Agentic AI Readiness
Establish where Agentic AI adds value, what it should be allowed to do and how people remain in control. Assess the organisation, the process and the proposed agent together before extending authority.
Agentic AI can use systems, make decisions, delegate work and initiate actions. A capable model alone does not establish that these actions are appropriate. Objectives, process clarity, ownership, information, controls and the consequences of error determine responsible progress.
Choose the right improvement for the business.
Agentic AI is one option within the Business Improvement journey. It is not the default answer. A named process and a proposed use case must earn the right to progress through evidence, not assumption.
Adding an agent to an unclear process can reproduce its exceptions, ownership gaps and poor information at greater speed. Define the business outcome, understand how work happens and test whether an agent is needed before choosing the technology.
Use the organisation assessment to establish the wider conditions. Screen a defined process and use case. If it merits deeper investigation, use the Process Deep Dive assessment to examine authority, controls and operating evidence, then convert findings into an owned roadmap. These decisions sit within the six-product offering; a readiness score does not replace them.
Preparedness needs to catch up with ambition.
Process foundations
of surveyed organisations said their business processes were highly prepared for AI agents. Only one in five leaders said their organisation was prepared to redesign processes for autonomous operation.
Deloitte, August 2026 · 501 US respondents in organisations already piloting agentic AI.
Governance capacity
of surveyed technology leaders felt fully ready for the expected scale of agent deployment; 77% said AI adoption was outpacing governance.
IBM Institute for Business Value and Oxford Economics, June 2026 · 2,000 technology executives.
Maturity and accountability
of organisations reached maturity level three or higher in strategy, governance and agentic controls. Explicit accountability was associated with greater responsible-AI maturity.
Value comes from capability and human collaboration
Deloitte reported that 75% of respondents saw more value in human collaboration with agents than in agent-powered automation alone. Source.
IBM found 25% fewer incidents in organisations embedding control into their AI systems than in those relying on manual governance. Source.
KPMG associated stronger outcomes with accountability, governance and visibility of operating costs. Its Q2 2026 study covered 2,145 leaders across 20 countries, territories and jurisdictions. Source.
McKinsey found that active risk mitigation lagged awareness across almost every risk category examined. These findings support testing controls in operation, alongside defining accountable ownership. Source.
Define authority before enabling action.
Where Agentic AI offers a credible benefit, assess what it should and should not do within the process. Hybrid operation combines agent activity with human judgement and approvals. Autonomous operation permits defined actions within agreed boundaries, with human accountability and oversight. The deep dive tests whether either is justified.
Authority and human oversight
Specify permitted actions, approval points and intervention rights. Keep named people accountable for purpose, constraints and material change.
Basis and critical gates
Separate the strength of a position from the basis on which it is claimed. Essential safeguards must be satisfied even when the overall confidence score is strong.
Access and recovery
Examine permissions, agent memory and delegation where relevant. Define monitoring, containment, rollback and handover to people.
Readiness and suitability are different decisions. A process may be technically ready for Agentic AI but lack a sufficient business case or acceptable governance arrangements. Workflow, RPA or a lower-cost approach with more human involvement may be the better answer. Any production change still requires appropriate assurance and approval.
Make the reasoning visible.
Make the recommended approach traceable to business needs, expected benefits, total cost, evidence and governance constraints. In the assessments, fixed scoring rules combine the response, the basis for it and the gates, with the scoring version recorded for review.
The right balance of people and technology
Workflow orchestrates activities and handovers. RPA automates defined tasks. Agentic AI can support hybrid working or bounded autonomous action. These approaches can be combined; they are options to evaluate, with no requirement to progress towards greater autonomy.
Where agents are justified, a clear operating model lets people, agents and existing systems work together, with people keeping authority over objectives, constraints and consequential change.
Eight organisational conditions around operating change.
An agent can cross process, system and departmental boundaries. Readiness is distributed across leadership, operations, technology, security, governance and people. An approved position, an unknown and disagreement between functions each call for a different response.
The Organisation Readiness Assessment examines these domains. Its findings establish shared context, ownership, constraints and candidate processes to assess. Complete the Agentic AI questions only where Agentic AI is in use, formally proposed or a material strategic option.
1 · Purpose, outcomes and direction
Defined outcomes, Problem before solution, Realistic alternatives, Review triggers.
2 · Governance and accountability
Decision rights, Outcome ownership, Proportionate challenge, Stop authority.
3 · Portfolio and prioritisation
Current inventory, Consistent selection, Risk classification, Learning between initiatives.
4 · Process and operating-model capability
Process ownership, Process truth, Definition status, Mixed operating modes.
5 · Information, technology and security
Information ownership, Supportable integration, Access control, Traceability.
6 · People, change and operational capacity
Participant involvement, Role effects, Sustained capacity, Adoption and competence.
7 · Assurance, resilience and lifecycle
Acceptance criteria, Representative testing, Continuity and recovery, Material-change review.
8 · Justification and benefits governance
Internal justification, Comparative case, Complete considerations, Baseline and ownership.
Assess one process at a time.
Define the process boundary, outcome, owner, how the work actually runs, the systems and information it depends on and the constraints that apply. Confidence in one process does not imply confidence in another.
The Process Readiness Assessment has 28 questions across 7 sections. Each answer takes a response and a basis, and the result shows how far your understanding of the process can be relied on. It does not assume that automation or Agentic AI is the answer.
7 sections
- Purpose and boundary
- Process understanding
- Current fitness
- Demand, variation and judgement
- Operating-mode options
- Information, control and resilience
- Ownership, justification and next step
Four confidence bands
- High confidence (80 to 100)
- Moderate confidence (60 to 79)
- Limited confidence (35 to 59)
- Insufficient confidence (0 to 34)
| Confidence band | What it means |
|---|---|
| High confidence (80 to 100) | The position is sufficiently established for indicative reliance. |
| Moderate confidence (60 to 79) | A useful basis exists but material confirmation or improvement remains. |
| Limited confidence (35 to 59) | The conclusion depends substantially on incomplete or weakly supported information. Do not select a target mode without further work. |
| Insufficient confidence (0 to 34) | The present information does not support a dependable conclusion. |
Where scope is too vague, clarify it with the process owner and sponsor first. If organisational ownership or governance is unresolved, establish that context before relying on the result.
Start the Process Readiness AssessmentChallenge the evidence and the operating options.
The Process Deep Dive Assessment tests one process across 8 core domains, then only the operating-mode modules that are credible. Where an agent is a credible option, the supervised Agentic AI and governed autonomy modules apply. An agent drafting advice and an agent executing an irreversible transaction require different evidence.
The assessment has 48 common questions and 28 conditional questions across 6 modules. The calculation follows fixed rules; a language model does not decide the result.
Every answer carries its basis
Record a response and how you know: approved, owner confirmed, team consensus, an individual view or disputed. Confidence is the two combined, and an unknown scores zero and stays visible.
Essential controls cannot be averaged away
Gates cover accountable ownership, information fitness, consequence and rights, and the decision itself, with further gates for each operating mode you activate. A gate that is not established, unknown, disputed or below 60 per cent confidence shows a condition whatever the average.
Operating-mode modules apply only when credible
Human-led, workflow, task automation, technology assistance, supervised Agentic AI and governed autonomy are chosen after the common core. A relevant module left incomplete lowers confidence. An irrelevant one is recorded as not applicable, with a reason.
Confidence and direction are different things.
- Confidence score and band: the average confidence across the core questions. It reflects how established each position is and the basis on which the answer is given.
- Domain and module scores: each core domain is scored on its own, and each conditional module is reported separately, never blended into the overall figure.
- What each step needs to succeed: where a relevant safeguard is not yet established, unknown, disputed or below 60 per cent confidence, the result shows the condition to meet, whatever the average.
- Information that would improve confidence: the unknowns, disagreements and weakly supported answers, each with the internal basis that would confirm it.
- Prioritised actions: confidence improvement, capability improvement or operating change, traced to the questions that created them.
Confidence is not direction. Direction is a judgement made from the pattern of answers, gates and modules, and it does not assume that more automation or Agentic AI is the answer. Neither confidence nor direction approves a deployment. A competent accountable body must decide using evidence appropriate to the process, affected people, sector and jurisdictions.
Carry agent-specific controls into the roadmap.
The Readiness Roadmap is shared across the broader improvement journey. For Agentic AI, add the relevant limits on authority, identity, memory, delegation and affected-person risks to its action register and decision gates.
Example action: identity and bounded permissions
| Action | Implement a unique managed identity and task-bounded permissions for the complaint-resolution agent. |
| Source finding | Gate condition on agent identity: not established. Question CS.1. |
| Action type | Capability improvement. |
| Why it matters | Shared credentials prevent attribution and can exceed the authorised task. |
| Owner | Head of Identity and Access Management. |
| Evidence | Identity record, approved entitlement design, access test and revocation test. |
| Reassessment point | After the access and revocation tests, before any pilot. |
Apply the seven roadmap gates to Agentic AI
- Gate 0: agree organisational scope and participants, record unknowns, identify the use case and process owner, and exclude prohibited activity.
- Gate 1: complete the Process Readiness Assessment, resolve gate conditions and identify participants and evidence for the Process Deep Dive.
- Gate 2: challenge the Process Deep Dive, close gate conditions or remove blocked actions, document intended autonomy and human controls, complete legal classification and approve testing.
- Gate 3: authorise a bounded experiment with prior acceptance thresholds, a representative setting, identity, least privilege, logging, containment, staffed oversight and stop conditions.
- Gate 4: meet the agreed acceptance thresholds and required gates, with approved exceptions only where permitted; pass end-to-end and recovery testing; accept residual risk; activate monitoring and incident response.
- Gate 5: use sustained evidence at the current authority level, validate benefits and economics, review incidents, overrides and differential outcomes, and reassess resilience, capacity and concentration risk before expanding authority.
- Gate 6: document retirement or replacement, revoke access, address data and memory retention or deletion, reconcile actions, complete supplier exit and continuity, and incorporate lessons.
Agent-specific closure and reassessment
Closure requires accepted operating evidence, owned residual risk and refreshed assessment and gate status. Recalculate the confidence score and gate status where affected.
Reassess changes to agent objectives or actions; autonomy, volume, value or affected population; model versions or suppliers; prompts, instructions, tools, integration, permissions, memory or knowledge sources; and new agent-to-agent delegation or orchestration. Also apply the common roadmap triggers for process, workforce, obligations, incidents, performance, new geographies and scheduled reviews.
Maintain a process-and-agent view showing domain and gate changes, the authority in force and reassessment history.
Recognised foundations, independently developed.
IGX360 draws on the NIST AI Risk Management Framework and ISO/IEC 42001 organisational and lifecycle concepts, relevant EU AI Act risk, transparency and oversight concepts, and OWASP agent-specific controls. These references do not constitute certification, assurance, legal advice or endorsement.
The approach is vendor-neutral. Ownership of a particular model, cloud, process-architecture, process-mining, RPA or agent platform does not itself improve readiness; the evidence must demonstrate the outcomes and controls the use case needs.
Practical questions.
How does organisational readiness relate to a specific use case?
The Organisation Readiness Assessment shows how much confidence can be placed in the capability of an organisation, division, department or team across eight domains, with an optional Agentic AI screen. The Process Readiness Assessment and Process Deep Dive Assessment then examine one named process against that context.
What is the difference between confidence and direction?
Confidence shows how much reliance can be placed on your understanding, from the response given and the basis for it. Direction is the operating mode worth investigating, and it is a judgement made from the pattern of answers, gates and modules, not from the score. Neither approves a deployment or a change.
Does a strong result approve an Agentic AI deployment?
No. Every result is indicative decision support based on the information supplied. It is not certification, independent assurance or legal advice. A competent accountable body must still approve any deployment or increase in authority.
Start with the decision you need to make.
Participation, results and data access From findings to roadmap The wider Readiness and Improvement journey