# AI Agent Rails Readiness Assessment: Where to Start, Function by Function

This AI agent readiness assessment asks 20 questions about your data, controls, people and evidence, then recommends a starting rail level for each business function that uses your customer data platform (CDP), plus the gaps to close first. It gives no total score or maturity grade. Answers stay in your browser.

**Who this is for:** leaders planning a first agent, and the engineers building this tool. It applies the [AI agent rails](https://privycdp.org/ai/rails) method and the [rail levels](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder). Prefer a worksheet? Download [the 20 questions as a CSV](https://privycdp.org/tools/agent-rails-readiness-assessment.csv). More assets: [tools hub](https://privycdp.org/tools).

## What does the assessment tell you?

The assessment tells you how much an agent may do in each function today, which job to try first and what to fix first. It takes the idea behind the [roadmap's self-assessment](https://privycdp.org/ai/ai-marketing-operations-roadmap) from one stage to a result per function.

It cannot tell you whether a job deserves an agent. Anthropic advises using the simplest solution [1](#source-1), so a script may still win. Forrester's AI Agent Use Case Readiness Tool does a different job: it covers 52 use cases and calculates a readiness score for roadmap planning [2](#source-2). Use a tool like that to rank use cases, and this one to set how far an agent may go. On PrivyCDP, every AI-assisted action is recorded in an immutable audit ledger with the human or system actor that authorised it.



## Which rail comes first in each function?

The first rail for each function comes from the agent roster, and "None" means the roster has no rail at that level. Load names and links from [agent-roster.json](https://privycdp.org/tools/agent-roster.json) at build time.

| Function | L1 | L2 | L3 | L4 |
|---|---|---|---|---|
| [Marketing operations](https://privycdp.org/ai/rails/functions/marketing-operations) | [Reporting Summariser](https://privycdp.org/ai/rails/agents/reporting-summariser) | [Journey QA Reviewer](https://privycdp.org/ai/rails/agents/journey-qa-reviewer) | [Audience Sync Steward](https://privycdp.org/ai/rails/agents/audience-sync-steward) | [Anomaly Watcher](https://privycdp.org/ai/rails/agents/anomaly-watcher), pause only |
| [Lifecycle and CRM marketing](https://privycdp.org/ai/rails/functions/lifecycle-marketing) | [Deliverability Watcher](https://privycdp.org/ai/rails/agents/deliverability-watcher), explanations only | [Claims Checker](https://privycdp.org/ai/rails/agents/claims-checker) | None | Deliverability Watcher, pause only |
| [Data and analytics](https://privycdp.org/ai/rails/functions/data-and-analytics) | [Schema Drift Sentinel](https://privycdp.org/ai/rails/agents/schema-drift-sentinel) | [Data Quality Triager](https://privycdp.org/ai/rails/agents/data-quality-triager), triage | Data Quality Triager, format-only fixes | None |
| [Compliance, privacy and security](https://privycdp.org/ai/rails/functions/compliance-privacy-security) | [Policy Drift Checker](https://privycdp.org/ai/rails/agents/policy-drift-checker) | [Access Review Assistant](https://privycdp.org/ai/rails/agents/access-review-assistant) | None | None |
| [Customer support](https://privycdp.org/ai/rails/functions/customer-support) | [Escalation Spotter](https://privycdp.org/ai/rails/agents/escalation-spotter) | [Case Classifier](https://privycdp.org/ai/rails/agents/case-classifier) | None | None |
| [Sales and revenue operations](https://privycdp.org/ai/rails/functions/sales-revenue-operations) | [Account Signal Digest](https://privycdp.org/ai/rails/agents/account-signal-digest) | [Lead Routing Proposer](https://privycdp.org/ai/rails/agents/lead-routing-proposer) | [CRM Hygiene Fixer](https://privycdp.org/ai/rails/agents/crm-hygiene-fixer) | None |
| [Product and growth](https://privycdp.org/ai/rails/functions/product-and-growth) | [Experiment Reader](https://privycdp.org/ai/rails/agents/experiment-reader) | None | None | None |
| [Platform operations](https://privycdp.org/ai/rails/functions/platform-operations) | [Cost Watcher](https://privycdp.org/ai/rails/agents/cost-watcher) | [Connector Change Reviewer](https://privycdp.org/ai/rails/agents/connector-change-reviewer) | [Sync Medic](https://privycdp.org/ai/rails/agents/sync-medic), with approval | Sync Medic, bounded retry |

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### How do I know if my team is ready for AI agents?

Check the basics for one specific job: a consent record a rule can query, an independent ledger, masked data access and a named owner. Those decide whether an agent may read at all. Drafting then needs tests and trained reviewers. Executing needs an approval service, separate credentials and a drilled stop.

### Why is there no overall readiness score?

An average would hide the answer that matters. Strong reporting cannot make up for a missing consent record, so one missing control stops a level on its own. A score also invites comparison, when levels belong to a job. You get a level and a list of fixes instead.

### What if my answers differ between teams?

Use "Differs by function" on any question where teams differ, and each function gets its own result. Marketing operations may have a tested approval path while customer support has none. Answer for what exists today, because planned controls cannot stop a bad run.

### Do my answers leave my browser?

No. The assessment runs in your browser. Answers are kept out of URLs, storage and analytics, and clear when the page closes. You can download a copy locally; email delivery is unavailable.

### What should we do if the result is L0?

Keep the job manual and close the listed gaps, starting with the first. L0 is a sensible result, because the job still runs. Gaps at this stage are worth fixing with or without agents, such as a queryable consent record and an independent audit ledger.

## Sources

1. Anthropic, Building Effective Agents (19 December 2024): https://www.anthropic.com/engineering/building-effective-agents
2. Forrester, AI Agents For Marketing Are Here: Are You Ready? (Stanhope and Liu, 8 September 2026): https://www.forrester.com/blogs/ai-agents-for-marketing-are-here-are-you-ready/
3. GDPR Article 35: https://gdpr-info.eu/art-35-gdpr/
4. Meta, Agents Rule of Two (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
5. EU AI Act, Annex III: https://artificialintelligenceact.eu/annex/3/

Once you have a result, [download the rail card template](https://privycdp.org/tools/agent-rail-card) and write a card for the first rail. The [AI agent rails](https://privycdp.org/ai/rails) hub covers the rest of the method.

This article is general information, not legal advice.

## Further reading

- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)
- [Customer data platform tools and templates](https://privycdp.org/tools)
- [AI Marketing Operations Roadmap for Regulated Teams: From Data Foundation to Selective Autonomy](https://privycdp.org/ai/ai-marketing-operations-roadmap)
- [Access Review Assistant: An AI Agent for Least-Privilege Reviews](https://privycdp.org/ai/rails/agents/access-review-assistant)