CCAO-F · Governance, Risk, and Responsible Use
Appropriate and inappropriate use cases: human in the loop
A manager at a bank has three finalists for a team lead role. She has the interview notes from a four-person panel, the rubric and a work sample from each candidate. She is behind and wants Claude to read everything, choose the best one and draft rejection emails for the other two, to go out that same afternoon. HR has already confirmed the notes can be used in the approved workspace.
The problem is not the data: it is authorized. The problem is who decides.
The rule: Claude prepares, a person decides
Some decisions change someone’s life: hiring, dismissing, granting or denying credit, recommending an investment, rating performance that sets a bonus. In a high-stakes decision for a person, the final call is made by a qualified person who can explain it and answer for it. That is having a human in the loop.
Claude does have a place in these tasks, in the preparation:
- organizing each candidate’s evidence against the rubric;
- summarizing the panel’s notes and flagging where interviewers disagree;
- building a comparison table for the decision meeting;
- drafting emails that the person reviews and sends once the decision has been made.
The panel decides better and faster, and responsibility stays where it was.
The two wrong extremes
| Extreme | Why it fails |
|---|---|
| “Let Claude decide, it applies the same rubric to everyone without bias” | Removing the person does not remove bias, it hides it; and nobody can answer for the decision |
| “Let Claude decide, but have it explain its reasoning in the email” | Explaining does not make it appropriate for AI to decide about a person |
| “Don’t use Claude for anything to do with hiring” | It loses the time saving in the part that is appropriate |
Where to start
When a team builds its list of first use cases, it is best to start with the low risk ones: those that decide nothing about anyone and that a person reviews before use, as already happens with any draft.
Good to start with:
- internal drafts (a procedure, minutes, a how-to) that someone reviews;
- summaries of public reports for an internal meeting;
- organizing scattered notes, grouping ideas from a brainstorm.
Inappropriate, or for a later phase with compliance involved:
- approving or rejecting customer requests and notifying them directly;
- sending financial or medical recommendations without a professional in between;
- publishing content that poses as something it is not (“customer” reviews, texts signed by someone who did not write them).
To recognize an appropriate use case, ask three questions: does it decide something about a person? does someone review it before it goes out? does it deceive whoever receives it? If the first is yes, Claude prepares and a person decides. If the second is no, a control is missing. If the third is yes, it is not a use case.
The typical traps
- Trusting the “objectivity” of AI for decisions about people.
- Letting Claude decide and adding an explanation as if that fixed it.
- Banning all use in a department instead of separating preparation from decision.
- Choosing the most eye-catching case for the pilot (approving credit) instead of the safest.
- Published content that deceives about who wrote it.
On the exam
If the scenario asks Claude to choose, approve or reject something that affects a person, look for the option where Claude organizes the information and a qualified person decides. If it asks you to pick use cases to start with, keep the reviewed internal drafts and summaries, and rule out the ones that decide about customers or deceive. Be wary of both “let the AI decide” and “don’t use it at all.”
Quick question
A practice exam question on this domain. It counts towards your progress.
A marketing manager at a home fitness start-up is preparing the landing page for a new smart rowing machine that launches in three weeks. The design agency left space for four customer testimonials with first names, cities and star ratings, but the product has not shipped to anyone yet.
She asks Claude to write four realistic testimonials, each with a different name and city, so the page looks complete for launch day. The page will be promoted with a paid campaign and the founders are keen to have social proof from the start.
What is the most appropriate response to this plan?