Agentic AI Readiness
Establish where Agentic AI adds value, what it should be allowed to do and how people remain in control. Assess the organisation, the process and the proposed agent together before extending authority.
Agentic AI can use systems, make decisions, delegate work and initiate actions. A capable model alone does not establish that these actions are appropriate. Objectives, process clarity, ownership, information, controls and the consequences of error determine responsible progress.
Choose the right improvement for the business.
Agentic AI is one option within the Business Improvement journey. It is not the default answer. A named process and a proposed use case must earn the right to progress through evidence, not assumption.
Adding an agent to an unclear process can reproduce its exceptions, ownership gaps and poor information at greater speed. Define the business outcome, understand how work happens and test whether an agent is needed before choosing the technology.
Use the organisation assessment to establish the wider conditions. Screen a defined process and use case. If it merits deeper investigation, use the Process Deep Dive assessment to examine authority, controls and operating evidence, then convert findings into an owned roadmap. These decisions sit within the six-product offering; a readiness score does not replace them.
Preparedness needs to catch up with ambition.
Process foundations
of surveyed organisations said their business processes were highly prepared for AI agents. Only one in five leaders said their organisation was prepared to redesign processes for autonomous operation.
Deloitte, August 2026 · 501 US respondents in organisations already piloting agentic AI.
Governance capacity
of surveyed technology leaders felt fully ready for the expected scale of agent deployment; 77% said AI adoption was outpacing governance.
IBM Institute for Business Value and Oxford Economics, June 2026 · 2,000 technology executives.
Maturity and accountability
of organisations reached maturity level three or higher in strategy, governance and agentic controls. Explicit accountability was associated with greater responsible-AI maturity.
Value comes from capability and human collaboration
Deloitte reported that 75% of respondents saw more value in human collaboration with agents than in agent-powered automation alone. Source.
IBM found 25% fewer incidents in organisations embedding control into their AI systems than in those relying on manual governance. Source.
KPMG associated stronger outcomes with accountability, governance and visibility of operating costs. Its Q2 2026 study covered 2,145 leaders across 20 countries, territories and jurisdictions. Source.
McKinsey found that active risk mitigation lagged awareness across almost every risk category examined. These findings support testing controls in operation, alongside defining accountable ownership. Source.
Define authority before enabling action.
Where Agentic AI offers a credible benefit, assess what it should and should not do within the process. Hybrid operation combines agent activity with human judgement and approvals. Autonomous operation permits defined actions within agreed boundaries, with human accountability and oversight. The deep dive tests whether either is justified.
Authority and human oversight
Specify permitted actions, approval points and intervention rights. Keep named people accountable for purpose, constraints and material change.
Evidence and critical gates
Separate claimed capability from evidence confidence. Essential safeguards must be satisfied even when the overall readiness score is strong.
Access and recovery
Examine permissions, agent memory and delegation where relevant. Define monitoring, containment, rollback and handover to people.
Readiness and suitability are different decisions. A process may be technically ready for Agentic AI but lack a sufficient business case or acceptable governance arrangements. Workflow, RPA or a lower-cost approach with more human involvement may be the better answer. Any production change still requires appropriate assurance and approval.
Make the reasoning visible.
Make the recommended approach traceable to business needs, expected benefits, total cost, evidence and governance constraints. For the detailed Agentic AI assessment, defined scoring rules distinguish maturity, evidence confidence and gating decisions, with the assessment version recorded for review.
The right balance of people and technology
Workflow orchestrates activities and handovers. RPA automates defined tasks. Agentic AI can support hybrid working or bounded autonomous action. These approaches can be combined; they are options to evaluate, with no requirement to progress towards greater autonomy.
Where agents are justified, the Agent-Enabled Operating Model (AEOM) provides a framework for people, agents and existing systems to work together. Human sovereignty preserves people’s authority over objectives, constraints and consequential change.
Thirteen organisational conditions around agent action.
An agent can cross process, system and departmental boundaries. Readiness is distributed across leadership, operations, technology, security, governance and people. An unsupported “yes”, an unknown and disagreement between functions each call for a different response.
The Organisation Readiness Assessment examines these domains. Its findings establish shared context, ownership, constraints and candidate processes for screening.
1 · Strategy, Purpose and Value
Establish why the organisation is considering agentic AI, which outcomes matter, and how strategic choices will be governed.
2 · Governance Operating Model and Accountability
Establish who can decide, approve, challenge, operate, suspend and retire agentic systems.
3 · Use-Case Portfolio and Risk Classification
Select agentic use cases deliberately and apply controls proportionate to consequence.
4 · Process and Operating-Model Readiness
Understand the work agents may enter and avoid scaling unclear or ineffective processes.
5 · Data, Knowledge, Context and Memory
Ensure agents receive appropriate information and do not create uncontrolled information risks.
6 · Technology Architecture and Integration
Provide a supportable architecture matched to agent workload, impact and dependency.
7 · Security, Agent Identity and Access
Control agents as non-human actors capable of using tools and delegated permissions.
8 · Agent Design, Authority and Human Sovereignty
Define what agents may pursue and do, where people retain authority, and how delegation stays bounded.
9 · Testing, Evaluation and Independent Assurance
Establish evidence that the complete agentic system behaves acceptably before and after release.
10 · Operational Control, Monitoring, Incident Response and Resilience
Operate agents visibly, and contain, recover from and learn from failure.
11 · Legal, Regulatory, Ethical and Affected-Person Rights
Translate obligations and legitimate expectations into effective agent constraints and remedies.
12 · Workforce, Organisation and Change
Prepare the people who design, supervise, work with and are affected by agents.
13 · Third Parties, Economics and Lifecycle Roadmap
Understand external dependencies, true economics, and the path from adoption to retirement.
Screen one process and one proposed use case.
Define the process boundary, outcome, proposed agent role, decisions and actions, systems and information, human oversight and constraints. Readiness in one process does not imply readiness in another.
The Agentic AI screen within the Process Readiness Assessment uses 5 sections and 7 stop conditions. A high score cannot compensate for an absent or unknown stop condition.
Five sections
- Purpose and Process Suitability
- Information and Technical Feasibility
- Authority, Consequence and Regulation
- Security and Control Feasibility
- Value, Ownership and Change Capacity
Seven stop conditions
- Information fitness
- Proposed authority
- Consequence and reversibility
- Legal applicability
- Agent identity
- Human oversight
- Containment and safe fallback
| Screening outcome | What it means |
|---|---|
| Do not progress in its current form | A stop condition is absent or unknown. Reject, restrict or reframe before further investment. |
| Foundation work required | Strengthen process, information, control, ownership or workforce conditions first. |
| Potential candidate, investigate | Gather more evidence and specialist review before a detailed assessment. |
| Progress to detailed assessment | The scope is sufficiently defined to justify deeper assessment; this is not deployment approval. |
Where scope is too vague, clarify it with the process owner and sponsor first. If organisational ownership or governance is unresolved, establish that context before treating screening as a basis for progression.
Start the Process Readiness AssessmentAssess the process and the proposed agent together.
The Agentic AI assessment within the Process Deep Dive Assessment examines one combination of process boundary, outcome, agent objective, authorised actions, systems, data, oversight, affected people and recovery requirements. An agent drafting advice and an agent executing an irreversible transaction require different evidence.
Use evidence for each answer. The current detailed assessment has 55 questions, 11 dimensions and 24 critical gates. The calculation follows defined rules, weights and gates; a language model does not decide whether the use case passes.
Separate capability from evidence
Record whether the answer is verified, partially evidenced, an unsupported assertion or unknown. The evidence confidence index remains visible beside maturity. If the higher response is not evidenced, use the lower state.
Essential controls cannot be averaged away
Critical gates cover accountable ownership, bounded objectives, permitted and prohibited actions, information fitness, legal classification, agent identity, least privilege, meaningful human oversight, representative testing, end-to-end observability, containment and continuity. A red gate constrains the result regardless of other scores.
Examine conditional risks
Four gates apply where persistent memory, agent-to-agent delegation or material effects on people are in scope. A not-applicable response requires a reason and is never scored as a high answer.
Five views of readiness, with distinct meanings.
- Weighted maturity: overall capability and 11 dimension scores. Authority, identity, risk, testing and operations carry greater weight.
- Evidence confidence: how far current evidence supports the responses.
- Critical gate status: 24 gates recorded as red, amber or green, including four conditional gates.
- Readiness decision: the next decision the use case may be a candidate to enter.
- Indicative autonomy ceiling: the highest form of agent involvement the current evidence supports for consideration.
Readiness decision
| Level | Meaning |
|---|---|
| R0 | Insufficient basis to assess |
| R1 | Critical foundation work required |
| R2 | Suitable for design and controlled validation |
| R3 | Candidate for a bounded supervised experiment |
| R4 | Candidate for controlled production validation |
| R5 | Strong candidate for governed scaling review |
Autonomy ceiling
| Level | Meaning |
|---|---|
| A0 | No agent action |
| A1 | Advisory assistance only |
| A2 | Human-approved action |
| A3 | Bounded supervised action |
| A4 | Governed autonomy within defined conditions |
| A5 | Expanded or dynamic autonomy review |
An R-level is a readiness finding. An A-level is an indicative limit for review. Neither approves deployment or expanded authority. A competent accountable body must decide using evidence appropriate to the process, use case, affected people, sector and jurisdictions.
Carry agent-specific controls into the roadmap.
The Readiness Roadmap is shared across the broader improvement journey. For Agentic AI, add the relevant limits on authority, identity, memory, delegation and affected-person risks to its action register and decision gates.
Example action: identity and bounded permissions
| Action | Implement a unique non-human identity and task-bounded permissions for the complaint-resolution agent. |
| Source finding | P6.2 red: unique agent identity; P6.3 amber: least-privilege access. |
| Why it matters | Shared credentials prevent attribution and can exceed the authorised task. |
| Owner | Head of Identity and Access Management. |
| Evidence | Identity record, approved entitlement design, access test and revocation test. |
| Reassessment impact | P6.2, P6.3, gates G10 and G11, and the indicative autonomy ceiling. |
Apply the seven roadmap gates to Agentic AI
- Gate 0: agree organisational scope and participants, record unknowns, identify the use case and process owner, and exclude prohibited activity.
- Gate 1: complete screening, resolve red stop conditions and identify participants and evidence for the detailed assessment.
- Gate 2: challenge the detailed assessment, close red gates or remove blocked actions, document intended autonomy and human controls, complete legal classification and approve testing.
- Gate 3: authorise a bounded experiment with prior acceptance thresholds, a representative setting, identity, least privilege, logging, containment, staffed oversight and stop conditions.
- Gate 4: meet the R4 conditions, required gates and permissible approved exceptions; pass end-to-end and recovery testing; accept residual risk; activate monitoring and incident response.
- Gate 5: use sustained evidence at the current authority level, validate benefits and economics, review incidents, overrides and differential outcomes, and reassess resilience, capacity and concentration risk before expanding authority.
- Gate 6: document retirement or replacement, revoke access, address data and memory retention or deletion, reconcile actions, complete supplier exit and continuity, and incorporate lessons.
Agent-specific closure and reassessment
Closure requires accepted operating evidence, owned residual risk and refreshed assessment and gate status. Recalculate the readiness decision and autonomy ceiling where affected.
Reassess changes to agent objectives or actions; autonomy, volume, value or affected population; model versions or suppliers; prompts, instructions, tools, integration, permissions, memory or knowledge sources; and new agent-to-agent delegation or orchestration. Also apply the common roadmap triggers for process, workforce, obligations, incidents, performance, new geographies and scheduled reviews.
Maintain a process-and-agent view showing dimension changes, the autonomy ceiling and reassessment history.
Recognised foundations, independently developed.
IGX360 draws on the NIST AI Risk Management Framework and ISO/IEC 42001 organisational and lifecycle concepts, relevant EU AI Act risk, transparency and oversight concepts, and OWASP agent-specific controls. These references do not constitute certification, assurance, legal advice or endorsement.
The approach is vendor-neutral. Ownership of a particular model, cloud, BPM, process-mining, RPA or agent platform does not itself improve readiness; the evidence must demonstrate the outcomes and controls the use case needs.