How to Prepare for Superintelligent AI: Seven Leadership Decisions

To prepare for superintelligent AI, make seven decisions in order and do not try to predict when it arrives. Decide who owns your data, which role to delegate first, where company knowledge lives, how models can be swapped, who and what has access, how you will gather evidence, and where human approval is required. Each decision pays off with the AI agents available today and becomes more valuable as models improve.

Key takeaways

• Preparation is a set of decisions about ownership, access and approval, not a forecast about timing.
• Order matters: data ownership and one clearly scoped role come before tools, and approval limits come last because they depend on everything before them.
• Keep identity, memory and permissions outside the model, so a stronger model can be adopted without rebuilding the company's setup.
• Write each decision down with a named owner and a review date, so it can be audited and changed deliberately.
• A small, observable first role teaches more than a broad strategy document.

Why decide instead of predict?

Nobody can tell you when AI will become far more capable than people at most knowledge work, or whether it will arrive as a single event. Plans that depend on a date tend to fail in one of two ways. Either the company waits for a moment that never announces itself, or it spends heavily on a prediction that turns out wrong.

Decisions age better than predictions. If your data is clearly owned, your knowledge is stored in a form you control, and your agents have narrow permissions and measurable jobs, then a more capable model is an upgrade to something you already run. If none of that exists, a more capable model is a larger risk landing on a weaker foundation.

The seven decisions below are ordered so that each one makes the next one easier. Earlier decisions are cheap to make and expensive to skip. Later ones are where most leadership attention should go once the groundwork is in place. If you want a broader frame, the 90-day plan for preparing for far more capable AI covers the same ground as a calendar.

Decisions one to three: ownership, role and memory

These three decisions define what the company is actually bringing to the table.

Decision one: decide who owns your data and where it may go. Write down which categories of information are yours alone, which may be processed by an outside provider, and which must never leave your environment. Ask each provider whether your inputs are retained, whether they are used to improve shared models, how you export everything, and in which region it is stored. Most companies discover they have never answered these questions in one place. The answers become the rulebook for every later choice.

Decision two: choose one role worth delegating. Do not start with a platform or a general assistant. Start with a single job that has a clear owner, a repeatable input, a visible output and a person who can tell you whether the result was good. Examples are triaging inbound requests, preparing a weekly operations summary or drafting first responses for a defined category of customer questions. A narrow role gives you something to measure and something to correct.

Decision three: decide where the company's memory lives. An agent is only as useful as the context it can reach: procedures, past decisions, glossaries, customer history and the reasons behind exceptions. If that knowledge sits only in people's heads or inside a vendor's proprietary format, it cannot be reused or moved. Keep it in plain, company-owned documents and records that the agent reads from, and keep a short log of decisions and corrections. This is also where your most valuable know-how sits, so the guidance in protecting company know-how as AI agents grow more capable belongs next to this decision.

A quick test for these three: could a new manager read your data rules, your first role description and your knowledge store, and understand how the company intends to work with AI? If not, keep writing before you build.

Decisions four and five: model independence and access

Decision four: keep the model replaceable. Models will change, and the best option next year may come from a different provider than today's. Treat the model as one component. The agent's identity, instructions, memory, tools and channel connections should live in a layer you control, so that swapping the model is a configuration change plus a re-test, not a rebuild. Keep a fixed set of representative tasks and run it whenever the model changes. The reasoning behind this is covered in how to avoid AI vendor lock-in with business agents, and the layers involved are mapped in the seven layers of company AI infrastructure.

Decision five: decide how access is granted, limited and removed. An agent should have its own identity, never a borrowed personal login. Give it only the systems and actions its role needs, and make each permission time-bound or reviewable. Separate reading from writing, and writing from anything that moves money, contacts customers or changes records of legal importance. Standard authorization guidance, such as the OWASP Authorization Cheat Sheet, applies directly: deny by default, grant the least privilege required, and log every decision.

Use this decision guide when granting a permission:

• Does the role fail without this access? If not, do not grant it.
• Can the access be read-only first? If yes, start there.
• Who is the named human owner of this permission?
• When does it expire or come up for review?
• Can you see in a log what the agent did with it?
• Can you revoke it in minutes, by one person, without the vendor?

Access is not a one-time setup. A recurring check keeps it honest, and a quarterly AI agent permission review gives you the steps and the evidence to keep.

Decisions six and seven: evidence and approval limits

Decision six: decide what counts as proof. Before the agent does real work, define the observable result that tells you it is helping. That may be handling time for a defined task, rework needed on its drafts, or the share of cases a person had to correct (tracked as a count your team agrees on, not a number you quote externally). Build a small set of real examples with agreed good answers and rerun it on a schedule. The practice of evaluating agents with realistic tasks is described well in Anthropic's writing on evals for AI agents, and how to define success criteria for an AI agent pilot shows how to turn it into a page your team can sign.

Decision seven: set approval limits. This is the decision that matters most as capability rises, and it comes last because it depends on the previous six. Sort every action the agent might take into three groups:

• Act freely: reversible, low impact, inside its own workspace, such as drafting, summarizing and sorting.
• Act with approval: anything that reaches a customer, changes a shared record, spends company resources or commits the company to something.
• Never act: actions reserved for people, such as legal sign-off, hiring decisions or changes to its own permissions.

Then assign a named approver for each approval category, a response time that approver can realistically meet, and one person who can pause the agent immediately. Limits should loosen only when your evidence from decision six supports it, and tighten again when it does not. This mirrors the governance thinking in the NIST AI Risk Management Framework: define roles, measure, manage and revisit. A more capable model does not change the logic. It raises the stakes of getting the boundaries right, which is why they are written down before they are needed.

What does a first quarter of these decisions look like?

You do not need to finish all seven at full depth. You need a defensible first version of each, tied to one real role. A practical sequence:

• Week one: name an executive owner and write the data rules from decision one on a single page.
• Weeks two and three: pick the first role, write its description, its input, its output and the person who judges the result.
• Weeks three to five: gather the knowledge the role needs into company-owned documents, and note what is missing.
• Weeks five to six: define the agent's identity and permissions, starting read-only, and decide how the model can be replaced.
• Weeks six to eight: build the small evaluation set and agree the success criterion.
• Weeks eight to ten: write the three-group approval list, name approvers and the person who can pause the agent.
• Weeks ten to twelve: run the role with real work, review results against the criterion, and adjust one limit at a time.

Illustrative scenario: a regional service company wants help with incoming supplier invoices. Its leaders decide that invoice data may be processed by an outside model but not retained, that the first role is matching invoices to purchase orders, and that the matching rules live in a shared document the finance lead maintains. The agent gets read access to the purchasing records and write access only to a review queue. Anything it flags as a mismatch goes to a named person, and payments stay entirely with people. After a few weeks the team compares its matches with the finance lead's own, and only then considers letting it clear the simplest matches without review. If a stronger model appears, the same invoice set is rerun before anything changes.

Be Human handles this as managed work. A first engagement defines one useful role, the memory and tools it needs, the approval boundaries and an observable success criterion. After that, managed operations can include monitoring, recurring evaluations, integration maintenance, permission reviews, incident response and controlled improvements, with the agent's identity, memory and permissions kept under your control. For how the early period typically runs, see what the first months with a managed AI agent look like.

Take the free Be Human AI diagnostic to find the first task worth handing to an agent.

Frequently asked questions

Do we need to understand superintelligence to start preparing? No. You need to understand what you own, what you want to delegate and who approves what. Those questions are identical whether the next model is slightly better or far better, so the work does not wait on a definition.

Is this relevant for a company that has not used AI agents yet? Yes, and it is easier to do before the first agent exists. Decisions one, two and three cost mostly time and clarity, and they prevent habits from forming around shared logins, scattered documents and unclear responsibility.

Who should own these decisions? One executive sponsor should hold the full set, with named owners for data, access and approvals below that person. The decisions cross legal, operations and technology, so they should not sit with a single technical team alone. The sponsor's job is to keep the written decisions current.

How often should we revisit the seven decisions? Review permissions and approval limits on a regular schedule, and revisit all seven whenever you change the model, add a new role or have an incident. Between those events, a short check that the written rules still match what the agent actually does is enough.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.