A Self-Assessment Framework for Leadership and Technical Teams

01

• Do we know how many autonomous agents — not just human users — our infrastructure is currently supporting?
• Have we modeled GPU, power, and thermal demand for agent-driven workloads specifically — not just projected human growth?
• What happens to our capacity plan if agent activity doubles in the next six months?
• Do we have a process to detect and respond to unplanned compute drift before it becomes a budget or reliability crisis?

02

• Does our data classification travel with data when an agent copies, derives, or moves it into a new pipeline?
• Do our data policies explicitly address autonomous agent access, or only human researcher access?
• Can we trace, end-to-end, what happens to a sensitive dataset once an agent begins working with it?
• Who is accountable if an agent surfaces or exposes data it shouldn't have accessed?

03

• Do our approval workflows have a defined path for machine-initiated requests, not just human ones?
• Can we produce an audit trail for agent-to-agent or agent-to-service activity today?
• If an autonomous action produces an unintended outcome, do we know who owns the response?
• Have we updated policy documentation to reflect agentic AI activity, or is it still silent on the topic?

04

• Is our security monitoring tuned to detect anomalous agent behavior, or only anomalous human behavior?
• Have we mapped cross-service data access paths that agents can traverse, end-to-end?
• Does our incident response plan account for scenarios where an agent — not a person — is the source of an incident?
• Have we stress-tested what happens when an agent has broader access than intended?