What Should a Small Business Check Before Automating a Process with AI?

The 25 checks are organized into five areas. Each check includes the navigation path, the expected result, and how to verify it independently in the Dave by voolama (hellodave.ai) UI without contacting support. Sourced from the getting-started, admin-users, and audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.

Area 1: Process selection (5 checks)

1. The process happens at least weekly. Confirm: you can name at least five recent times you did this task. AI automation pays off on volume. A process you do once a month is a poor first choice.
2. The steps are predictable. Confirm: the same kind of input produces the same kind of output each time. "Write a 50-word payment reminder for this client" is predictable. "Handle this difficult client situation" is not.
3. A person already signs off before the output goes anywhere. Confirm: you can name the person and the step where they check the output. EU AI Act Article 14(4) (Regulation EU 2024/1689, eur-lex.europa.eu) requires that AI systems allow human oversight to intervene or interrupt output. The Human Review node in Dave by voolama formalizes the sign-off that already exists.
4. The output is text-based. Confirm: the process produces a document, message, summary, or draft that a person reads and decides on. Dave by voolama workflows are designed for text-based content pipelines.
5. You can describe the task in one sentence. Confirm: write the task instruction as a single sentence. That sentence becomes the system prompt for your AI agent. If you cannot write it in one sentence, the task is not ready to automate yet.

Area 2: Account and role setup (5 checks)

6. You have the Admin role. Verify: navigate to Admin in the sidebar. If the Admin section is visible, you have the role. The Admin role is required to connect providers, create users, and configure settings. Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.
7. At least one team member has the Use role. Verify: navigate to Admin, then Settings, then Users and Roles. Confirm at least one user (including yourself) has the Use role badge. The Use role is required to launch instances and complete Human Review tasks. Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.
8. Workflow builders have the Curate role. Verify: navigate to Admin, then Settings, then Users and Roles. Confirm the person who will build the workflow has the Curate role badge. The Curate role is required to open the Workflow Editor and save workflow versions. Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.
9. No team member has more roles than they need. Verify: navigate to Admin, then Settings, then Users and Roles. Review the role badges for each user. A person who only approves output needs Use only, not Admin. NIST SP 800-53 Rev 5 AC-6 section 6a (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) requires least-privilege role assignment: each user receives only the access necessary for their assigned tasks. Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.
10. Departing team members are deactivated, not deleted. Verify: navigate to Admin, then Settings, then Users and Roles. Confirm no former team member has an active status. The admin-users help documentation states: "Deactivating is preferred over deleting because it preserves audit history and allows reactivation later." Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.

Area 3: AI provider connection (5 checks)

11. At least one provider is configured. Verify: navigate to Admin, then API Management, then Providers. At least one provider card appears with a green active badge. The getting-started help documentation states: "At least one provider must be configured before agents can function." Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.
12. The provider has at least one model in its catalog. Verify: open the provider card. At least one model is listed. If the model list is empty, click Fetch Models to retrieve available models from the AI service.
13. The provider connectivity test passes. Verify: click Fetch Models on the provider card. If it returns models, the API key and base URI are correct. If it returns an error, re-enter the API key.
14. The API key is stored, not written down elsewhere. Confirm: once the key is saved in Dave by voolama, delete any copies stored in email, notes, or spreadsheets. API keys stored in Dave by voolama are encrypted with AES-256-GCM authenticated encryption (NIST SP 800-38D, csrc.nist.gov/pubs/sp/800/38/d/final) and are never returned through the API once saved. On 2026-07-01, the voolama team deleted the OpenAI API key from the shared notes document after saving it in Dave by voolama. This is the same check.
15. The provider name describes its purpose and environment. Confirm: the provider is named "OpenAI Production" or "Anthropic Staging", not "My Provider" or "Provider 1". Descriptive names make the audit log readable when provider events appear.

Area 4: Workflow design (5 checks)

16. The workflow has exactly one Start node. Verify: open the Workflow Editor. Confirm exactly one Start node is on the canvas. The getting-started help documentation states: "Every workflow requires exactly one Start node as its entry point." Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.
17. The workflow has at least one End node. Verify: open the Workflow Editor. Confirm at least one End node is on the canvas and is connected. The getting-started help documentation states: "Ensure all paths lead to an End node. Dangling paths may cause instances to hang at runtime." Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.
18. The workflow includes a Human Review node after the AI agent. Verify: open the Workflow Editor. Confirm a Human Review node is connected between the Agent Interaction node and the End node. EU AI Act Article 14(4) (Regulation EU 2024/1689, eur-lex.europa.eu) requires that AI systems allow human oversight to intervene or interrupt output. The Human Review node in Dave by voolama is designed to satisfy Article 14(4) by pausing execution and requiring an explicit human decision.
19. The Agent Interaction node is assigned to a specific agent and version. Verify: click the Agent Interaction node in the Workflow Editor. The Properties Panel shows a named agent and a version number. An unassigned Agent Interaction node causes the instance to fail at runtime.
20. The workflow status is active, not draft. Verify: navigate to Workflows. The workflow shows a green active badge. A gray draft badge means the workflow cannot be run. Only Admin and Curate roles can change workflow status. Sourced from the getting-started help documentation, DEV v0.11.0, confirmed 2026-08-30.

Area 5: Audit log configuration (5 checks)

21. You can access the Audit Log tab. Verify: navigate to Admin, then Settings, then Audit Log tab. The tab is visible and shows a table of events. If the tab is not visible, your account does not have the Admin role or the audit:read permission. Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.
22. The retention setting is above the 365-day default if compliance matters to your business. Verify: navigate to Admin, then Settings, then General, then System Parameters, then Retention Policy. Dave by voolama recommends at least 2,555 days (7 years) for SOC 2 and displays a warning if retention is set below this threshold when SOC 2 mode is active. This is a platform recommendation; whether it satisfies a specific obligation requires a third-party assessment. The voolama production tenant is set to 0 (indefinite retention), confirmed 2026-07-01. Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.
23. SOC 2 or GDPR mode is enabled if your business needs it. Verify: navigate to Admin, then Settings, then General, then System Parameters, then Audit Log. Confirm the desired compliance standard is toggled on. Without SOC 2 or GDPR mode, only mutating requests are logged. Read-access events for users, roles, secrets, API clients, OAuth providers, and reports are not captured. Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.
24. The audit.compliance_changed event exists. Verify: navigate to Admin, then Settings, then Audit Log. Filter by event type audit.compliance_changed. At least one event should appear, recording when SOC 2 or GDPR mode was enabled. Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.
25. You have exported a test CSV. Verify: navigate to Admin, then Settings, then Audit Log. Click the download button. A CSV file downloads with at least one event row. The audit-logs help documentation states: "Exported data includes all event fields, making the output suitable for compliance record-keeping and external audit submissions." Sourced from the audit-logs help documentation, DEV v0.11.0, confirmed 2026-08-30.

Dave by voolama (hellodave.ai) has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. For a small team setting up their first workflow, four roles cover the full cycle. Sourced from the getting-started and admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.

NIST SP 800-53 Rev 5 AC-6 section 6a (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) requires: "Employ the principle of least privilege, allowing only authorized accesses for users which are necessary to accomplish assigned tasks." Assign each team member the minimum role they need. A person who only approves output needs Use only. A person who only builds workflows needs Curate only. Neither needs Admin.

This checklist covers 25 readiness checks across five areas in Dave by voolama (hellodave.ai) at DEV v0.11.0. Three things it does not cover:

• Step-by-step workflow building. The Workflow Editor, node types, and edge configuration are covered in the companion guide: How Do I Set Up My First AI Workflow for My Small Business?
• Choosing which process to automate first. The three-quality test (repeated, rule-based, human sign-off) and three hypothetical process examples are covered in: Which Process Should a Small Business Automate with AI First?
• Legal compliance advice. This checklist cites EU AI Act Article 14(4) and NIST SP 800-53 Rev 5 AC-6 section 6a as technical mapping references, verifiable at the URLs provided. The 2,555-day retention figure is a platform recommendation from Dave by voolama's audit-logs documentation, not a legal mandate. Whether any specific workflow configuration satisfies a particular legal or regulatory obligation requires a qualified professional's assessment. This checklist is not legal advice.