World Model Readiness
Engraved technology instrument

For your company

Technology & Risk

Module · When software acts in your name

The Agentic AI Readiness Check

An agent is not a chatbot: it does not answer, it acts. It sends the email, moves the money, books the travel, changes the record, all with your credentials and without waiting to be asked twice. The capability is real and the guardrails usually are not. This module checks the five that decide whether autonomy is an asset or a liability: permission boundaries, spend limits, audit trails, human checkpoints, and a kill switch that works.

Question 1 of 5 · Boundaries are explicit

Do your agents have explicit boundaries on what they are allowed to do?

An agent with your credentials can do anything you can do unless something stops it: send mail, change records, move money, book travel. Boundaries defined as scoped permissions, enforced by the system, are the difference between a tool and a loaded liability.

Question 2 of 5 · Spend is capped hard

Can your agents spend money, and if so what actually stops them overspending?

Agents that book, buy or transact need hard limits enforced by the payment system, not soft ones suggested in a prompt. A loop bug or an injected instruction should hit a wall, not a polite reminder. The first runaway agent is an expensive way to learn this.

Question 3 of 5 · Every action is logged

For every action an agent takes, can you reconstruct what it did and why?

When an agent acts in your name you need the full chain: the trigger, the reasoning, the action, the result. Without an immutable log you cannot debug a failure, dispute a charge or defend a decision. 'The AI did it' is not an audit trail.

Question 4 of 5 · Humans gate key actions

Are there actions your agents cannot complete without a human saying yes?

Autonomy is a dial, not a switch. High-stakes or irreversible actions, large payments, external messages, data deletion, should pause for human approval. Which actions those are is a governance choice you make deliberately, or one that gets made for you by omission.

Question 5 of 5 · Kill switch is tested

If an agent starts doing damage right now, can you stop it in seconds?

Every autonomous system needs a tested off switch that halts all agents fast, without waiting for a deploy. Untested kill switches fail exactly when they are needed. The question is not whether you have one, but whether you have ever actually pulled it.

For the statistics · one click each

Three questions for the public picture

These do not affect your score. They feed the anonymised, aggregated statistics; groups under 8 respondents are never shown.

How far have autonomous AI agents gone in your company?

None
Exploring
Human always in the loop
Acting autonomously
Scaled across processes

Can any of your agents spend money or transact without human approval?

No
Up to a small limit
Only with approval
Yes, unsupervised
No agents yet

Do you have a tested way to stop all agents immediately?

No
Yes, but untested
Yes, tested
Tested regularly
No agents yet

Your context

Used to calibrate the report. Company size and sector remain in the anonymized dataset; your email does not.

What the five levels look like

Every dimension in this assessment is scored 1 to 5. This is what the levels mean, dimension by dimension. The graded report diagnoses where your own answers land and what to do about it.

Boundaries are explicit

  1. 1No boundaries
  2. 2Prompt instructions only
  3. 3Some scoping
  4. 4Scoped permissions
  5. 5Least-privilege, enforced

At the low end: An agent with no enforced boundary is an insider threat you built on purpose. Scope its permissions to the minimum the task needs, in the systems it touches, before it runs again. What good looks like: Least-privilege permissions enforced by the platform are exactly right. Review the grants as the agent takes on new tasks; scope creep is how a safe agent turns dangerous.

Spend is capped hard

  1. 1No limits
  2. 2Trust the prompt
  3. 3Soft caps
  4. 4Hard caps, wide
  5. 5Hard caps, tight

At the low end: An agent that can spend without a hard ceiling is one bug away from a very bad invoice. Put an enforced limit at the payment or API layer before it transacts again. What good looks like: Tight, enforced spend limits mean a runaway agent fails cheap. Keep the caps sized to the task, not to convenience; a wide limit is a slow leak waiting for a bug.

Every action is logged

  1. 1No logging
  2. 2Partial logs
  3. 3Actions logged
  4. 4Actions plus reasoning
  5. 5Full immutable trail

At the low end: An unlogged agent is one you cannot debug, defend or trust. Start logging every action with its trigger and result now; you will want it the first time something goes wrong. What good looks like: A full, immutable trail is what lets you run agents in regulated and high-stakes work at all. Keep it tamper-evident; a log the agent can edit is not evidence.

Humans gate key actions

  1. 1Fully autonomous
  2. 2No checkpoints
  3. 3Ad hoc approvals
  4. 4Checkpoints on key actions
  5. 5Risk-tiered checkpoints

At the low end: Full autonomy over irreversible actions is a bet you only lose once. Decide which actions are too costly to undo and put a human approval gate in front of them this week. What good looks like: Risk-tiered checkpoints let low-stakes work run free while the dangerous actions wait for a human. Revisit the tiers as the agent earns trust and its scope grows.

Kill switch is tested

  1. 1No kill switch
  2. 2Exists, untested
  3. 3Tested once
  4. 4Tested, slow
  5. 5Tested, instant

At the low end: An agent you cannot stop fast is a fire with no extinguisher. Build a single control that halts all agents immediately, independent of the normal deploy path. What good looks like: A kill switch you have tested and can pull in seconds is what makes real autonomy defensible. Re-drill it after changes; the path that worked last quarter may have quietly broken.