# Opportunity canvas

Template id: `opportunity-canvas`
Responsible skills: `opportunity-management:problem-framing` (sections 1 to 3), `opportunity-management:ai-suitability`
(section 4) and `opportunity-management:risk-classification` (section 5)

One canvas per opportunity, carried from intake to decision. An opportunity does not enter delivery until sections 1 to
5 are complete. Anything not yet known stays marked `[To confirm: ...]`; never estimate a figure and record it as measured.

## 1. Request

| Field | Value |
|---|---|
| Opportunity reference | [To confirm: reference] |
| Date received | [To confirm: date] |
| Raised by (role) | [To confirm: role, for example a Champion or manager] |
| Original request, verbatim | [To confirm: request in the requester's words] |
| Candidate solution named by requester, if any | [To confirm: solution, recorded for suitability to test] |

## 2. Framed problem

| Field | Value |
|---|---|
| Problem statement (no technology named) | [To confirm: one or two sentences] |
| Business owner (role) and date agreed | [To confirm: role and date] |
| Affected roles and approximate numbers | [To confirm: roles and numbers] |
| Current cost (time, delay, quality, risk or experience) | [To confirm: description and measure] |
| Baseline | [To confirm: measured value, or how and by when it will be measured] |
| Expected outcome | [To confirm: change sought in the measure] |
| Strategic outcome supported | [To confirm: outcome reference, or "none"] |
| Possible duplicates elsewhere | [To confirm: references, or "none found"] |
| Early problem type (process issue, education gap, repetitive task, knowledge issue, business data workflow) | [To confirm: type, a signal for suitability rather than a decision] |
| Backlog entry reference and stage | [To confirm: reference; capture, assessment, delivery, live or value tracking] |

Fictional example, for illustration only: "Contract managers spend most of Monday compiling site reports from emails,
and a third of reports arrive late."

## 3. Early signals

| Signal | Yes, no or to confirm | Note |
|---|---|---|
| Personal, confidential or regulated data involved | [To confirm: answer] | [To confirm: note] |
| Outputs reach customers, partners or the public | [To confirm: answer] | [To confirm: note] |
| Informs decisions about people, money, safety or rights | [To confirm: answer] | [To confirm: note] |
| Relies on knowledge with no clear owner | [To confirm: answer] | [To confirm: note] |

Framing status: [To confirm: framed, awaiting owner, awaiting baseline, stopped (with reason) or merged]

## 4. AI suitability decision

| Field | Value |
|---|---|
| Rung chosen (0 no AI to 6 engineered solution), per part if combined | [To confirm: rung] |
| Rungs rejected and why | [To confirm: reasons] |
| Why AI beats process change, ordinary automation, training or an existing capability | [To confirm: reasoning, or "AI not recommended"] |
| Preconditions | [To confirm: preconditions] |
| Open questions | [To confirm: questions] |
| Decided by (role) and date | [To confirm: role and date] |

## 5. Risk tier record

Rate each factor 0 to 4 with one sentence of evidence. The tier is the highest rating, never an average. Anything shared
beyond its creator is at least tier 1. Tiers are a proposed CopilotForge convention to validate against local policy.

| Factor | Rating | Evidence |
|---|---|---|
| Impact if wrong | [To confirm: rating] | [To confirm: evidence] |
| Reach | [To confirm: rating] | [To confirm: evidence] |
| Data sensitivity | [To confirm: rating] | [To confirm: evidence] |
| Autonomy | [To confirm: rating] | [To confirm: evidence] |

| Field | Value |
|---|---|
| Risk tier | [To confirm: 0 to 4] |
| Minimum governance posture | [To confirm: posture for the tier] |
| Reviewer gates required | [To confirm: for example security-privacy, evaluation-quality, design-authority, responsible-ai] |
| Gate evidence the delivery team must produce | [To confirm: evidence by gate] |
| Redesign options considered (reach, data, autonomy) | [To confirm: options and decision] |
| Security and privacy record (tier 2 and above) | [To confirm: ai-risk-assessment reference] |
| Re-classification triggers | Wider audience, new data or connectors, new actions, external exposure, change of owner, incident |
| Governance areas checked (security, privacy, data ownership, compliance, human accountability) | [To confirm: answer or gap for each] |
| Human role accountable for outcomes | [To confirm: role] |
| Data and knowledge owners | [To confirm: roles] |
| Classified by (role) and date | [To confirm: role and date] |
| Tier lowered? Rationale and risk owner | [To confirm: rationale, or "not lowered"] |

## 6. Readiness to enter delivery

| Gate condition | Met |
|---|---|
| Named business owner | [To confirm: yes or no] |
| Clear problem statement | [To confirm: yes or no] |
| Expected outcome and baseline (or plan) | [To confirm: yes or no] |
| Initial risk classification | [To confirm: yes or no] |
| Explicit suitability decision | [To confirm: yes or no] |
| Backlog entry with owner, priority, estimated value, return estimate and status | [To confirm: yes or no] |

No entry in the backlog means no project.

> Credit: Template from CopilotForge by Simon Foote (https://github.com/SimonFoote-greensparx/CopilotForge), licensed under CC BY 4.0. Keep this credit when you share or adapt the template; in your own completed document you may keep it as a footer or remove it.