Is Your Company Ready for Superintelligence? A 10-Question Checklist

Superintelligence, in the sense used in debates about the future of AI, is not a product your company can buy and install. What you can assess today is operational readiness: whether your data, processes, permissions and owners are organized well enough to expand the use of agents and automations without losing control. A ten-question diagnostic exposes those gaps before any larger pilot or contract.

Key takeaways

• Readiness depends on reliable data, described processes and named owners, more than on how sophisticated the model is.
• Permissions should be minimal: the agent reads and acts only on what its role requires.
• Every relevant action needs a record, and every sensitive decision needs human review.
• A pilot with one real workflow, an agreed metric and a deadline for deciding is worth more than a broad plan without an owner.
• If many answers are "we don't know," the next step is to map, not to expand.

Why the superintelligence debate does not change today's work

The debate about systems far more capable than humans is legitimate, but it rarely helps a manager make a decision next week. To understand the difference between what is discussed for the future and what exists in commercial use, read Superintelligence vs ChatGPT: The Real Difference for Business. The questions below are the same ones that apply to any AI in operation: where the information lives, who answers for the result, and what the system can do on its own. Companies that answer them well can expand use with fewer surprises, whatever name the model carries.

Data: the first three questions

The three data questions are:

• Do we know where the information the agent will use lives, and who is responsible for keeping it up to date?
• Is the data current and consistent across spreadsheets, CRM, order system and customer service?
• Do we have a clear purpose and legal basis for using customer data, and do we know whether any data leaves Brazil when it passes through an AI provider?

The third question is the one most often neglected. Personal data handled by a WhatsApp agent, an email assistant or a transcription tool falls under the LGPD (Brazil's General Data Protection Law), and the company needs to know what each data point is for and where it is processed. The ANPD, Brazil's data protection authority, is the official reference to follow on this subject. If the team cannot list the data that feeds the agent, expansion should wait.

Processes: two questions about what is written down

The two process questions are:

• Can we describe the current process step by step, including the exceptions that show up every week?
• Do we know which decisions follow fixed rules and which require human judgment?

A process that exists only in the heads of two people cannot be handed to an agent. The description does not need to be a long manual, but it must show inputs, outputs, deadlines and what happens when something falls outside the usual pattern. In practice, the best split is usually this: deterministic workflows with clear rules for what is repetitive, and AI to interpret ambiguous messages, summarize context or suggest a reply that someone reviews. Anthropic's published guidance on building effective agents reinforces the idea of starting with simple workflows and increasing autonomy only when there is a proven need.

Permissions: three questions about what the system can do

The three permission questions are:

• Which systems can the agent read, and which can it change?
• Is there any action the agent never performs without human approval, and is that rule written down?
• Who revokes access when a person changes role, when a vendor is replaced or when the agent is switched off?

Here the practical rule is to grant the minimum necessary. An agent that answers delivery time questions does not need write access to finance. The OWASP authorization guidance starts from principles such as denying by default and checking permission for each operation, not only at login. It is also worth treating content that arrives from outside, such as customer messages and web pages, as untrusted input, because it can try to push the agent to act beyond what was intended.

Owners: the last two questions

The two ownership questions are:

• Who owns the business process, and who answers for the replies the agent gives customers?
• Who reviews the records and metrics every month, and who has the authority to decide whether to expand, adjust or stop?

An agent without an owner becomes a problem nobody takes responsibility for. When a wrong answer reaches a customer, the useful question is not "whose fault is it," but "who fixes the workflow and who communicates the change." We recommend naming two roles: a process owner, who knows the business rule, and an operations owner, who tracks records, costs and escalations. In small companies, one person can hold both roles, as long as that is defined.

Illustrative scenario: a store that wants to answer on WhatsApp

Illustrative scenario: a building materials store wants an agent to answer questions about stock and delivery time. While working through the ten questions, the team finds that stock sits in a spreadsheet updated by three people, that the delivery time depends on a routine nobody has written down, and that the sales manager never defined what the agent may promise. The result of the diagnostic is not to reject AI. It is to organize the spreadsheet, write the delivery rule, limit the agent to checking stock, and transfer any discount request or exception to a person. Only after that does it make sense to test a small workflow.

How to use the diagnostic in practice

The diagnostic works best when it is answered together with the people who run the process, not only by top management. A simple routine is usually enough:

• Bring together the people who operate the process and the person who is accountable for it, in a one-hour conversation.
• Answer each of the ten questions with "yes," "no" or "partially," noting the evidence behind each answer.
• Group the gaps into three lists: data to organize, rules to write and permissions to restrict.
• Choose one real workflow for the pilot, with a metric agreed before it starts.
• Set the date when the team will decide to expand, adjust or stop, based on the records.

Our approach follows four steps: map the current process and its baseline, limit data and actions, pilot one real workflow with records and an agreed metric, and then transfer the operation and decide the next step. This sequence does not promise results. It reduces the risk of expanding something you have not yet understood. When the company plans to use AI over messaging channels, also check the platform rules, such as the 24-hour window, before designing the flow. The article WhatsApp 24 Hour Customer Service Window: How an AI Agent Should Act explains the starting point.

When not to expand yet

A negative answer does not mean postponing everything. The guide below helps separate what to do now from what should wait:

• If the data is not reliable, organize the source before any agent.
• If the process is not described, map it before automating.
• If there is no named owner, do not start a pilot in customer service.
• If permissions are broad, restrict them before testing.
• If all answers are clear, choose a small workflow and start the pilot with records.

For managers who must decide these points on their own, it is also worth considering what to delegate and what to keep, as we discuss in Superintelligence for Founders: What to Decide Yourself and What Not To.

Frequently asked questions

Do I need a data team to answer the diagnostic?

No. The ten questions are about management and operations, and most answers sit with the people who run the process. A technical team comes in later to build integrations and permissions, but defining the owner, the rule and the limit can be done by the company itself.

If the company already uses ChatGPT or another ready-made tool, does it still need this diagnostic?

Yes, especially if employees use the tool with customer data. Before allowing use, the company needs to define what can be pasted, who can use it and what is forbidden. A simple usage policy already answers many of the questions about data and permissions.

How long does it take to answer the ten questions?

It depends on the size of the process and how many people need to be consulted, but a well-prepared conversation is usually enough to identify the main gaps. The goal is not to turn the diagnostic into a project without an end, but into a list of actions with an owner and a deadline.

Should I wait for superintelligence before starting with AI?

There is no reason to wait. Practices around data, processes, permissions and responsibility serve the AI that exists today, and they will remain useful for any more advanced system. Starting with internal organization is the safest way to prepare the company for what comes next.

Sources

• NIST AI Risk Management Framework
• OWASP: Authorization Cheat Sheet
• Anthropic: Building effective agents
• ANPD: Autoridade Nacional de Proteção de Dados