Superintelligence Readiness Assessment: Score Your Company Today

A superintelligence readiness assessment is a structured check of whether your company can give more capable AI agents useful, bounded work without losing control of data, access or quality. It scores five areas on one scale: data, memory, tools, permissions and review habits. Leaders who score each area with written evidence can see which gaps to close first, without depending on a forecast of what future models will do.

Key takeaways

• Score five areas on one scale: data, memory, tools, permissions and review habits.
• Permissions and review habits deserve attention first, because they limit the damage any agent can cause.
• Every score needs written evidence. A score without evidence is an opinion.
• Choose one or two gaps for the next cycle, each with a named owner and a check you can repeat.
• Treat the result as a baseline to measure again, not as a verdict on the company.

Why readiness depends on your company, not on the model

Model capability changes on the vendor's schedule, and your company does not control it. What stays with your company is the structure around the model: where knowledge lives, what an agent can remember, which systems it can call, who approved that access, and whether anyone reads what it did. A company with clean records, narrow permissions and a habit of review can adopt a stronger model with a configuration change and a test run. A company without those foundations has to rebuild them under pressure.

That is why the assessment measures present operating conditions rather than guesses about what comes next. The NIST AI Risk Management Framework organizes AI risk around governing, mapping, measuring and managing, which is a useful lens for the same questions. Use it as a checklist of concerns, then score your own evidence against them.

The five areas to score

Data is where the company's knowledge lives, who owns each source, how current it is, and whether anyone has decided which sources an agent may read. Ask whether the policies, price guidance and process documents an agent would need sit in one reviewed place or are scattered across personal drives and inboxes.

Memory covers what the agent may keep between sessions, where that memory is stored, who can view and delete it, and how it stays separate between clients, teams or projects. Memory without an owner creates risk in both directions: outdated facts get repeated, and sensitive details persist where they should not.

Tools are the actions an agent can take through connected systems, such as a CRM, a calendar, a document store or a billing interface. A tool inventory lists each action, its inputs, what it changes and whether it can be reversed. A single generic action such as "update records" is harder to permission and harder to audit than five narrow ones.

Permissions define which identity the agent acts under, which scopes it holds, and who approves a change. Least privilege is the working principle. The OWASP Authorization Cheat Sheet is a practical reference for checking that access is enforced by the systems themselves rather than assumed from the interface. In a sound design, read access is broader than write access, and writes that touch money, customer records or outbound messages require an explicit approval step.

Review habits describe whether someone looks at what the agent did, how often, and what happens when it is wrong. This includes readable logs, a small set of realistic test tasks, and a clear incident path. The OpenTelemetry observability primer explains the underlying idea: you cannot review what you did not record.

How to score each area from 0 to 3

Use the same scale for all five areas. Score the highest level you can demonstrate today, not the level you plan to reach.

• 0: Absent. Nobody can say what exists or who owns it.
• 1: Ad hoc. Something exists, but it depends on one person's memory or habits.
• 2: Documented and partly tested. There is a named owner, a written list, and at least one check that has been run.
• 3: Owned, tested and reviewed on a schedule, with the evidence from the last review kept on file.

A combined total out of fifteen is useful for comparing areas and tracking change over time. Read the individual scores first, though. A zero in permissions matters more than a strong total in data, because permissions determine what a mistake can reach.

Run the assessment in one working week

• Step one: Name the reviewer. Choose one leader who owns the result and can approve the gap list. Without this, the scores will not turn into decisions.
• Step two: List five to ten recurring workflows where an agent might help, such as answering routine supplier questions or preparing proposal drafts.
• Step three: For the strongest two or three candidates, note which data each task reads, what the agent should remember, which tools it would call, which identity it would use and who would review its output.
• Step four: Score each of the five areas for each candidate, attaching one piece of evidence per score, such as a document link, a permission export or a sample log entry.
• Step five: For each area, write the gap as one sentence that names the owner and the missing artifact.
• Step six: Pick the two gaps that must close before any agent receives write access, and schedule the next scoring session before the meeting ends.

Illustrative scenario: a small services firm

Illustrative scenario, not a real company: a small services firm wants an agent to draft follow-ups to clients from its shared inbox and project folders. The assessment shows data at 2, because the project folder is well organized but the pricing guidance lives in one partner's notes. Memory scores 1, because nobody has decided whether the agent may recall client details across projects. Tools score 1, because the only connection is a generic document editor. Permissions score 0, because the test account has administrator rights across the shared drive. Review habits score 1, because drafts are read only when someone has spare time.

The team does not begin by choosing a more capable model. They replace the administrator account with a read-only identity, define one narrow tool that creates draft replies a person must send, and move the pricing guidance into the reviewed folder. They then run the agent on three real follow-ups and check each draft against a short list. In this scenario, the permissions score would move from 0 to 2 and the review score from 1 to 2, while the team keeps the agent away from sending anything on its own.

Reading the result: a decision guide

• If permissions score 0 or 1, do not give the agent write access to customer records, money or outbound messages until that changes.
• If memory scores 0 or 1, limit the agent to a single task session with no stored personal or client details.
• If tools score 0 or 1, reduce the agent to one or two named actions and write a short description of what each one changes.
• If review habits score 0 or 1, add a human approval step before any output leaves the company.
• If data scores 0 or 1 and the workflow depends on that data, choose a different workflow first.
• If every area scores 2 or higher, choose the workflow with the clearest success criterion and run a controlled pilot.

Before you start that pilot, define the success criteria so the test has a clear pass condition and a clear reason to stop.

Keep the score current between assessments

A score decays when people, tools and data sources change, so it needs a fixed rhythm. Check the permission and review areas whenever a new person, system or data source joins the workflow, and run the full scoring at an interval the reviewer sets. A quarterly permission review is a practical way to give the permissions score that rhythm, and the company AI infrastructure layers guide shows where each area sits in the wider setup.

Be Human designs, implements and operates personalized AI infrastructure, and this assessment is the first step of how that work begins. A first engagement defines one useful role, the memory and tools that role needs, its approval boundaries and an observable success criterion. In managed operations, the same five areas are revisited through monitoring, recurring evaluations, integration maintenance, permission review and incident response, so today's score stays a working record rather than a document that goes stale. The service is remote and available in English and Portuguese.

If you want a starting point, the free Be Human AI diagnostic can help you find the first task worth handing to an agent.

Frequently asked questions

How long does a readiness assessment take? A focused version fits within one working week for a single department, because most of the time goes to listing workflows and collecting evidence rather than debating scores. Companies with many systems or unclear ownership need more time to locate the artifacts. The goal is a defensible score, not a complete audit.

Who should score the company? The leader who owns the workflow should sponsor the result, while the people who run the systems supply the evidence. Scores drawn only from executives tend to overrate documentation, and scores drawn only from technical staff can miss the approval gaps that matter to the business.

Do we need a high score before starting an agent pilot? No, because a pilot is useful precisely because it exposes gaps. The requirement is that the pilot uses only the permissions, memory and tools its scores support, and that it stops if it reaches a boundary it was not given. Low scores tell you which limits to set before the pilot begins.

How often should we repeat the assessment? Repeat the full scoring at an interval set by the reviewer, and recheck the permission and review areas whenever a new tool, person or data source enters the workflow. Waiting for the calendar alone is not enough, because a single new integration can change the permissions picture without anyone noticing.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.