JB's Case Notes #1
Problem Statement
A business request lands in chat as one sentence. The secure answer is a firewall policy with users, applications, zones, conditions, and compliance checks. During user testing, we found that administrators struggled to keep both the business request and the technical implementation in the same thread.
Solution №1 — Drop the policy in the chat
Easiest idea: when Copilot gets the request, paste the draft policy into the next message. Users, apps, rules—right there in the thread.
Or a small card in the reply—“here's the policy”—so you don't even need another screen?
Allow doctors to securely access Electronic Health Records from hospital-managed devices
Got it — here’s a draft policy for that request. Users, apps, and rules are in the card below.
Doctors → EHR access
- AllowDoctors-AD-Group → EHR-App · HTTPS 443
- DenyNurses → EHR-App · explicit block
- DenyAll others → EHR-App · default deny
Also exclude contractors from EHR, and log every allow path
Updated — contractors denied, logging on. The draft is still in the message above if you need to review or approve it.
Should managed tablets count, or only workstations?
Including tablets. Scroll up for the card — Edit and Approve are still attached to that earlier reply.
New replies keep landing. The draft stays put. History grows over the work.
Honestly, it helps for a first look. You can see what the AI thought you meant. But the moment you send another message, that draft is gone. Scroll up. Dig. Hope you find the right block.
And chat is a bad place to review something you might edit and approve. A policy isn't a paragraph.
The thread starts to feel like the finished work. It isn't. The policy is.
So maybe the chat and the policy shouldn't share the same box...
Solution №2 — Keep them side by side
What if chat stays on the left for the conversation, and the policy opens on the right—and stays there while you keep talking?
I didn't want a second app. Just two clear jobs: talk about intent on one side, look at the draft on the other. Ask a follow-up, the draft updates in place—no new wall of text.
Still—if the right side opens with a full policy too early, it feels like the AI answered before it listened. How do we fix that?
Show the reading first. Who's involved, which apps, what kind of access—before any firewall rules. People correct the meaning. Then the policy comes second.
When something changes on the right, say what changed and why. And keep Approve separate from chatting. Talking is for figuring it out. Approving is a real decision—someone has to own it.
Business intent
Secure EHR access for doctors on hospital-managed devices
AI interpretation
Doctors-AD-Group → EHR-Application · HTTPS 443 · session logging on allow path
Validation results
6 checks passed — compliance, duplicates, segmentation, and impact clear
Simulation insights
240 doctors in scope · 2 applications reachable · low impact
Optimisation opportunities
Enable audit logging — aligns with 3 similar clinical policies
Remaining risks
No blocking issues — nurses and contractors remain excluded
Approval readiness
Draft policy · clinical access request
Ready to approve
Checks passed · impact reviewed · human decision required
Human approval required
Policy Copilot prepared the draft. You own the decision to deploy to production.
A card in chat can still point at the draft—open it, keep history on the left—but the work stays on the desktop split. Chat is the journey. The policy is what you sign off.