How to Prepare Your Company for Superintelligence: A Practical Plan
Prepare for superintelligence without betting on forecasts: document processes, organize data, limit permissions, build evaluations and keep human approval.
Want to apply this in your company?
Book a call with Juan →How to Prepare Your Company for Superintelligence: A Practical Plan
To prepare your company for superintelligence, you do not need to predict when it arrives or what it will look like. Invest in what improves any AI system, today's or tomorrow's: documented processes, organized data, minimal permissions, repeatable evaluations and human approval for risky decisions.
Key takeaways
- Nobody knows if, when or how superintelligence will appear, so the useful preparation is the kind that works in every scenario.
- A process that is not written down cannot be delegated to any system, human or artificial.
- Internal data and knowledge need an owner, an update routine and access rules before any agent uses them.
- Minimal permissions and repeatable evaluations let you switch models without rebuilding your operation.
- Human approval belongs where a mistake is expensive or hard to undo.
What does it mean to prepare without betting on predictions?
Serious people believe that systems far more capable than today's are close, and equally serious people believe they are far away or will never arrive. For someone making decisions in a company, that debate is not very useful. What you control is the quality of your own operation.
A good way to think about it: separate official documentation, deployment experience and hypothesis. Vendor documentation tells you what a model does today. Deployment experience shows where projects usually stall: informal processes, scattered data, access that is too broad. The hypothesis about superintelligence belongs in the third group, and no budget decision should depend on it.
The practical test is simple. For each preparation step, ask: does this still hold if models improve only a little? And if they improve a lot? If the answer is yes in both cases, the investment is safe. If it only makes sense in one specific scenario, it is a bet, and a bet is not preparation.
It is also worth following the regulatory environment, which changes independently of the technology. A good starting point is understanding Brazil's AI regulation and what companies should do now along with the ANPD guidance on personal data.
Why does documenting processes come first?
A more capable system executes well-described work better, and it also makes mistakes with more confidence on poorly described work. If support, billing or triage depend on what each person thinks is right, there is nothing to hand to an agent, let alone to something more powerful.
Documentation does not have to be a two-hundred-page manual. For each important process, record the essentials:
- What trigger starts the process.
- What information comes in and where it comes from.
- What the steps are, in the order they actually happen, not the order they should happen.
- What exceptions appear and who decides on them.
- What the expected result is and how you know it worked.
- Who owns the process.
The exceptions item is the most valuable. That is where your team's judgment lives, and it is usually only in the heads of one or two people. Writing it down reduces dependence on individuals today and builds the foundation for any automation later.
Start with processes that repeat often, involve customers and have reasonably clear rules. Leave the more ambiguous ones until you have gained some practice.
How do you organize company data and knowledge?
Most companies have knowledge scattered across personal spreadsheets, WhatsApp groups, emails, PDFs in different versions and a half-filled CRM. Any AI system that reads this material will inherit the mess. A better model does not fix a returns policy that exists in three contradictory versions.
The preparation here is about management, not technology:
- Define a source of truth for each type of information (prices, deadlines, policies, customer records).
- Give each source an owner and a review date.
- Remove or mark as obsolete anything that is out of date.
- Classify what is personal data, what is sensitive and what is confidential to the business.
- Record where each piece of data was collected and for what purpose, which is what LGPD asks of any processing.
This classification also decides where a piece of data can be processed. If personal information is sent to a service outside the country, specific requirements apply, so review what LGPD says about international data transfer when using AI providers first. For very sensitive data, some companies consider running models on their own infrastructure, which brings other operating costs.
Finally, set a usage rule for the tools your team already uses on its own. A company policy for employee ChatGPT use makes clear what can be pasted into an external tool and what cannot, and it is one of the cheapest and most urgent preparations.
How do you define permissions and action limits?
The more capable a system is, the more important it is to limit what it can do. The principle is old in information security: least privilege. Each agent, integration or tool should have access only to what the task requires, and nothing more.
In practice, map three things for every AI system:
- What it can read (which databases, which fields, which customers).
- What it can write or execute (send a message, change a record, issue a discount, open a ticket).
- What it must never do alone (payments, cancellations, legal replies, anything irreversible).
Also separate credentials by role, and do not use a person's password for an agent to operate. Authorization guides, such as the one from OWASP, focus on checking permissions on every request and denying by default.
There is a second risk: malicious content that tries to manipulate the agent, such as a customer message with hidden instructions. Hard action limits are the best defense, because they work even when the text convinces the model. Read about prompt injection protection for AI agents before giving an agent access to tools.
Log everything the agent does: what it received, what it decided, which action it executed. Without a decision log there is no audit, and without an audit there is no safe way to expand autonomy.
How do you build evaluations that survive a model change?
Models change quickly. What should not change is your yardstick. An evaluation is a set of real situations, with the acceptable answer or behavior defined by you, that runs whenever something changes: the model, the instruction text, the knowledge base.
If you have one, switching models becomes an afternoon test, not an act of faith. If you do not, every new release becomes a debate of opinions.
Build your set like this:
- Gather real conversations and cases, already anonymized, including the hard ones and the ones that went wrong.
- For each case, write what a good answer looks like and what would be unacceptable.
- Include cases where the correct move is to refuse or hand off to a person.
- Run the set before any change and compare it with the previous run.
- Review the set periodically, because the business changes.
Test actions as well, not only text. A simulation environment lets you check what the agent would try to do without touching real systems, and there is a step-by-step guide on mock tools for testing AI agents in a safe sandbox. Engineering literature on agent evaluations, such as Anthropic's, and the NIST risk management framework reinforce the same idea: measure before you trust, and keep measuring.
Where should you keep human approval?
Human approval is not a brake on technology. It is how you delegate responsibly. The useful question is not whether a person should review everything, but which decisions justify review.
A simple decision guide:
- Reversible, low-impact action with a clear rule: can be automatic, with a log.
- Reversible action that involves a customer: automatic, with periodic sample review.
- Action that is hard to undo and involves money, health, legal rights or reputation: human approval before execution.
- Out-of-pattern situation or low confidence: hand off to a person with the context already summarized.
Also define who approves, how quickly, and what happens if nobody responds. Approval without an owner becomes a stalled queue, and the team starts approving on autopilot, which is worse than having no control.
When an automated decision affects a data subject, LGPD gives them the right to request a review. Understand what LGPD Article 20 says about automated decisions and design the human review path from the start, not after a complaint.
What is the step-by-step plan, and what does it look like in practice?
The method we use organizes this work into four moves: map, limit, pilot and hand over. Mapping is describing the current process and measuring a baseline. Limiting is defining the data, tools and actions allowed. Piloting is running a single real flow, with logs and a success metric agreed in advance. Handing over is delivering the documented operation and deciding, with evidence, whether to expand, adjust or stop.
In steps:
- Choose a process with volume, reasonably clear rules and limited impact.
- Document it, including the exceptions and the owner.
- Identify the data sources and fix what is out of date.
- Define minimal permissions and the actions that require approval.
- Build the evaluation set with real, anonymized cases.
- Run a restricted pilot, with decision logging.
- Compare against the baseline and decide: expand, adjust or stop.
Illustrative scenario: an electrical supplies distributor wants an agent to answer order questions on WhatsApp. Before choosing any tool, the team writes down how an order status is checked, who authorizes a duplicate invoice and what to do with a delivery complaint. The agent gets read-only access to order status and can change nothing. Cancellation requests go to a support agent, with the history summarized. Some time later, the company switches models: it runs the same set of cases, compares the results and decides within a few days. The gain did not come from the model. It came from what was prepared around it.
If you want to see how this kind of work is usually run, there is a description of how Juan Carlo works with companies.
Frequently asked questions
Will artificial superintelligence change what I need to do today? Probably not the essentials. Clear processes, reliable data, limited access, evaluations and human review remain necessary if systems get only slightly better, and if they get much better, they become even more important.
Do I need to hire someone or buy a platform to start? Not necessarily. The first job is internal: writing down processes, naming owners and cleaning up information sources. Tools and outside help make more sense once you know which flow you want to pilot and how you will measure the result.
How do I know if I am overdoing human control? Check whether approvals are made with attention or on autopilot, and whether the queue delays the customer. If almost everything is approved unchanged, that class of action may be able to run automatically with sample review. If errors reach the customer, you have too little control.
Where do I start if my company is small? Pick a single repetitive process, such as answering frequent questions or triaging orders, and do the five preparations at small scale. One process page, one source of truth, one restricted access, a set of twenty test cases and a rule for when to call a person already change the safety of the operation a great deal.