01 · The metric errorA full funnel can conceal an empty system
Imagine an organisation that has provisioned an AI writing assistant to every employee. The launch dashboard glows green: licences allocated, accounts activated, training completed. Yet approved documents still move through the old route, staff copy fragments between unconnected systems, reviewers discover more invented claims, and the people doing sensitive work quietly avoid the tool. The organisation has distributed software. It has not established adoption.
The familiar measures are not useless. A login shows that access credentials worked. A prompt shows that somebody tried an interaction. Repeated activity may indicate usefulness. None establishes that a recurring piece of work reached a better outcome after context, verification, exceptions, rework, workload and harm were considered. An activity measure becomes especially misleading when it rewards the behaviour it claims merely to observe. Tie prompt volume to performance ratings and prompts will rise. The evidence may become less truthful while unsafe use moves out of sight.
This article defines adoption as an emergent property of a work system. People adopt a changed way of accomplishing work inside a web of demand, tasks, roles, authority, information, capability, capacity, incentives, professional obligations, controls and consequences. Low use can therefore be a precise signal that the system is incomplete. High use can coexist with poor adoption when generated material creates errors, escalations or invisible checking labour. The governing question is not “Why will people not use it?” It is “What conditions make an appropriate use episode possible, worthwhile, legitimate, safe and learnable?”
Current evidence supports the distinction but does not license a universal adoption rate. UK government and ONS studies report uneven use across sectors and firm sizes, alongside barriers involving skills, cost, business need and integration. Their survey measures are population-bound and often self-reported. OECD employer and worker surveys add working conditions, training, trust and consultation, while the ILO finds heterogeneous changes to tasks, autonomy and job quality. These sources tell leaders where to look. They do not turn a reported productivity impression into audited value or causal proof.
02 · The unitTrace the outcome-producing use episode
The smallest useful unit is not a user. It is a recurring episode of work in which a defined actor uses or declines AI, obtains the necessary context, exercises judgment or delegated authority, completes controls, manages exceptions, hands work onward and contributes to an intended outcome.
Each episode record identifies the eligible work population and exclusions; the person, team and agent roles; model, tool, data, policy and workflow versions; required inputs and available context; and the choice to use, edit, override, escalate, abstain or stop. It captures verification, delay, rework and recovery, as well as notice, contestability and remedy for an affected party. It then connects output and decision to outcome, time, workload, cost, harm and distribution. Finally, it names the owner who can act on the learning signal.
A login cannot satisfy that record. Neither can a draft abandoned outside the document workflow. A successful episode may contain no generated output at all: a risk reviewer can inspect the case, recognise that the model is outside its validated boundary and document an abstention. That is not failed adoption. It is a system producing the right controlled behaviour. Conversely, an agent who copies a confident but incorrect answer into a customer record has completed a prompt and perhaps a transaction, but not a successful episode.
Thought experiment: identical users, different systems
Place the same capable analyst in two teams. In the first, approved data arrives in the working environment, authority is explicit, verification time is protected and exceptions reach a named owner. In the second, data must be copied manually, the manager rewards queue speed, and no one owns recovery. Different use is a predictable consequence of different systems, not evidence that the analyst acquired a new personality between floors.
03 · The conditionsSix coupled pairs make work possible
The Work-System Adoption Map is this article's synthesis of twelve conditions in six coupled pairs. It is a map, not a maturity scale. A population may have excellent capability and no authority, or sound integration and no valuable demand. Averaging the conditions would conceal the binding constraint.
Demand and outcome ask whether a real recurring trigger enters the workflow and whether the intended customer, worker, operational or financial result is explicit. Task and flow ask whether the AI contribution fits the whole task bundle and whether upstream inputs and downstream handoffs exist at the moment of work. A plausible demonstration fails both tests if it solves an occasional fragment outside the production sequence.
Role and authority identify the user, decision owner, verifier, exception owner and affected party, then test whether permission, delegation, override, escalation, abstention and stop rights can actually be exercised. Context and integration cover relevant data, policy, history and versions as well as the systems, channels and devices where work occurs. Nominal access on a desktop is not reachability for a night-shift worker using a managed handset.
Capability and capacity separate knowing how to frame, verify, challenge, explain and recover from having the time, staffing, support and cognitive room to do so. Legitimacy and learning connect incentives, professional standards, privacy, fairness, worker voice and social norms with feedback, incidents and outcomes reaching somebody empowered to change or stop the system. These conditions are population-specific. The binding condition for a remote contractor may be authentication; for a clinician, liability; for an agent, queue pressure; for a customer, recourse.
| Condition | Evidence in the episode | Failure signal | Owner | Possible intervention |
|---|---|---|---|---|
| Demand | Recurring trigger and eligible volume | Demonstration without live demand | Service owner | Narrow to an observed recurring event |
| Outcome | Defined result and comparison | Activity rises while value is unknown | Outcome owner | Attach a decision and outcome measure |
| Task | Full task bundle and hidden work | Useful fragment creates extra checking | Process owner | Redesign task allocation and verification |
| Flow | Inputs, sequence and handoffs work | Copying, waiting or abandoned output | Operations lead | Repair the smallest broken handoff |
| Role | Actor, verifier and exception owner named | Work falls between teams | Functional leader | Issue a role and interface contract |
| Authority | Usable rights to act, override and stop | Liability is unclear at decision time | Accountable executive | Grant bounded rights and escalation |
| Context | Approved data, policy, history and versions | Generic output ignores local facts | Data or policy owner | Provide governed retrieval and provenance |
| Integration | Tool present in actual channel and device | Parallel screens and manual transfer | Product owner | Embed or create a reliable handoff |
| Capability | Role-specific framing, checking and recovery | Plausible error passes unchallenged | Work leader | Use supervised real-work practice |
| Capacity | Time, staffing, support and attention funded | Queues displace verification | Operations owner | Rebalance load and service target |
| Legitimacy | Standards, voice, privacy and recourse | Shadow use or justified contest | Policy and workforce owners | Consult, repair rights or reject use |
| Learning | Exceptions and outcomes reach a change owner | Same failure recurs across versions | Product and risk owners | Create feedback, expiry and revalidation |
04 · The denominatorA population ledger prevents convenient arithmetic
The Adoption Population Ledger moves from Eligible to Reachable, Enabled, Attempted, Repeated, Embedded and Outcome-producing. Every stage has its own numerator, denominator and exclusions. People, tasks, episodes, decisions and outcomes remain separate units.
Eligible means the capability is relevant and permitted for defined work and people. Reachable means that eligible population can obtain it in the actual location, shift, channel and device. Enabled adds context, authority, capability, time and support. Attempted records a real episode, including documented abstention where that is the correct response. Repeated distinguishes work from a demonstration. Embedded means the changed practice survives normal workload, exceptions, handoffs, staff changes and competing priorities. Outcome-producing means verified benefit remains after error, rework, control load, harm and distribution are considered.
Cohorts cannot be silently collapsed. One person can perform many episodes, and one episode can involve several people. A global percentage can hide an inaccessible language group, an excluded contractor population or a high-consequence task that should rarely use automation. The ledger requires leaders to explain each exclusion and choose the next decision supported by that stage, rather than treating movement to the right as inherently good.
| Stage | Numerator | Denominator | Visible exclusion | Decision use |
|---|---|---|---|---|
| Eligible | Relevant, permitted work | Observed task population | Irrelevant or prohibited episodes | Confirm genuine demand |
| Reachable | Eligible work with practical access | Eligible cohort | Shift, device, location, language | Repair access or narrow scope |
| Enabled | Reachable work with all critical conditions | Reachable cohort | Context, authority, skill or capacity gap | Locate the binding condition |
| Attempted | Live episode or justified abstention | Enabled cohort | No trigger or declined episode | Observe behaviour without guessing motive |
| Repeated | More than a trial in the defined period | Attempted cohort | One-off, demo or exceptional work | Test recurrence and learning |
| Embedded | Practice survives ordinary pressure | Repeated cohort | Workload, turnover or handoff failure | Test operating durability |
| Outcome-producing | Verified net contribution | Embedded episodes | Error, rework, harm or displaced cost | Retain, adapt, narrow or stop |
Thought experiment: the denominator changes the verdict
A compliance team makes 2,000 decisions but permits AI support for only 200 low-ambiguity cases. Reviewers use it in 120, abstain with reasons in 60 and miss 20. Dividing 120 uses by 2,000 decisions produces six per cent and invites a campaign. Dividing 180 appropriate actions by 200 eligible episodes reveals a mostly functioning boundary and a precise twenty-episode problem. Neither figure proves outcome, but only the second respects the work.
05 · The diagnosisFriction is evidence before it is an obstacle
The Adoption Friction Ledger records observed behaviour without assigning a motive. It names the population, task, context, frequency and consequence; maps the affected condition; lists evidence and rivals; classifies the friction as protective, harmful or unresolved; and assigns an experiment, owner, expiry and rollback.
Protective friction is the deliberate difficulty that safeguards consequence, review or recourse. A second approval before an irreversible payment may be appropriate. Harmful friction adds no corresponding protection: repeated authentication, unavailable context, duplicate entry or a queue target that makes verification impossible. Unresolved friction is a hypothesis under test. A worker's decision to avoid a summarisation aid may reflect poor accuracy, slower review, unclear liability, professional identity, an accessibility problem or simply a weak product. Calling all of these “resistance” substitutes judgement for observation.
The ledger must also expose the cost of its own intervention. Removing a review step may reduce waiting while increasing error exposure. Adding a mandatory explanation may aid contestability but overload staff or exclude users of assistive technology. The proposed change therefore carries an enabling signal, an adverse signal, the new workload or risk it can create, and a date when the organisation will retain, adapt, narrow, replace or stop it.
| Observed behaviour | Plausible rival explanation | Effect | Small experiment | Owner |
|---|---|---|---|---|
| Staff keep the final approval | Consequence requires independent authority | Protective | Measure approval quality and delay before changing it | Decision owner |
| Drafts are copied between tools | Integration or approved-context gap | Harmful | Embed one document route for one cohort | Product owner |
| Clinicians avoid summaries | Review takes longer or liability is unclear | Unresolved | Timed shadow comparison with explicit authority | Clinical service owner |
| Agents skip verification | Queue target conflicts with control work | Harmful | Protect review time and compare rework | Operations lead |
| Risk reviewers abstain selectively | Model is outside validated conditions | Protective | Audit boundary decisions and missed eligible cases | Risk owner |
| Workers contest scheduling | Hours, privacy, autonomy or appeal changed | Unresolved | Pause consequence, consult and test recourse | Workforce owner |
06 · Before rolloutAssemble a minimum viable work system
Before an adoption campaign, the Minimum Viable Work System Test asks whether there is enough system to adopt. It is a go-to-work test, not a declaration that the model itself is safe or the business case is proved.
A consequential recurring population must exist, and the non-AI path and option not to proceed must remain credible. The team observes the full task bundle, including hidden verification and coordination. Inputs, context, integrations and handoffs work. Roles and authority are complete. Users can recognise limits, verify, escalate and recover. Workload and support are funded rather than pushed into personal time. Professional standards, worker voice, privacy, accessibility and affected-party rights are respected. Incidents, exceptions, recovery and recourse have owners. Evidence can be gathered without surveillance theatre. A stop, redesign or retirement path exists.
If these elements are absent, communications cannot manufacture them. Champions may temporarily bridge gaps through personal effort, but that produces a biased demonstration: unusually motivated people absorb extra load that the wider population cannot sustain. Mandatory usage conceals the problem more aggressively. It turns an incomplete system into individual exposure and converts the measurement process into a performance signal.
Failure boundary
Do not redesign people around an unusable product. Stop when no consequential recurring demand exists, net outcome remains negative after bounded repair, the necessary context cannot be used lawfully, essential authority or recourse cannot be assigned, severe harm cannot be contained, or the non-AI route is demonstrably more reliable. Sunk rollout cost is not a reason to preserve a weak use case.
07 · The changeRepair the binding condition with a bounded test
The Adoption Intervention Matrix converts diagnosis into the smallest change that can reveal whether a condition is binding. Training is one option among workflow, technology, context, authority, capacity, incentives and controls. It is never the automatic answer to low use.
Each intervention names the condition and friction, affected population and episode, owner, contributor and independent challenger. It states the proposed change, expected enabling signal, adverse signal, comparison and test duration. It also predicts workload, job-quality, accessibility, fairness and privacy consequences. At expiry the owner must retain, adapt, narrow, replace or stop. An indefinite pilot merely postpones the decision while normalising unsupported work.
Suppose an approved sales assistant is ignored while staff use a public model. The smallest revealing change may be governed access to a limited slice of approved customer context for one team, not a global training course. Expected signals include fewer manual transfers and more completed approved episodes. Adverse signals include sensitive data exposure, slower customer response or new retrieval errors. If context repair does not displace shadow use or improve outcomes, usefulness, latency or workflow fit remains a rival explanation.
08 · The panelFive views must disagree in public
The Adoption Evidence Panel holds five views apart: population, episode, work, outcome and system health. There is no weighted total. Its value lies in disagreement, because disagreement reveals which attractive story is incomplete.
The population view shows who and what is eligible, reached, enabled and excluded, with reasons. The episode view shows attempts, repeats, abstentions, edits, overrides, escalations, exceptions and recovery. The work view makes time, waiting, rework, cognitive load, queue transfer, hidden checking and coordination visible. The outcome view compares quality, speed, service, revenue, cost, safety, harm and distribution with a credible alternative. The system-health view watches support demand, incidents, drift, versions, worker trust, affected-party feedback and unresolved friction.
High activity with rising rework is not a puzzling contradiction; it is a clear panel. Low activity among an ineligible population is not a motivation crisis. A fall in use after tighter boundaries can be an improvement if the remaining episodes are better calibrated and affected parties receive stronger recourse. Self-reported time saved can be an exploratory signal, but it cannot carry the outcome view without workflow and comparison evidence.
| View | Measures kept visible | Question answered | Misreading prevented |
|---|---|---|---|
| Population | Eligible, reachable, enabled and excluded cohorts | Who and what could appropriately participate? | Active users divided by total headcount |
| Episode | Attempts, abstentions, overrides, escalations, exceptions, recovery | What happened at the moment of work? | Prompts treated as completed work |
| Work | Time, wait, checking, rework, load, coordination | Where did effort move or accumulate? | Hidden labour reported as a saving |
| Outcome | Quality, service, cost, safety, harm and distribution | Did the episode contribute net value against a comparison? | Output volume mistaken for benefit |
| System health | Support, incidents, drift, versions, trust, feedback, unresolved friction | Can the practice remain legitimate and reliable? | A temporary pilot declared complete |
The evidence boundary
Brynjolfsson, Li and Raymond studied 5,179 customer-support agents in one staggered deployment and found heterogeneous effects, including larger gains for less experienced workers. It is strong field evidence for population-specific outcomes and possible learning, not a productivity constant for every occupation. NIST's human-AI material reinforces the need for context, differentiated roles, challenge and override evidence. Parasuraman, Sheridan and Wickens show that allocating functions to automation changes human work rather than deleting it; Bainbridge's warning endures because people may inherit abnormal conditions after routine involvement has weakened.
Acceptance research supplies the strongest rival. Davis's perceived usefulness and ease of use, and the performance expectancy, effort, social influence, facilitating conditions and contextual moderators in UTAUT, describe meaningful individual differences. A system account can become patronising if it erases agency, preference, professional identity or experience. Orlikowski's practice lens and May and Finch's work of embedding also warn against treating technology as a fixed object with automatic effects.
The answer to the rival
Individual acceptance remains evidence inside the map. It cannot compensate for absent workflow, context, authority, capacity, legitimacy or value. Scale the diagnosis to recurrence and consequence: a private, optional, low-consequence aid may need only a light episode check; shared or consequential work warrants the complete system. “System” must never become an excuse for a poor product. If usefulness remains weak after a bounded test, stop.
The Adoption Revalidation Rule reopens the population ledger, map and representative episodes whenever the task, population, workflow, model, data, interface, vendor, autonomy, policy, regulation, incentive, staffing, skill mix, workload or affected-party consequence changes materially. Historical usage describes an earlier configuration. It does not prove that the current work system remains adopted.
09 · Ten controlsCases that separate activity from adoption
These compact cases apply one discipline: define the eligible population, trace the episode, inspect all twelve conditions, classify friction, test the minimum system, choose a bounded intervention and read the five evidence views. The named owner must be able to change the binding condition.
1. Writing outside the workflow
Population and episode: approved-document authors when a recurring draft begins. The assistant has no approved context and sits outside the document route, so copying and abandonment dominate.
Diagnosis and action: task, flow, context and integration fail; friction is harmful. The product owner embeds one approved template and governed context source for one cohort. Measure completed documents, checking time and policy errors; preserve a no-AI route and revalidate after document-policy changes.
2. Customer-service activity without outcome
Population and episode: agents handling eligible enquiries from retrieval through answer, control and closure. Use is frequent, yet copy errors, rework and escalations rise.
Diagnosis and action: outcome, capability, capacity and learning fail although access is healthy. The service owner narrows supported enquiry types, restores verification time and routes errors to the product owner. Customers receive correction and escalation. Compare resolution quality, repeat contact and load, not generated replies.
3. Rational clinical non-use
Population and episode: clinicians considering summaries for permitted consultations. Review takes longer than the present path and liability for missed detail is unclear.
Diagnosis and action: authority and capacity are unresolved, while professional friction is protective. The clinical service owner runs a timed shadow comparison with explicit decision rights and no patient consequence. Proceed only if review burden falls without worsening omissions; retain clinician abstention and patient remedy.
4. Shadow sales adoption
Population and episode: sales staff preparing authorised customer follow-up. The approved tool is slow and context-poor; a public model supplies apparent usefulness while exposing private data.
Diagnosis and action: demand is healthy, integration and context fail, and privacy friction is both protective and bypassed. The product and data owners test governed customer context with acceptable latency. Monitor approved completion, exposure attempts, quality and exclusions; stop public-model use with a workable alternative.
5. Trained claims team without time
Population and episode: handlers processing eligible claims through recommendation, checking and decision. Course completion is high, but queue targets eliminate verification and reflection.
Diagnosis and action: capacity and incentives bind, not knowledge alone. The operations owner protects review time for a defined claim cohort and adjusts the target. Compare error, rework, queue age and cognitive load. Claimants keep explanation, contest and human review rights.
6. Selective risk-review use
Population and episode: reviewers use AI only for cases inside validated data and consequence limits, documenting abstentions elsewhere. A low organisation-wide use rate is expected.
Diagnosis and action: authority and legitimacy are healthy because the boundary is usable. Friction is protective. The risk owner audits correct eligibility, overrides and missed eligible episodes rather than promoting more use. Expansion requires new evidence and independent challenge after any model or policy change.
7. Fast junior, weak calibration
Population and episode: junior analysts draft eligible analyses but cannot recognise plausible errors before handoff. Activity and speed are high while decision quality is exposed.
Diagnosis and action: capability and authority fail. The analysis leader adds supervised real-work practice, representative error cases and a bounded approval gate. Measure detection, escalation, corrected outcomes and mentor load. Do not grant wider authority merely because usage repeats.
8. Contested algorithmic scheduling
Population and episode: shift workers whose hours and autonomy change when a scheduling aid recommends assignments. Workers lack meaningful consultation, explanation and appeal.
Diagnosis and action: legitimacy, role, authority and recourse fail; contest is protective evidence. The workforce owner pauses consequential automation, consults affected groups and tests privacy, job quality and appeal. Adoption cannot proceed until rights work in practice, including for language and accessibility cohorts.
9. A viable small-business system
Population and episode: a small firm handles a narrow recurring invoice exception. It cannot fund deep integration, but a simple assistant plus a manual, reliable handoff preserves context and accountability.
Diagnosis and action: the minimum system can be proportionate. The owner limits scope, records versions and exceptions, and compares cycle time and error with the manual route. Any growth in volume, data sensitivity or autonomy triggers revalidation rather than automatic scaling.
10. The mandated prompt target
Population and episode: executives apply one target to roles with different eligibility and consequence. Prompts rise, outcomes deteriorate, staff conceal unsafe work and rational abstention is punished.
Diagnosis and action: incentive, legitimacy and evidence integrity fail system-wide. The accountable executive removes the target, protects disclosure and rebuilds population, episode and outcome evidence. The rollout stops until trustworthy denominators, authority and recourse exist. Workers are not blamed for design-induced failure.
Across the cases, repair is not synonymous with scale. The writing assistant needs workflow fit; customer support needs redesigned controls; clinical abstention needs authority and workload repair; shadow use exposes unmet demand and privacy risk; claims work needs capacity and incentive change. Selective risk use is retained, junior authority is gated, scheduling is paused for rights, the small business chooses a lighter system, and the mandated target stops. The same usage statistic would have prescribed the wrong action in nearly every case.
10 · Interactive instrumentWork-System Adoption Diagnostician
Use the instrument to structure a case, not to score a person. Select the evidence state for each field or load a named scenario. The result chooses one of exactly five routes and exposes the population ledger, episode, condition map, friction, minimum-system gaps, intervention, obligations, signals and revalidation trigger.
Diagnose one recurring work population
Each field is a prompt for inspectable evidence. “Unknown” is a finding, not a neutral middle value.
Worked scenarios
Repair access and workflow fit
Load a scenario or set the evidence fields to generate a bounded work-system route.
The instrument intentionally refuses three outputs. It does not diagnose “resistance” from low use, recommend training because a person hesitated, or calculate a universal adoption score. It directs attention to the condition an owner can change and preserves both the non-AI path and the possibility that no repair can make the intended outcome worth pursuing.
11 · The operating conclusionAdoption belongs to the work, not the personality
A sound adoption practice makes the work system answerable for the behaviour it enables. It refuses to make a worker personally accountable for missing context, impossible queues, unusable rights or a low-value product.
The sequence is practical. Start with a recurring outcome and an eligible population. Trace representative use episodes, including abstention, escalation and recovery. Map the twelve conditions and preserve cohort denominators. Record friction as observed behaviour with rivals. Test whether a minimum system exists. Change the smallest plausible binding condition for a bounded period. Read population, episode, work, outcome and system health together. At expiry, retain, adapt, narrow, replace or stop. Revalidate when the configuration changes.
This reframes leadership's role. Communications may explain a changed practice, and learning teams may build capability, but neither owns adoption alone. Product owners must repair workflow and integration. Operations leaders must fund control work. Accountable executives must make authority usable. Workforce and policy owners must protect voice, privacy, job quality and recourse. Risk teams must preserve necessary friction. Outcome owners must reject activity that does not survive comparison. The organisation adopts only when these contributions meet inside ordinary work.
The discipline is deliberately less flattering than a rising login chart. It can reveal that a celebrated launch excludes a shift, that apparent time savings moved into review, that non-use protected a customer, or that the rational decision is to retire the capability. That is precisely why it is useful. Adoption is not compliance with a product metric. It is the repeatable capacity of a real work system to produce an intended outcome under its actual constraints and obligations.
Evidence spineReferences and limits
Official statistics and surveys are used within their stated populations and periods. Self-report, sampling, jurisdiction and cross-sectional associations limit generalisation. Field and human-factors studies illuminate mechanisms, not universal effect sizes. The named maps, ledgers, tests, panel, revalidation rule and diagnostician are this article's synthesis.
- UK Department for Science, Innovation and Technology, AI Adoption Research, updated 2026.
- UK Office for National Statistics, Artificial Intelligence in UK Businesses: 2023 to 2026.
- UK Office for National Statistics, Management Practices and the Adoption of Technology and Artificial Intelligence in UK Firms, 2023.
- OECD, The Impact of AI on the Workplace: Main Findings from Surveys of Employers and Workers.
- OECD, The Adoption of Artificial Intelligence in Firms, 2025.
- International Labour Organization, The Impact of GenAI on Jobs, Productivity and Work Organization, 2026.
- International Labour Organization, Artificial Intelligence Adoption and Its Impact on Jobs, 2025.
- International Labour Organization, Global Case Studies of Social Dialogue on AI and Algorithmic Management.
- NIST AI Resource Center, AI Risk Management and Human-AI Interaction.
- NIST AI Resource Center, Descriptions of AI Actor Tasks.
- NIST AI Resource Center, AI RMF Core.
- Brynjolfsson, E., Li, D. and Raymond, L., Generative AI at Work, NBER Working Paper 31161.
- Davis, F. D., Perceived Usefulness, Perceived Ease of Use, and User Acceptance of Information Technology, 1989.
- Venkatesh, V., Morris, M. G., Davis, G. B. and Davis, F. D., User Acceptance of Information Technology: Toward a Unified View, 2003.
- May, C. and Finch, T., Implementing, Embedding, and Integrating Practices, 2009.
- Orlikowski, W. J., Using Technology and Constituting Structures: A Practice Lens, 2000.
- Parasuraman, R., Sheridan, T. B. and Wickens, C. D., A Model for Types and Levels of Human Interaction with Automation, 2000.
- Bainbridge, L., Ironies of Automation, 1983.