Directing the Agent

Give an AI agent access to a forensic schedule engine and it will do exactly what you tell it. That is both its greatest strength and the reason it can waste your entire afternoon.

In a previous post, we described the division of labor between the tool, the agent, and the analyst. The tool computes. The agent navigates. The analyst drives. What we left undeveloped was the steering mechanism itself: how does an analyst actually direct an AI agent through a forensic investigation?

The answer is surprisingly old-fashioned. You write it down.

The Agent Without a Playbook

Imagine handing a junior analyst a project with 40 schedule updates and saying "find the delays." They would open the first update, start poking around, notice something interesting in Window 3, spend four hours on it, and surface with a detailed finding about a single activity. Meanwhile, the actual story of the project lives in the pattern across all 40 updates, and they never got past the first thing that caught their eye.

AI agents fail the same way. They are thorough, fast, and relentless. They will happily drill into the first anomaly they find and produce a comprehensive analysis of something that turns out to be immaterial. The problem is never capability. The problem is sequence.

An experienced analyst knows to scan first and drill second. Look at the milestone trend across all updates. See where the completion date jumped. Note where the critical path shifted. Build the map of the whole project before picking a spot to dig. That instinct takes years to develop. An agent can acquire it in a paragraph.

SOPs Are Agent Instructions

A standard operating procedure for forensic analysis is nothing new. Firms have had them for decades: checklists for data collection, steps for baseline validation, frameworks for delay attribution. What changes with AI agents is that the SOP becomes directly executable. The analyst writes the procedure; the agent follows it.

This is a different relationship than clicking buttons in software. A button encodes one developer's idea of what you might want to do. An SOP encodes your idea of what needs to happen for this engagement. The specificity is the point. A manipulation detection procedure for a highway project with suspected duration inflation looks different from one for a commercial building with suspected logic rerouting. The underlying tools are the same. The playbook is not.

The second version takes the analyst five minutes to write. It saves hours of misdirected agent effort. And it produces something the analyst can actually use: a structured overview of the project that frames every subsequent investigation.

Reconnaissance Before Deep Dives

The single most important principle in agent-directed forensic analysis is: scan first, drill second. We call the scanning pass "reconnaissance," and it is the step most people skip.

Reconnaissance means processing every analysis window mechanically. For each consecutive schedule pair, produce a compact summary: how much did the completion date move, what drove it, did the critical path shift, what were the largest impacts. No interpretation. No deep dives. Just structured observations, one per window, covering the entire project.

This is exactly the kind of work agents excel at. It is repetitive, well-defined, and parallelizable. An agent (or several agents working in parallel) can produce window summaries for a 40-update project faster than a human can open the first two schedules in P6. And the output is consistent: every window gets the same treatment, with no fatigue-induced shortcuts for Window 35 that didn't apply to Window 3.

What happens next is where the analyst earns their fee. With the full set of window summaries in hand, patterns emerge that no single-window analysis would reveal. A critical path that quietly shifted in Window 8 and never shifted back. A calendar that had holidays stripped and restored in alternating updates. An activity that showed up as a top delay driver in twelve consecutive windows despite never actually progressing. These patterns are invisible when you are heads-down in one window. They are obvious when you have the full map.

Steps 1 and 4 are agent work. Steps 2 and 3 are analyst work. Step 5 is both. The SOP defines how each step executes.

What Goes Into an SOP

A forensic analysis SOP is not a general methodology document. AACE 29R-03 is a methodology document. An SOP is the specific procedure for executing that methodology on a specific type of engagement, using specific tools, with specific quality gates.

At minimum, an effective SOP covers:

• Data requirements: What schedule files, contract documents, and correspondence does the analyst need before analysis can begin? What makes a dataset incomplete, and what do you do about gaps?
• Validation steps: How do you confirm the schedule data is trustworthy? Recalculating CPM from raw network data rather than trusting stored dates. Checking for post-status edits. Verifying baseline approval.
• Analysis sequence: What gets analyzed first, second, third? Which analyses depend on the results of others? Reconnaissance before deep dives. Critical path evolution before manipulation detection. Contract review before delay attribution.
• Quality gates: What must be true before proceeding to the next phase? All window summaries complete before targeting deep dives. All critical-priority items investigated before moving to medium-priority. All findings validated before they enter the report.
• Red flag protocols: What does the analyst do when a tool output does not make sense? When two analyses produce contradictory results? When a finding is adverse to the client's position? These are the moments where human judgment is non-negotiable.

None of this is software. All of it determines whether the software produces useful results.

The Analyst's Real Leverage

There is a natural anxiety about AI in expert disciplines. If the tool can run the analysis, what is the expert for? The answer, in forensic schedule analysis, is direction and judgment.

The analyst who writes the SOP controls the investigation. They decide which methodology applies. They decide which windows warrant deep investigation. They interpret findings against contract provisions. They determine whether a pattern indicates manipulation or legitimate re-sequencing. They build the narrative that survives cross-examination. None of that is automatable, because all of it requires understanding the specific context of a specific dispute.

What the analyst no longer has to do is the mechanical work that used to consume most of their time. Clicking through P6 filters for every update. Manually comparing logic networks. Building spreadsheets to track activity histories across dozens of snapshots. That work now happens computationally, directed by the analyst's SOP, executed by agents with access to tools like FPM's MCP server.

The analyst who invests in their SOPs will outperform the analyst who invests in faster hardware. The bottleneck was never computation. It was always knowing what to compute, in what order, and what the results mean.

Getting Started

If you are running forensic schedule analyses today, you already have SOPs. They might be in a procedures manual. They might be in the senior analyst's head. They might be in the unwritten habits of the firm. The first step is making them explicit, specific enough that someone who has never worked your engagements could follow them. That level of specificity is what makes them executable by an agent.

Start with the phase you repeat most often. For many firms, that is the window-by-window analysis: for each pair of consecutive schedule updates, what changed, what drove the milestone, how much did the completion date move? Write the steps. Specify what data to pull and what to look for. Define what triggers further investigation versus what gets noted and moved past.

Then hand that procedure to an agent with the right tools and watch it work. The first run will not be perfect. You will find that some instructions are ambiguous, some steps need reordering, and some outputs need a different format. That is the refinement loop. Each engagement makes the SOP better, and each improvement compounds across every future project.

The firms that will lead forensic schedule analysis in the next decade will not be the ones with the most powerful software. They will be the ones with the most refined playbooks for directing that software toward the questions that win cases.