tools

AI Agent Rails Readiness Assessment: Where to Start, Function by Function

This AI agent readiness assessment asks 20 questions about your data, controls, people and evidence, then recommends a starting rail level for each business function that uses your customer data platform (CDP), plus the gaps to close first. It gives no total score or maturity grade. Answers stay in your browser.

By Art Kukharenko · Published · Updated

All tools

Who this is for: leaders planning a first agent, and the engineers building this tool. It applies the AI agent rails method and the rail levels. Prefer a worksheet? Download the 20 questions as a CSV. More assets: tools hub.

What does the assessment tell you?

The assessment tells you how much an agent may do in each function today, which job to try first and what to fix first. It takes the idea behind the roadmap's self-assessment from one stage to a result per function.

It cannot tell you whether a job deserves an agent. Anthropic advises using the simplest solution 1, so a script may still win. Forrester's AI Agent Use Case Readiness Tool does a different job: it covers 52 use cases and calculates a readiness score for roadmap planning 2. Use a tool like that to rank use cases, and this one to set how far an agent may go. On PrivyCDP, every AI-assisted action is recorded in an immutable audit ledger with the human or system actor that authorised it.

Which rail comes first in each function?

The first rail for each function comes from the agent roster, and "None" means the roster has no rail at that level. Load names and links from agent-roster.json at build time.

FunctionL1L2L3L4
Marketing operationsReporting SummariserJourney QA ReviewerAudience Sync StewardAnomaly Watcher, pause only
Lifecycle and CRM marketingDeliverability Watcher, explanations onlyClaims CheckerNoneDeliverability Watcher, pause only
Data and analyticsSchema Drift SentinelData Quality Triager, triageData Quality Triager, format-only fixesNone
Compliance, privacy and securityPolicy Drift CheckerAccess Review AssistantNoneNone
Customer supportEscalation SpotterCase ClassifierNoneNone
Sales and revenue operationsAccount Signal DigestLead Routing ProposerCRM Hygiene FixerNone
Product and growthExperiment ReaderNoneNoneNone
Platform operationsCost WatcherConnector Change ReviewerSync Medic, with approvalSync Medic, bounded retry

Browse use casesFunction playbooksAgent roster

Assess one job in each function

Answers stay in this page’s memory. They are never sent to a server or analytics, stored, or added to the URL. Closing the page clears them. Email delivery is unavailable. See the privacy policy.

Choose your functions

1. Foundation

For any one customer, can a system rule look up current consent and suppression for a given channel and purpose?

Rules enforce consent, not models. Without a record a rule can query, every later rail depends on someone remembering.

2. Foundation

Does an append-only record show who did what to customer data, written by a system the actor cannot edit?

Agents do not write or edit their own record. Without an independent ledger, there is nothing to audit a rail against.

3. Foundation

Has your data protection officer (DPO) decided whether agent use on customer data needs a data protection impact assessment?

GDPR Article 35 can require an assessment for new technology and for profiling. The decision belongs before the first read, so take advice.

4. Foundation

Does each agent get its own identity and scoped credentials, never a person's login or a shared key?

Shared credentials hide who acted and stop you revoking one agent alone. OWASP lists identity and privilege abuse among its top agentic risks.

5. Data

Can an agent read just one job's fields, masked by data class, through a view rather than direct table access?

A data view enforces data scope. Asking a model to ignore fields does not.

6. Data

Do automated tests flag stale or broken data before a person or an agent relies on it?

An agent drafts from whatever it is given, and a confident draft on stale data is harder to spot than an empty report.

7. Data

Has someone checked profile merges against pairs with known answers, and do they repeat that check?

A false merge can join the consent and history of two people, and any draft built on that profile inherits the error.

8. Data

Are free-text fields and other untrusted inputs marked, and kept out of any session that holds sensitive data and can change state?

Under the Agents Rule of Two, one session should hold at most two of: untrusted input, sensitive data, and the ability to change state or communicate externally.

9. Controls

Is each agent's tool list allow-listed by verb (read, propose, execute) in a gateway, outside the prompt?

A prompt is not a control. If a propose-level agent can reach a write tool, only its instructions stop it writing.

10. Controls

Does each approval go to a named person other than the requester, and bind to a hash of the exact payload?

A later change to the payload must void the approval. Timeouts must expire, never approve.

11. Controls

Do writes run through a separate execution service that checks consent and suppression by rule on every action?

With execution separated, a hijacked model holds no write credentials. Rules keep the hard limits whatever the model says.

12. Controls

Can a named person stop a rail and undo its recent changes, and have they practised doing it?

A stop nobody has tried may not work when it is needed. Rollback decides how much a bad run costs.

13. Controls

Are limits on records, sends, spend and destinations set outside the model, with auto-revert and an alert to the owner?

At L4 nobody approves each action, so written limits and auto-revert do the work that approval did at L3.

14. People

Does each planned job have one named owner who answers for it and has the authority to stop it?

A rail with no named owner should drop down the ladder automatically, so without one it cannot start.

15. People

Have reviewers practised catching wrong agent output on this job, including deliberately bad examples?

People tend to over-rely on machine output. EU AI Act Article 14(4)(b) names this automation bias for high-risk systems, and a marketing review queue is open to the same habit.

16. People

Do you report agent and review performance by rail and role, never by named member of staff?

EU AI Act Annex III point 4(b) lists monitoring workers' performance and allocating tasks by individual behaviour as high-risk uses. Take advice before any report names staff.

17. Evidence

Before any change to the model, prompt or tools, must the job pass a test set containing seeded defects and injection attempts?

Without a set you cannot tell good from lucky, and a model change can quietly undo what worked.

18. Evidence

Have you measured the manual version of this job, so you can compare it with the agent?

Cycle time, escaped error rate and override rate mean little without a baseline from before the agent.

19. Evidence

Has a job in this function run at L2 with written evidence of acceptance, overrides and errors, signed off by its owner?

Promotion needs written evidence and owner sign-off. Agreement that a draft looks good is neither.

20. Evidence

Has a job in this function run at L3 with rollback, incident and approval records, signed off by its owner?

L4 suits only low-risk, reversible actions, and the record at L3 is what shows that an action is one.

Choose at least one function to see results.

FAQ

How do I know if my team is ready for AI agents?

Check the basics for one specific job: a consent record a rule can query, an independent ledger, masked data access and a named owner. Those decide whether an agent may read at all. Drafting then needs tests and trained reviewers. Executing needs an approval service, separate credentials and a drilled stop.

Why is there no overall readiness score?

An average would hide the answer that matters. Strong reporting cannot make up for a missing consent record, so one missing control stops a level on its own. A score also invites comparison, when levels belong to a job. You get a level and a list of fixes instead.

What if my answers differ between teams?

Use "Differs by function" on any question where teams differ, and each function gets its own result. Marketing operations may have a tested approval path while customer support has none. Answer for what exists today, because planned controls cannot stop a bad run.

Do my answers leave my browser?

No. The assessment runs in your browser. Answers are kept out of URLs, storage and analytics, and clear when the page closes. You can download a copy locally; email delivery is unavailable.

What should we do if the result is L0?

Keep the job manual and close the listed gaps, starting with the first. L0 is a sensible result, because the job still runs. Gaps at this stage are worth fixing with or without agents, such as a queryable consent record and an independent audit ledger.

Sources

  1. Anthropic, Building Effective Agents (19 December 2024)
  2. Forrester, AI Agents For Marketing Are Here: Are You Ready? (Stanhope and Liu, 8 September 2026)
  3. GDPR Article 35
  4. Meta, Agents Rule of Two (31 October 2025)
  5. EU AI Act, Annex III

Once you have a result, download the rail card template and write a card for the first rail. The AI agent rails hub covers the rest of the method.

This article is general information, not legal advice.

Further reading

Published: · Updated:

Editorial dates describe content changes. Confirm current sources before making legal, security or purchasing decisions.