World Model Readiness
Engraved technology instrument

For your company

Technology & Risk

Module · When the customer is a machine

The AI Ecosystem Readiness Check

Your next integration request will not come from a person filling in a form. It will come from a partner's AI agent, at machine speed, expecting to authenticate itself, read a contract, and transact without a human in the loop. Companies built for human customers are not built for this. This module checks whether you are ready to be part of an agent ecosystem: an API a machine can use, authentication for non-human clients, permission and rate models that assume automation, data contracts partners can rely on, and eyes on the agent traffic itself.

Question 1 of 5 · An API a machine can use

Can a partner's system connect to yours through an API without a human involved?

If integrating with you means emails, spreadsheets, or a portal a person has to click through, an agent cannot use you and will route around you. A documented, stable API is the price of admission to an ecosystem where the other side is increasingly software, not staff.

Question 2 of 5 · Machines can log in

Can a non-human client authenticate to your systems safely?

Human logins assume a person, a password, a second factor on a phone. A partner agent has none of those. Machine-to-machine authentication, keys, tokens, scoped service credentials, is a different discipline, and bolting agents onto human login flows is how credentials leak and access sprawls.

Question 3 of 5 · Limits assume automation

Do your rate limits and permissions assume a machine on the other end?

A human clicks a few times a minute; an agent can call you thousands of times before you finish reading this. Rate limits, quotas, and fine-grained permissions sized for people fall over or over-expose the moment the caller is software that never tires and does exactly what it is allowed to.

Question 4 of 5 · Partners can rely on it

Do your partners have a clear contract for the data they exchange with you?

An agent acts on the structure and meaning of your data exactly as documented, with no human to notice when a field changes shape. A data contract, the format, the fields, the guarantees, and how changes are announced, is what lets a partner's automation depend on you without breaking silently.

Question 5 of 5 · You watch the agents

Can you see and understand the automated traffic hitting your systems?

Agent traffic behaves nothing like human traffic: it is bursty, relentless, and a malfunctioning or hostile agent looks a lot like a healthy one until it does not. Without monitoring built for machine clients, you cannot tell a productive partner from a runaway loop or an abuser until the damage is visible.

For the statistics · one click each

Three questions for the public picture

These do not affect your score. They feed the anonymised, aggregated statistics; groups under 8 respondents are never shown.

How can partners integrate with your systems today?

Manually only
Private API on request
Documented public API
A full integration platform
We do not know

Are partner AI agents already calling your systems?

No
We are not sure
Just starting
Yes, regularly
No external integrations

How do non-human clients authenticate to you?

They cannot
Shared keys
Per-partner credentials
Managed machine identity
We do not know

Your context

Used to calibrate the report. Company size and sector remain in the anonymized dataset; your email does not.

What the five levels look like

Every dimension in this assessment is scored 1 to 5. This is what the levels mean, dimension by dimension. The graded report diagnoses where your own answers land and what to do about it.

An API a machine can use

  1. 1No API
  2. 2Manual integration only
  3. 3Private API, ad hoc
  4. 4Documented API
  5. 5Stable, versioned API

At the low end: With no API, every integration is a human project, and a partner's agent simply cannot reach you. Expose a documented API for the transactions partners most often need, before they pick someone who has one. What good looks like: A stable, versioned API is the foundation an agent ecosystem is built on. Treat breaking changes as the serious events they are; a partner's agent has no way to improvise around a surprise.

Machines can log in

  1. 1Human logins only
  2. 2Shared API keys
  3. 3Per-partner keys
  4. 4Scoped tokens
  5. 5Managed machine identity

At the low end: If the only way in is a human login, partners will share a person's credentials with their agent, which is exactly the leak you fear. Stand up proper machine-to-machine authentication before that becomes your default. What good looks like: A managed machine identity model, with scoped tokens you can rotate and revoke, is what lets you trust non-human clients. Audit the grants regularly; machine credentials sprawl even faster than human ones.

Limits assume automation

  1. 1No limits or scopes
  2. 2Human-sized limits
  3. 3Basic rate limits
  4. 4Rate limits plus scopes
  5. 5Per-client, fine-grained

At the low end: With no rate limits or scoped permissions, one partner agent can overwhelm you or reach data it should never see. Put per-client limits and fine-grained scopes in place before you invite automated traffic. What good looks like: Per-client, fine-grained rate and permission models are what let you open up safely to automation. Keep them tight by default and widen deliberately; an agent uses every permission you grant it, always.

Partners can rely on it

  1. 1No contract
  2. 2Undocumented format
  3. 3Documented, unstable
  4. 4Stable data contract
  5. 5Versioned with change policy

At the low end: Without a data contract, every partner reverse-engineers your format and breaks the day you change it. Document the structure and the guarantees so their automation has something firm to build on. What good looks like: A versioned data contract with a clear change policy is what makes you a dependable node in an ecosystem. Honour the deprecation timelines you publish; a partner's agent cannot scramble when you move fast.

You watch the agents

  1. 1No visibility
  2. 2Aggregate logs only
  3. 3Per-client logging
  4. 4Monitored with alerts
  5. 5Behaviour anomaly detection

At the low end: If you cannot see the automated traffic, a runaway or hostile agent is invisible until it hurts. Start logging per client so you can at least tell who is calling and how much. What good looks like: Behaviour-based anomaly detection on agent traffic is what lets you open up without flying blind. Keep tuning it as partners' agents evolve; normal for a machine client is a moving target.