Examples of work agentic AI can automate 3 of 7
Investigation and response to security risks affecting your systems
This hypothetical example begins with an update notice for a library used to display attachments in an internal portal. The notice describes a possibility that one user could see another user's attachments. The team checks whether its use is affected, then obtains separate approvals for testing the update and applying it to the live system.
Attachment display library: security update notice
Hello system administrators,
Thank you for using the attachment display library. We have released a security update for the attachment display feature.
With the affected versions and settings, a user may be able to view another user's attachments.
Please check the following to assess whether your system is affected:
- The library version currently running
- Whether the attachment display feature is in use
- The paths and settings through which users access attachment display
If your system is affected, please consider updating after checking the change in a test environment.
This notice does not establish that any particular system is affected or that information has been exposed. Please reply to this email if you have questions.
Kind regards, Library Maintenance Team
Assess the impact and test before changing the live system
An update notice does not make a live update an immediate next step. The team needs to check whether it uses the affected version and feature, then confirm that normal work and access permissions still function after the change.
The coordinator reads the update notice and compares the configuration record with the running system. Outdated records or unclear usage require confirmation from the person responsible for the system.
If action is needed, the coordinator tests the update in a separate environment and checks normal attachment display and access permissions. The owner reviews the results before approving the live update. Checks are repeated after that update, and the configuration and work records are revised.
The work extends beyond reading the notice: staff must track usage checks, test results, approvals and verification after the live update.
When an AI agent investigates, tests and carries out approved updates
In this example, the agent compares information it is permitted to read and presents its findings and test plan in Teams. The owner first approves work in the test environment, then reviews the results before making a separate decision on the live update.
Microsoft TeamsAttachment library assessment and update plan
Sato, the portal is running a version covered by the update notice and uses the affected attachment display feature. Users reach it after signing in to the internal portal. I have attached the comparison with the configuration record and the owner's confirmations.
I propose updating the test environment first and checking the items below. Please approve this test work.
Proposed test update and checks
- Scope: the internal portal's test environment
- Change: update the attachment library to the fixed version
- Checks: normal attachment display, denial of unauthorized attachment access, and the running version
- Use the designated check accounts and files
I have reviewed the running configuration and findings. I approve the proposed update and checks in the test environment using the designated accounts and files. Proceed through testing, then bring back the results so I can decide on the live update.
I updated the test environment and completed the approved checks. Authorized attachments displayed correctly, and unauthorized attachment access was denied. I also verified the running version. The test results and proposed live update plan are attached.
I propose carrying out the live update and checks today from 20:00 to 20:30 Japan Standard Time. May I proceed with this plan?
Live update plan / Separate approval required
- Scope: the internal portal's attachment display library
- Window: today, 20:00–20:30 Japan Standard Time
- Start condition: the running configuration matches the reviewed configuration
- After updating: check operation and access permissions with designated accounts and files, then update the configuration record
- If display or access checks fail: stop the work, restore the previous version using the attached procedure and recheck. Report remaining risks and unverified items as incomplete work
I have reviewed the test results. I approve the proposed live update, operation and access checks, and configuration record update today from 20:00 to 20:30 Japan Standard Time. Hold the work if the start condition is not met. If checks fail, restore the previous version using the attached conditions and procedure.
I checked the start condition and applied the fixed version within the approved window. Using the designated accounts and files, I checked normal attachment display and access permissions, then verified the running version.
I updated the configuration record and saved the check results and approvals. No items in the agreed checks remain incomplete. These results do not cover features outside the agreed scope.
- AssessmentRunning version, feature and access path
- Test resultsApproved checks
- Live work recordUpdate, checks and approvals
- Configuration recordUpdated version
The agent handles permitted investigation, test planning, approved updates and checks, and record keeping. The owner decides whether action is needed in light of its business impact and separately approves testing and the live update.
Unknowns, missing permissions, failed tests and failed updates are reported as incomplete. Changed conditions pause the work for review. Restoring the previous version follows the approved conditions and procedure, but may leave the security issue unresolved. Remaining risks and unverified items are reported to the owner.
Report unknowns, missing permissions, failed tests or updates, and residual risk after rollback to the owner as incomplete work
Business events and how an AI agent responds
From an update notice to missing information or failed tests, these examples show how the response changes as the work progresses.
AI agent
Detects a trigger and starts the work
-
What starts the work
An update notice arrives
A fix is available for the attachment display library.
What people receive
Impact assessment prepared
I checked the version and feature in use. Please review the findings and proposed test update.
-
What starts the work
The record and running version differ
The running version does not match the configuration record.
What people receive
Differences referred for review
I listed the differences and what I could verify. The update is on hold while unknowns are resolved.
-
What starts the work
Test work is approved
Carry out the proposed update and checks in the test environment.
What people receive
Results and a live plan prepared
I completed the approved checks. The live system is unchanged. Please review the results and live update plan.
-
What starts the work
An attachment fails to display in testing
After the update, an attachment that should be visible does not display.
What people receive
The problem is reported before release
I recorded the failed check and its results. The live update is on hold pending a decision.
-
What starts the work
The live update plan is approved
Update and check the live system within the specified window and conditions.
What people receive
Results and records reported
I applied the approved update and checked operation and access permissions. The configuration and work records are updated.
-
What starts the work
A check fails after the live update
One of the approved checks did not pass.
What people receive
The approved recovery procedure is used
I restored the previous version under the approved conditions. The work remains incomplete; I am reporting the results and remaining risk.
Bring together the information needed to decide, update and verify
Connect the external notice with actual usage, and carry the work through assessment, testing and verification after the update.
The owner uses the evidence and test results to judge business impact and timing. The agent handles the work and records within that approved scope.
Start with one system and one type of update. Review missed information, pending approvals and unverified items before deciding how much work to delegate.
Talk about your workflowExplore other use cases
View more
Procedures and FAQs
Detection and correction of conflicting internal information
AI checks whether meeting decisions, procedures, and customer guidance agree. It confirms official decisions and exceptions with the people responsible and prepares revisions. Following approval, it updates documents, shares them with the relevant people, and verifies that the changes are reflected.
Customer support
First response to after-hours inquiries
Review an inquiry received after hours against response rules and earlier cases. Prepare a reply within the permitted scope and hand uncertain cases to staff with the findings.