Generative AI Workflow Risk

This white paper examines how generative AI use in workplace workflows can lead to destructive system actions, defective professional work, and unauthorized disclosure of restricted information. Its central assessment is that approving an AI tool or assigning a human reviewer does not establish control of the complete workflow. Drawing on Replit, Mata v. Avianca, and Deloitte, with Samsung included as a qualified reported incident, the paper traces how task definition, permissions, information handling, and human–AI interaction turn actions and outputs into business consequences. It distinguishes documented incidents from experimental research, technical evidence, and proposed safeguards. The analysis provides recommendations for validating objectives, restricting access and transmission, testing human review, and evaluating final outcomes. It identifies conditions supporting workflow expansion, restriction, or suspension. Written for security, governance, risk, operations, and professional-services leaders, the paper includes Chicago-style endnotes and a bibliography.