The Assessment Ends With Owned Action, Not a PDF Score
A readiness result is only useful if it changes what happens next. The roadmap converts discovery and assessment findings into a governed action register.
Every action traces to a question, a gate or an evidence gap. Each one records an owner, a dependency, the evidence required to close it, a decision gate, and a reassessment trigger. Completing an activity is not closure. Evidence accepted by a named validator is.
Not a generic list of recommendations.
Every action must trace to evidence from the organisational discovery, the use-case screening, the detailed assessment, the critical gates and evidence gaps, and the obligations and assurance that apply. Priority is set in this order.
- Prohibited or legally blocked activity.
- Red critical gates.
- Fixed regulatory, contractual or operational deadlines.
- High-consequence unknowns.
- Amber critical gates.
- Cross-cutting organisational dependencies.
- The lowest detailed-assessment dimensions.
- Evidence-confidence gaps.
- Value optimisation and scale opportunities.
Twelve workstreams, used only where they apply.
Findings are grouped so ownership and dependencies are clear. No action is forced into a workstream that does not fit it.
- W1 Strategy, sponsorship and value
- W2 Governance, accountability and risk classification
- W3 Process discovery and redesign
- W4 Data, knowledge, context and memory
- W5 Architecture and integration
- W6 Security, identity and permissions
- W7 Agent design, authority and human oversight
- W8 Legal, regulatory, ethics and affected-person rights
- W9 Workforce, roles, skills and change
- W10 Testing, simulation and independent assurance
- W11 Observability, incident response and resilience
- W12 Supplier, economics and sustainability
What every action records.
- Action
- A specific outcome to be established, not a vague activity.
- Source finding
- The assessment question, gate or evidence gap it traces to.
- Why it matters
- The value, consequence, obligation or dependency behind it.
- Accountable owner
- One role or person accountable, with the contributors required.
- Dependency
- The actions or decisions that must precede it.
- Required evidence
- The artefact or operating evidence that proves completion.
- Priority
- Critical, High, Medium or Later, from a transparent scoring formula.
- Validator
- The person or function that accepts the closure evidence.
- Residual risk
- The remaining exposure after the action is complete.
- Reassessment impact
- The questions, gates, dimensions and autonomy decision affected.
Implement a unique non-human identity and task-bounded permissions for the complaint-resolution agent
- Source finding
- P6.2 red (unique agent identity); P6.3 amber (least-privilege access)
- Why it matters
- Shared user credentials prevent attribution and exceed the authorised task
- Accountable owner
- Head of Identity and Access Management
- Required evidence
- Identity record, approved entitlement design, access test and revocation test
- Reassessment impact
- P6.2, P6.3, gates G10 and G11, and the autonomy ceiling
Seven points where a governing body decides.
Progress between stages is a decision, not a default. Each gate names the evidence required before it can be passed.
Gate 0 Discovery complete
Scope and multidisciplinary participants agreed; material organisational unknowns recorded; use case and process owner identified; nothing obviously prohibited is being progressed.
Gate 1 Screening passed
Screening context complete; no red stop condition; required detailed-assessment participants identified; principal evidence sources available.
Gate 2 Detailed design and evidence complete
Detailed assessment completed and challenged; red gates closed or the blocked action removed; intended autonomy and human controls documented; legal classification complete; test and assurance plan approved.
Gate 3 Bounded experiment authorised
Acceptance thresholds agreed before testing; representative test environment approved; identity, least privilege, logging and containment operate; human oversight staffed; experiment limits and stop conditions documented.
Gate 4 Controlled production validation
Assessment meets the R4 conditions; required gates green or approved exceptions; end-to-end and recovery testing passed; residual risk formally accepted; monitoring and incident response active.
Gate 5 Governed scaling or authority expansion
Sustained operating evidence at the current authority level; benefits and economics validated; incidents, overrides and differential outcomes reviewed; capacity, resilience and concentration risk reassessed at scale; independent assurance where consequence warrants it.
Gate 6 Retirement or replacement
Retirement trigger or replacement decision documented; access and credentials revoked; data, memory and records retained or deleted appropriately; open actions reconciled; supplier exit and continuity complete; lessons incorporated.
An action is closed only when.
- The required outcome exists across the defined scope.
- The required evidence is attached or referenced.
- The named validator has accepted the evidence.
- Residual risk is recorded and owned.
- The affected assessment answers and gate statuses have been reassessed.
- The readiness decision and autonomy ceiling have been recalculated if affected.
Publishing a policy or buying a tool is not closure unless the required operating outcome is evidenced.
Readiness is reassessed when.
- A change in the agent's objective or authorised actions.
- An increase in autonomy, volume, transaction value or affected population.
- A new model, major model version or material supplier change.
- A change to prompts or instructions, tools, integration, permissions, memory or knowledge source.
- A process, policy, system, data or workforce change.
- A new or changed legal, regulatory or contractual obligation.
- An incident, near miss, complaint, material override trend or control failure.
- Performance, cost or benefit outside approved thresholds.
- A new agent-to-agent delegation or orchestration.
- Entry into a new geography, customer group or regulated activity.
- A scheduled review date.
One set of actions, four audiences.
Executive view
Decisions, red and amber gates, owners, funding, benefits and dates.
Delivery view
Workstreams, dependencies, milestones and blockers.
Assurance view
Obligations, controls, evidence, validators and residual risk.
Process and agent view
Dimension changes, autonomy ceiling and reassessment history.
Turn the result into a governed plan.
The roadmap is produced as part of the facilitated detailed assessment, or run as a continuing governance workspace. It does not replace accountable approval, specialist advice, regulatory obligations or independent assurance.