AI & Agentic Systems

Agent-readiness scorecard

Twelve questions about your estate, none about which model you use. Scores whether an agentic workflow would survive security review.

Twelve questions about your estate, none of them about which model you use. Answer honestly — the score is only useful if it is wrong in the directions you already suspect.

Access

Is there a current inventory of the APIs and interfaces an agent could call?
Not a wiki page from 2023 — something that matches what is deployed.
Can an agent be given its own identity, separate from a human's?
A service principal or workload identity, not a borrowed employee account.
Can permissions be scoped narrowly enough to limit what it may change?
Read-only on some systems, write on a specific object type, nothing else.

Accountability

Could you reconstruct every action taken by a non-human caller last Tuesday?
Who called what, with which arguments, and what came back.
Are the write operations reversible, or gated behind a human approval?
Somebody will eventually need to undo an agent's afternoon.

Safety

Are the systems it would call protected by rate limits and quotas?
An agent in a retry loop is a load test you did not schedule.
Are the write endpoints idempotent, or protected by idempotency keys?
Agents retry. Without this, a retry becomes a duplicate order.
Is input validated against a schema before it reaches a system of record?
The model will eventually send a malformed payload with total confidence.

Delivery

Is there a non-production environment with realistic data to test against?
Somewhere an agent can be wrong without consequences.
Is there an evaluation set that would catch a regression when the model changes?
Providers update models underneath you. Behaviour drifts silently.
Is there a named owner for the workflow once it is live?
Not the project team — whoever answers the pager in six months.
Is there one specific workflow it would do, that annoys someone today?
A person moving data between three systems and applying a stateable rule.

0 of 12 answered

Nothing is submitted, stored or sent — the score is computed in your browser and disappears when you close the tab. There is no email gate, deliberately: a scorecard that holds your own answers hostage is a lead form wearing a costume. Weights are shown next to each gap so you can disagree with the arithmetic.

Other tools

These exist because the underlying problem is real. If the numbers you just put in look uncomfortable, that is usually worth a conversation.

Tell us what you're running