Do I need to know what should be automated?

No. Most people arrive with a feeling rather than a specification — something takes too long, or only one person can do it, or it gets dropped whenever the week is busy. That is enough to start from. If you can point at one job you would gladly stop doing by hand, we can work with that. If you can’t point at one yet, start with the free diagnostic instead: it finds the constraint first, and the workflow follows from it.

What happens with the first workflow?

We build it. You describe the job the way you would explain it to somebody starting on Monday — what comes in, what you would check, what should go out, and what you would never let leave without reading it. That becomes a working workflow, connected to the tools you already use, running on your account. You watch it run on real work before you rely on it. One workflow, start to finish, so what you are judging is a thing that works rather than a proposal for one.

What happens after that?

It runs. Keeping it running is the recurring part — hosting, the models it calls, monitoring, and the fixes for when something upstream changes its mind about a field name. Most people then add a second workflow, and it is usually one they spotted themselves while watching the first one work. There is no bundle to commit to up front. The next workflow is a decision you make when you want it, and not before.

Can my team eventually build workflows themselves?

That is the intended end state, and the training exists for it. Once your team has watched a few workflows get built, the skill turns out to be the describing — knowing what the work actually involves and where the judgment sits — which is the part your team already has. Some businesses would rather we kept building, and that is a legitimate choice rather than a failure. Most want at least one person inside who can change something without picking up the phone.

Do I become dependent on hmn.plus?

It is the right question to ask any vendor, and the honest answer is that you can be for exactly as long as it is useful. Three things are deliberate: the workflows are described in plain language rather than locked in a format only we can read, they run on infrastructure that can sit in your own name, and we teach the building instead of keeping it. Being the only people who can change your systems would be a business model. It is not ours.

Can we eventually own the system?

Yes, and it is an option rather than a destination — plenty of businesses would rather we kept running it, and that is a reasonable thing to want. When you do want it, the workflows, their definitions and the infrastructure transfer to you, and your team keeps the training that makes them usable. We would rather you stayed because staying is worth it.

The first automation is a fixed price, so the first decision is a small one: NZ$500 + GST to map it and get it built. After that, the platform it runs on is NZ$150 + GST a month for each person who builds workflows — everyone else who uses it is free — and that covers hosting, running your workflows, monitoring and support. Workflows you build yourself cost nothing extra; the ones we build are quoted one at a time, on what each actually involves. No annual lock-in, and nothing larger to sign before you have seen something of your own working.

Why not use ChatGPT, Claude, Zapier or n8n?

They answer a different question. Chat tools put something capable on the other end of a conversation, and then nothing happens unless a person types — every session starts again, and what the business knows ends up living in whoever writes the best prompt. Zapier and n8n wire apps to each other; the wiring holds until a field name changes, and it never makes a judgment call. Both leave the work depending on a particular person. What we build has a fixed shape: the same steps in the same order, your rules written in, a record of every action and the reason for it, and a person standing where a person should stand. The thinking inside a step can be as sharp as it needs to be. The path through it does not change because somebody phrased something differently. That is the difference between a tool one person is good at and a system a business runs on.

Where should AI actually be used?

On the judgment inside a step, not on the whole step. Reading an enquiry and working out what kind it is: yes. Drafting a reply in your voice, from your own past replies: yes. Moving money, or telling a client something binding, with nobody looking: no. What we build to is that anything with consequences waits for a person, and everything in front of it does not have to. A faster version of a bad process is still a bad process, which is why deciding where AI belongs happens before anything gets built, and is most of the value.

AI Workflow Governance: Secure Your AI Processes

The trust advantage: a double-edged sword

Small firms often thrive on trust. It's a catalyst for quick decisions and collaborative synergy. However, when it comes to AI-generated workflows, trust must be replaced with caution. As efficient and secure as AI orchestration with workflow definitions and scripts is, gaps remain if governance isn't embedded from the start.

Imagine allowing staff unfettered access to AI tools. Without proper checks, you risk accidental cross-department access. This isn't hypothetical; it's an inevitable challenge for organizations embracing AI.

The foundational security triad: admin rights, visibility, and data control

To ensure secure AI usage, start with the basics—admin and user rights. Limit privileges based on individual roles. It's not just about controlling access, but controlling what users can do with that access. Role-based access control (RBAC) is critical here.

Visibility controls also need serious attention. Who can see what, when, and why? Define these parameters clearly. Limit AI's access to sensitive data by creating a tiered data structure. Allow read/write where essential, but keep it restricted by default.

Scripting service-level operation scopes

Next, consider service-level operation scoping. Delineate what each service can perform—read, write, delete, or admin tasks. By scoping operations, you prevent AI from having unchecked access to information it's not meant to handle.

An often overlooked aspect is actor kill switches. These act as emergency brakes, enabling you to halt AI operations quickly. It’s a safety net should anything go awry, providing more human per hour in crisis management.

Security management: from keys to audit trails

Good governance also involves strategic management of security keys and credentials. Isolate these carefully to avoid undesired access or data leaks. Treat them as you would a master key—not to be duplicated or shared freely.

Finally, let’s not overlook audit logging. It's your accountability partner. Implement robust logging to track who accesses what and when. This provides a trail of digital footprints, crucial in tracing errors or unauthorized actions.

Why governance must be intrinsic to workflow design

The temptation is to bolt on governance measures once a system is live. Resist this. Instead, bake security governance into the workflow schema itself. A well-designed governance framework acknowledges potential risks and mitigates them as the system evolves.

Without this, the risk of misuse or accidental exposure grows. Especially when staff—with high AI literacy—have access to AI tools. The stakes are higher, and so should be your commitment to a secure AI landscape.

In the end, security is the new frontier of AI automation. It's about more than just risk aversion. It's about creating an ecosystem where AI can be fully harnessed without compromising data integrity or consumer trust.

At hmn.plus, we ensured our AI workflows were secure from inception. Our approach prioritizes governance, recognizing it's as crucial as the AI tools themselves. By embedding these principles, we've not only closed security gaps before they open but also fostered a more secure, innovative environment.