Frontier Firm Readiness

⚡ Generate from source material ⬇ Export .yarnpack.json Advanced: raw JSON

Metadata

Scales, categories & audiences

Scales: frontier3 (3 levels) · Categories: ambition diffusion people codify security · Audiences: exec cio_data risk people process

Edit these in the raw JSON editor below — they change rarely and carry structure (levels, signals, deep-dive wiring) that a form would mangle.

About you and your organisation context

Three quick facts so the workshop is pitched right. Not scored.

Id	Question	Type	Category	Scale
ctx_seats	Roughly how many Microsoft 365 Copilot seats does your organisation hold today?	single_select	—	—
ctx_azure	Does your organisation run workloads on Azure today?	single_select	—	—
ctx_process	If the leadership team could hand one process to agents tomorrow, which would it be, and why that one?	verbatim	—	—

＋ Add question to “About you and your organisation”

The five elements core

Twenty questions across the five elements of the Frontier Firm playbook. Answer in your own words, as things are today, not as planned. Where something exists, say where we could see it.

Id	Question	Type	Category	Scale
a1	Where does AI matter to your business strategy, and where has leadership decided it does not? Who owns that answer, and is it written down?	scored_text · scored	ambition	frontier3
a2	How do you measure value from Copilot or agents today, and who sees that measure?	scored_text · scored	ambition	frontier3
a3	Have you named the processes that agents should run, and who owns each one? Was any process redesigned before it was automated?	scored_text · scored	ambition	frontier3
a4	How is AI work funded and sponsored: as licences in the IT budget, as pilots with a sponsor, or as a portfolio tied to outcomes?	scored_text · scored	ambition	frontier3
b1	Who is allowed to build an agent, who approves it, and who runs it once it is live?	scored_text · scored	diffusion	frontier3
b2	What do you build agents on today? Is there a sanctioned platform with environments, identity and cost controls?	scored_text · scored	diffusion	frontier3
b3	Can an agent reach the data it needs, in a governed way? Where does that data live, is it classified, and who curates the grounding sources?	scored_text · scored	diffusion	frontier3
b4	How does a successful agent pilot get to production? What has to be true before it is switched on for everyone?	scored_text · scored	diffusion	frontier3
c1	Have roles or manager expectations changed because of Copilot or agents? Do managers know how to direct and review agent work?	scored_text · scored	people	frontier3
c2	What AI learning is in place, by role? Is there a champions network, and is completion measured?	scored_text · scored	people	frontier3
c3	Beyond licence activation, how do you know who is using Copilot or agents, for what, and to what effect?	scored_text · scored	people	frontier3
c4	How do you assess the human impact of agents in work systems: workload, deskilling, psychosocial risk, consultation?	scored_text · scored	people	frontier3
d1	Do you know every AI system and agent in use, and which of them make or shape decisions about people? Is the privacy policy update for 10 December 2026 planned?	scored_text · scored	codify	frontier3
d2	How do you know an agent does what you intended, before release and after? Are there acceptance criteria and an evaluation set?	scored_text · scored	codify	frontier3
d3	For decisions agents influence, who reviews what, at which risk tier? Has the override path been tested?	scored_text · scored	codify	frontier3
d4	Is what makes your organisation distinct captured in the instructions, knowledge and rules your agents run on? Who owns that content?	scored_text · scored	codify	frontier3
e1	Do agents have their own identities, or do they act as the person who built them? Who owns each agent identity?	scored_text · scored	security	frontier3
e2	Are sensitivity labels and DLP applied to what Copilot and agents can reach? Has oversharing been checked and remediated?	scored_text · scored	security	frontier3
e3	What protects agents from prompt injection and tool misuse? Has any of it been tested?	scored_text · scored	security	frontier3
e4	Which of your vendors have shipped AI features into products you already use? Does procurement review AI at contract time?	scored_text · scored	security	frontier3

＋ Add question to “The five elements”

Ambition deep-dive ambition_dd · audience: exec

For the leadership team and executive sponsor.

Id	Question	Type	Category	Scale
amb_moves	If you could only make two moves on AI in the next six months, what would they be?	verbatim	—	—
amb_blockers	What is most likely to stop those moves: funding, skills, risk appetite, data, something else?	verbatim	—	—
amb_outcomes	Which of the four Frontier Firm outcomes matter most to your organisation this year?	multi_select	—	—

＋ Add question to “Ambition deep-dive”

Guardrails deep-dive guardrails_dd · audience: risk

For risk, compliance, privacy and legal.

Id	Question	Type	Category	Scale
grd_adm	List the systems you know of that make or shape decisions about individuals: recruitment, credit, eligibility, pricing, scheduling, performance, service access. Include vendor products.	verbatim	—	—
grd_incidents	Has there been an AI-related incident or near miss in the last twelve months? What happened and how was it classified?	verbatim	—	—
grd_policy	Is anyone working on the privacy policy changes for automated decision-making due 10 December 2026?	single_select	—	—

＋ Add question to “Guardrails deep-dive”

Data and agents deep-dive data_agents_dd · audience: cio_data

For the CIO, head of data and platform owners.

Id	Question	Type	Category	Scale
da_platforms	List the AI and data platforms in use today, sanctioned or not: Copilot Studio, Foundry, Fabric, Databricks, Power Platform, anything else.	verbatim	—	—
da_pilots	Describe any agent pilots underway: what they do, who owns them, and whether they touch production data.	verbatim	—	—
da_data_for_process	For the process the leadership team would hand to agents, where does its data live, and who owns it?	verbatim	—	—

＋ Add question to “Data and agents deep-dive”

People deep-dive people_dd · audience: people

For HR, change and adoption leads.

Id	Question	Type	Category	Scale
ppl_personas	Which roles have you defined Copilot personas for, and who are the champions?	verbatim	—	—
ppl_managers	What have managers been given to help them direct and review work done with agents?	verbatim	—	—

＋ Add question to “People deep-dive”

Add section

Advanced — raw JSON

Full pack document, validated on save (schema yarn-pack/2). This is where scales, audiences, structured conditions and adaptive config live.

{
  "schema": "yarn-pack/2",
  "id": "frontier-readiness",
  "version": "0.1.0",
  "name": "Frontier Firm Readiness",
  "engagement": "AISG — Frontier Firm Readiness Workshop pre-read and in-room calibration",
  "intro": "A short, guided conversation ahead of your Frontier Firm Readiness Workshop. It takes 15 to 20 minutes. Answer as things are today, in your own words; a rough answer is more useful than a polished one. Your answers seed the scores we calibrate together in the room.",
  "tone_default": "professional",
  "prefill_fields": {
    "department": [
      "Executive",
      "Technology / IT",
      "Data & Analytics",
      "Risk & Compliance",
      "Privacy / Legal",
      "People & Culture",
      "Operations",
      "Finance",
      "Customer / Service",
      "Other"
    ]
  },
  "scales": [
    {
      "id": "frontier3",
      "name": "Frontier Firm level",
      "levels": [
        {
          "value": 1,
          "label": "Human with assistant",
          "gloss": "Copilot or equivalent is licensed. Individuals use it for their own productivity. Value is anecdotal. No agent runs a process step without a human driving it."
        },
        {
          "value": 2,
          "label": "Human-agent teams",
          "gloss": "Named agents run specific process steps under human direction. There is an owner, a build path and at least one pilot in production. Governance exists for those agents but is not yet routine."
        },
        {
          "value": 3,
          "label": "Human-led, agent-operated",
          "gloss": "Whole processes run on agents within codified parameters. Humans lead on outcomes, exceptions and trust. Evaluations, oversight evidence and security controls are tested and repeat on a cadence."
        }
      ],
      "signals": {
        "1": [
          "no ",
          "not ",
          "none",
          "never",
          "haven't",
          "don't",
          "do not",
          "ad hoc",
          "ad-hoc",
          "anecdot",
          "individuals",
          "own productivity",
          "personal productivity",
          "just copilot",
          "only copilot",
          "only have",
          "licences",
          "licenses",
          "not yet",
          "no agents",
          "informal",
          "unaware",
          "no idea",
          "blocked",
          "prompt training",
          "whoever built",
          "as the person",
          "run as",
          "no build",
          "spot check",
          "tribal"
        ],
        "2": [
          "agents run",
          "an agent",
          "agent runs",
          "two agents",
          "process step",
          " pilot",
          "copilot studio",
          "foundry",
          "named owner",
          "owner",
          "sponsor",
          "in production",
          "some processes",
          "personas",
          "champions",
          "register",
          "acceptance criteria",
          "defined",
          "documented",
          "labels applied",
          "one process",
          "a few",
          "starting to",
          "emerging",
          "own identity",
          "own identities",
          "least privilege",
          "entra",
          "evaluation set",
          "risk tier",
          "model card",
          "one-page",
          "one page",
          "owned by",
          "processes agents",
          "take on",
          "candidate process",
          "value hypothes",
          "kpi"
        ],
        "3": [
          "end-to-end",
          "end to end",
          "agent-operated",
          "autonomous",
          "whole process",
          "continuous",
          "evals",
          "evaluation set",
          "monitored",
          "audit trail",
          "across the",
          "portfolio",
          "board",
          "lifecycle",
          "re-validat",
          "red team",
          "red-team",
          "quarterly",
          "conditional access",
          "lineage",
          "reinvest"
        ]
      }
    }
  ],
  "categories": [
    {
      "id": "ambition",
      "name": "A · Set business ambition and goals",
      "description": "Anchor AI in service to the business strategy. Efficiency is the floor, not the goal.",
      "order": 1,
      "target_default": 2
    },
    {
      "id": "diffusion",
      "name": "B · Build your diffusion engine",
      "description": "An operating model that delivers against the goals at scale: people, platform and data.",
      "order": 2,
      "target_default": 2
    },
    {
      "id": "people",
      "name": "C · Invest in your people",
      "description": "Adapt roles, manager behaviours and learning so AI expands human capability.",
      "order": 3,
      "target_default": 2
    },
    {
      "id": "codify",
      "name": "D · Codify your advantage and controls",
      "description": "Codify what makes the organisation distinct into evaluations and controls.",
      "order": 4,
      "target_default": 2
    },
    {
      "id": "security",
      "name": "E · Safeguard your security",
      "description": "Enterprise-grade governance for every agent action, before scale.",
      "order": 5,
      "target_default": 2
    }
  ],
  "audiences": [
    {
      "id": "exec",
      "name": "Leadership / executive sponsor",
      "desc": "Sets ambition, owns outcomes",
      "deep_dive_sections": [
        "ambition_dd"
      ]
    },
    {
      "id": "cio_data",
      "name": "CIO / head of data / platform",
      "desc": "Owns platforms, data and agent build",
      "deep_dive_sections": [
        "data_agents_dd"
      ]
    },
    {
      "id": "risk",
      "name": "Risk / compliance / privacy / legal",
      "desc": "Owns guardrails and disclosure",
      "deep_dive_sections": [
        "guardrails_dd"
      ]
    },
    {
      "id": "people",
      "name": "HR / change / adoption",
      "desc": "Owns roles, skills and adoption",
      "deep_dive_sections": [
        "people_dd"
      ]
    },
    {
      "id": "process",
      "name": "Process owner",
      "desc": "Runs a business process agents could take on",
      "deep_dive_sections": []
    }
  ],
  "sections": [
    {
      "id": "context",
      "title": "About you and your organisation",
      "blurb": "Three quick facts so the workshop is pitched right. Not scored.",
      "optional": false,
      "questions": [
        {
          "id": "ctx_seats",
          "type": "single_select",
          "name": "Copilot seats",
          "text": "Roughly how many Microsoft 365 Copilot seats does your organisation hold today?",
          "scored": false,
          "star": false,
          "options": [
            {
              "value": "none",
              "label": "None yet"
            },
            {
              "value": "lt50",
              "label": "Fewer than 50"
            },
            {
              "value": "50_300",
              "label": "50 to 300"
            },
            {
              "value": "gt300",
              "label": "More than 300"
            },
            {
              "value": "unsure",
              "label": "Not sure"
            }
          ],
          "ai_drafted": false
        },
        {
          "id": "ctx_azure",
          "type": "single_select",
          "name": "Azure footprint",
          "text": "Does your organisation run workloads on Azure today?",
          "scored": false,
          "star": false,
          "options": [
            {
              "value": "yes",
              "label": "Yes, meaningfully"
            },
            {
              "value": "some",
              "label": "A little"
            },
            {
              "value": "no",
              "label": "No"
            },
            {
              "value": "unsure",
              "label": "Not sure"
            }
          ],
          "ai_drafted": false
        },
        {
          "id": "ctx_process",
          "type": "verbatim",
          "name": "Candidate process",
          "text": "If the leadership team could hand one process to agents tomorrow, which would it be, and why that one?",
          "scored": false,
          "star": false,
          "ai_drafted": false
        }
      ]
    },
    {
      "id": "core",
      "title": "The five elements",
      "blurb": "Twenty questions across the five elements of the Frontier Firm playbook. Answer in your own words, as things are today, not as planned. Where something exists, say where we could see it.",
      "optional": false,
      "questions": [
        {
          "id": "a1",
          "type": "scored_text",
          "category": "ambition",
          "name": "Ambition statement",
          "text": "Where does AI matter to your business strategy, and where has leadership decided it does not? Who owns that answer, and is it written down?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "Point us to the document or board paper, if one exists.",
          "rubric": {
            "1": "Ambition is 'productivity' or 'efficiency'. Nobody owns a written answer.",
            "2": "A one-page ambition with an executive owner names one to three outcomes and the processes agents should take on.",
            "3": "Board-level ambition across the four outcomes (employee experience, customer engagement, process reshaping, innovation) with agent-operated processes stated as goals."
          },
          "maps": "diagnostic:Organisation;controls:C-015;move:AI Strategy Build",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "a2",
          "type": "scored_text",
          "category": "ambition",
          "name": "Outcome measurement",
          "text": "How do you measure value from Copilot or agents today, and who sees that measure?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "Name the report or dashboard and how often it is reviewed.",
          "rubric": {
            "1": "Licence usage and anecdotes.",
            "2": "Value hypotheses and process KPIs per pilot, reviewed at least quarterly.",
            "3": "Portfolio-level realised value reported to the executive or board alongside cost."
          },
          "maps": "diagnostic:Governance;move:Value Measurement & Board Reporting",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "a3",
          "type": "scored_text",
          "category": "ambition",
          "name": "Process selection",
          "text": "Have you named the processes that agents should run, and who owns each one? Was any process redesigned before it was automated?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "List the processes and their owners.",
          "rubric": {
            "1": "No named processes; AI is applied to individual tasks.",
            "2": "One to three candidate processes, each with an owner, redesigned before automation.",
            "3": "A prioritised process portfolio with owners, stage gates and an explicit scale, hold or stop decision."
          },
          "maps": "diagnostic:Organisation;move:Business Process Augmentation",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "a4",
          "type": "scored_text",
          "category": "ambition",
          "name": "Funding and sponsorship",
          "text": "How is AI work funded and sponsored: as licences in the IT budget, as pilots with a sponsor, or as a portfolio tied to outcomes?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "AI is a line in the IT licence budget.",
            "2": "An executive sponsor and dedicated pilot funding exist.",
            "3": "Portfolio funding tied to outcomes, with reinvestment of returns."
          },
          "maps": "diagnostic:Organisation;move:AI Strategy Build",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "b1",
          "type": "scored_text",
          "category": "diffusion",
          "name": "Operating model for agents",
          "text": "Who is allowed to build an agent, who approves it, and who runs it once it is live?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "Name the team and describe the intake path.",
          "rubric": {
            "1": "Individuals build Copilot agents ad hoc, or IT blocks agent creation outright.",
            "2": "A named team or centre of enablement with an intake path and a sanctioned build route.",
            "3": "A platform team with reusable patterns, a catalogue and lifecycle management across business units."
          },
          "maps": "diagnostic:Organisation;controls:C-015;move:AI Operating Model Design",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "b2",
          "type": "scored_text",
          "category": "diffusion",
          "name": "Platform readiness",
          "text": "What do you build agents on today? Is there a sanctioned platform with environments, identity and cost controls?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "List the platforms in use, sanctioned or not.",
          "rubric": {
            "1": "Microsoft 365 Copilot only; no sanctioned build platform.",
            "2": "Copilot Studio and/or Azure AI Foundry stood up with environments, identity and cost controls.",
            "3": "A governed platform with evaluations, observability and a deployment pipeline."
          },
          "maps": "diagnostic:Technology;controls:C-005;move:Agile Agents (Platform Introduction)",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "b3",
          "type": "scored_text",
          "category": "diffusion",
          "name": "Data readiness for agents",
          "text": "Can an agent reach the data it needs, in a governed way? Where does that data live, is it classified, and who curates the grounding sources?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "Name the platform and the domains that are on it.",
          "rubric": {
            "1": "Data in silos; SharePoint sprawl; no classification; grounding sources unknown.",
            "2": "Key domains available on a governed platform (Fabric or lakehouse), sensitivity labels applied, grounding sources curated.",
            "3": "Governed data products with lineage, quality thresholds and agent access through governed endpoints."
          },
          "maps": "diagnostic:Data;controls:C-003,C-020;move:Data Foundation Readiness",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "b4",
          "type": "scored_text",
          "category": "diffusion",
          "name": "Path from pilot to production",
          "text": "How does a successful agent pilot get to production? What has to be true before it is switched on for everyone?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "Describe the last pilot that made it, or the last one that did not.",
          "rubric": {
            "1": "Pilots stay pilots.",
            "2": "A defined path with acceptance criteria met before deployment.",
            "3": "A repeatable factory: templates, reuse, re-validation and decommissioning."
          },
          "maps": "diagnostic:Engineering;controls:C-010,C-012;move:Agile Agents",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "c1",
          "type": "scored_text",
          "category": "people",
          "name": "Roles and manager behaviour",
          "text": "Have roles or manager expectations changed because of Copilot or agents? Do managers know how to direct and review agent work?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Prompt training. Roles and manager expectations unchanged.",
            "2": "Personas defined; managers coached to direct and review agent work; adoption tracked by persona.",
            "3": "Roles formally redesigned for human-agent teams; workforce planning accounts for agents."
          },
          "maps": "diagnostic:Literacy;move:Copilot Adoption Program",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "c2",
          "type": "scored_text",
          "category": "people",
          "name": "Skills and literacy",
          "text": "What AI learning is in place, by role? Is there a champions network, and is completion measured?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Generic training; champions informal.",
            "2": "Role-based literacy programme and a champions network, with completion measured.",
            "3": "Continuous learning; specialists build and evaluate agents; skills tracked against roles."
          },
          "maps": "diagnostic:Literacy;move:Adoption & Engagement",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "c3",
          "type": "scored_text",
          "category": "people",
          "name": "Adoption measurement",
          "text": "Beyond licence activation, how do you know who is using Copilot or agents, for what, and to what effect?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "Name the measure and who owns it.",
          "rubric": {
            "1": "Licence activation counts.",
            "2": "Persona-level adoption and value tracked.",
            "3": "Adoption tied to process outcomes and feeding portfolio decisions."
          },
          "maps": "diagnostic:Literacy;move:Copilot Adoption Program",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "c4",
          "type": "scored_text",
          "category": "people",
          "name": "Human impact and WHS",
          "text": "How do you assess the human impact of agents in work systems: workload, deskilling, psychosocial risk, consultation?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Not considered.",
            "2": "Change impact and psychosocial risk assessed per deployment; staff consulted.",
            "3": "WHS for digital work systems built into the AI lifecycle; oversight evidence per risk tier."
          },
          "maps": "diagnostic:Governance;controls:C-007;move:AI Risk & Compliance Advisory",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "d1",
          "type": "scored_text",
          "category": "codify",
          "name": "AI register and ADM inventory",
          "text": "Do you know every AI system and agent in use, and which of them make or shape decisions about people? Is the privacy policy update for 10 December 2026 planned?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "evidence_prompt": "Attach or describe the register, however rough.",
          "rubric": {
            "1": "No inventory; shadow AI likely. Nobody has asked which systems make decisions about people.",
            "2": "A register exists. Automated decision-making candidates identified against the APP 1 significant-effect test; privacy policy update planned.",
            "3": "Register maintained within five business days of change; ADM disclosures live; vendor material-change notifications subscribed."
          },
          "maps": "diagnostic:Governance;controls:C-013,C-015,C-016;move:Signalbox (Vendor AI & ADM Register)",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "d2",
          "type": "scored_text",
          "category": "codify",
          "name": "Evaluation of agent behaviour",
          "text": "How do you know an agent does what you intended, before release and after? Are there acceptance criteria and an evaluation set?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Spot checks by the builder.",
            "2": "Acceptance criteria and a pre-production evaluation set per agent.",
            "3": "Continuous evaluation, drift detection and re-validation on a cadence."
          },
          "maps": "diagnostic:Engineering;controls:C-010,C-011,C-012;move:AI Governance Control Plane",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "d3",
          "type": "scored_text",
          "category": "codify",
          "name": "Human oversight and decision rights",
          "text": "For decisions agents influence, who reviews what, at which risk tier? Has the override path been tested?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Either humans review everything or nothing; undefined.",
            "2": "Risk tiers define human-in-the-loop versus human-on-the-loop; override path tested.",
            "3": "Decision audit trail per consequential decision; oversight evidenced per tier; agents act within codified parameters."
          },
          "maps": "diagnostic:Governance;controls:C-007,C-008,C-009;move:AI Governance Framework Alignment",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "d4",
          "type": "scored_text",
          "category": "codify",
          "name": "Codified know-how",
          "text": "Is what makes your organisation distinct captured in the instructions, knowledge and rules your agents run on? Who owns that content?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Tribal knowledge; agents grounded on whatever is to hand.",
            "2": "Process knowledge codified for one to three agents, each with an owner and a model card.",
            "3": "Curated, versioned knowledge assets with owners, evaluated for accuracy."
          },
          "maps": "diagnostic:Data;controls:C-014;move:Business Process Augmentation",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "e1",
          "type": "scored_text",
          "category": "security",
          "name": "Identity for agents",
          "text": "Do agents have their own identities, or do they act as the person who built them? Who owns each agent identity?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Agents run under a person's identity; no inventory of agent identities.",
            "2": "Agents have their own identities (Entra Agent ID or equivalent), least privilege, a named owner.",
            "3": "Lifecycle-managed agent identities, conditional access, periodic access review."
          },
          "maps": "diagnostic:Technology;controls:C-005;move:AI Security",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "e2",
          "type": "scored_text",
          "category": "security",
          "name": "Data protection and DLP",
          "text": "Are sensitivity labels and DLP applied to what Copilot and agents can reach? Has oversharing been checked and remediated?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "No sensitivity labels; oversharing unchecked.",
            "2": "Purview labels and DLP applied to Copilot and agent scope; oversharing remediated.",
            "3": "DLP for agent actions, prompt and response auditing, retention set."
          },
          "maps": "diagnostic:Technology;controls:C-003;move:AI Security",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "e3",
          "type": "scored_text",
          "category": "security",
          "name": "Threat protection for agents",
          "text": "What protects agents from prompt injection and tool misuse? Has any of it been tested?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "None specific to AI.",
            "2": "Input and output filtering, content safety, tested before release.",
            "3": "Red-teaming, quarterly penetration testing, AI incidents classified and reviewed."
          },
          "maps": "diagnostic:Technology;controls:C-004,C-018;move:AI Security",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        },
        {
          "id": "e4",
          "type": "scored_text",
          "category": "security",
          "name": "Vendor and third-party AI",
          "text": "Which of your vendors have shipped AI features into products you already use? Does procurement review AI at contract time?",
          "scale": "frontier3",
          "scored": true,
          "star": false,
          "rubric": {
            "1": "Unknown which vendors have shipped AI features.",
            "2": "Vendor security review at procurement includes AI.",
            "3": "Exit strategy per vendor; material-change monitoring; regulator triggers documented."
          },
          "maps": "diagnostic:Governance;controls:C-006,C-016,C-017,C-019;move:Signalbox (Vendor AI & ADM Register)",
          "adaptive": {
            "probe": "allow",
            "max_probes": 1,
            "skip": "deny"
          },
          "ai_drafted": false
        }
      ]
    },
    {
      "id": "ambition_dd",
      "title": "Ambition deep-dive",
      "blurb": "For the leadership team and executive sponsor.",
      "audience": [
        "exec"
      ],
      "optional": false,
      "questions": [
        {
          "id": "amb_moves",
          "type": "verbatim",
          "name": "The two moves you would bet on",
          "text": "If you could only make two moves on AI in the next six months, what would they be?",
          "scored": false,
          "star": false,
          "ai_drafted": false
        },
        {
          "id": "amb_blockers",
          "type": "verbatim",
          "name": "What would stop you",
          "text": "What is most likely to stop those moves: funding, skills, risk appetite, data, something else?",
          "scored": false,
          "star": false,
          "ai_drafted": false
        },
        {
          "id": "amb_outcomes",
          "type": "multi_select",
          "name": "Outcomes that matter most",
          "text": "Which of the four Frontier Firm outcomes matter most to your organisation this year?",
          "scored": false,
          "star": false,
          "options": [
            {
              "value": "employee",
              "label": "Enrich employee experience"
            },
            {
              "value": "customer",
              "label": "Reinvent customer engagement"
            },
            {
              "value": "process",
              "label": "Reshape business processes"
            },
            {
              "value": "innovation",
              "label": "Bend the innovation curve"
            }
          ],
          "ai_drafted": false
        }
      ]
    },
    {
      "id": "guardrails_dd",
      "title": "Guardrails deep-dive",
      "blurb": "For risk, compliance, privacy and legal.",
      "audience": [
        "risk"
      ],
      "optional": false,
      "questions": [
        {
          "id": "grd_adm",
          "type": "verbatim",
          "name": "Decisions about people",
          "text": "List the systems you know of that make or shape decisions about individuals: recruitment, credit, eligibility, pricing, scheduling, performance, service access. Include vendor products.",
          "scored": false,
          "star": false,
          "ai_drafted": false
        },
        {
          "id": "grd_incidents",
          "type": "verbatim",
          "name": "AI incidents",
          "text": "Has there been an AI-related incident or near miss in the last twelve months? What happened and how was it classified?",
          "scored": false,
          "star": false,
          "ai_drafted": false
        },
        {
          "id": "grd_policy",
          "type": "single_select",
          "name": "Privacy policy for ADM",
          "text": "Is anyone working on the privacy policy changes for automated decision-making due 10 December 2026?",
          "scored": false,
          "star": false,
          "options": [
            {
              "value": "done",
              "label": "Already updated"
            },
            {
              "value": "underway",
              "label": "Underway"
            },
            {
              "value": "planned",
              "label": "Planned, not started"
            },
            {
              "value": "no",
              "label": "Not on the list"
            },
            {
              "value": "unsure",
              "label": "Not sure"
            }
          ],
          "ai_drafted": false
        }
      ]
    },
    {
      "id": "data_agents_dd",
      "title": "Data and agents deep-dive",
      "blurb": "For the CIO, head of data and platform owners.",
      "audience": [
        "cio_data"
      ],
      "optional": false,
      "questions": [
        {
          "id": "da_platforms",
          "type": "verbatim",
          "name": "Platforms in play",
          "text": "List the AI and data platforms in use today, sanctioned or not: Copilot Studio, Foundry, Fabric, Databricks, Power Platform, anything else.",
          "scored": false,
          "star": false,
          "ai_drafted": false
        },
        {
          "id": "da_pilots",
          "type": "verbatim",
          "name": "Agent pilots",
          "text": "Describe any agent pilots underway: what they do, who owns them, and whether they touch production data.",
          "scored": false,
          "star": false,
          "ai_drafted": false
        },
        {
          "id": "da_data_for_process",
          "type": "verbatim",
          "name": "Data behind the candidate process",
          "text": "For the process the leadership team would hand to agents, where does its data live, and who owns it?",
          "scored": false,
          "star": false,
          "ai_drafted": false
        }
      ]
    },
    {
      "id": "people_dd",
      "title": "People deep-dive",
      "blurb": "For HR, change and adoption leads.",
      "audience": [
        "people"
      ],
      "optional": false,
      "questions": [
        {
          "id": "ppl_personas",
          "type": "verbatim",
          "name": "Personas and champions",
          "text": "Which roles have you defined Copilot personas for, and who are the champions?",
          "scored": false,
          "star": false,
          "ai_drafted": false
        },
        {
          "id": "ppl_managers",
          "type": "verbatim",
          "name": "Manager readiness",
          "text": "What have managers been given to help them direct and review work done with agents?",
          "scored": false,
          "star": false,
          "ai_drafted": false
        }
      ]
    }
  ],
  "grids": {},
  "outputs": [
    "Score by element (1 to 3) and overall Frontier Firm level",
    "Contested indicators to discuss first",
    "Guardrail gap list from the Controls Library cross-references",
    "Data and agent readiness view",
    "Automated decision-making candidates (first pass)",
    "The two moves, sequenced, each resolved to a catalogue offer"
  ],
  "report_defaults": [
    "rpt-frontier-readiness"
  ],
  "playbook": {
    "sequence": [
      "ambition",
      "security",
      "codify",
      "diffusion",
      "people"
    ],
    "sequence_note": "Ambition first because it decides everything else. Security and codified controls before the diffusion engine, because scaling ungoverned agents is the failure mode the workshop exists to prevent. People last in sequence but never last in priority: adoption work runs alongside every move.",
    "actions": {
      "ambition": {
        "to_2": [
          "Write the one-page ambition: the outcomes that matter, the processes agents should take on, and the executive who owns it.",
          "Pick one to three processes, name their owners, and redesign each before any agent is built.",
          "Replace usage statistics with a value hypothesis and two process KPIs per pilot."
        ],
        "to_3": [
          "Take the ambition to the board across the four outcomes and state agent-operated processes as goals.",
          "Fund AI as a portfolio with stage gates and reinvestment, not project by project.",
          "Report realised value alongside cost each quarter."
        ]
      },
      "security": {
        "to_2": [
          "Give every agent its own identity with a named owner and least privilege.",
          "Apply Purview sensitivity labels and DLP to everything Copilot and agents can reach; remediate oversharing first.",
          "Put input and output filtering in front of every agent and test it before release.",
          "Add AI to the vendor security review at procurement."
        ],
        "to_3": [
          "Lifecycle-manage agent identities with conditional access and periodic access review.",
          "Audit prompts and responses; set retention.",
          "Red-team agents and schedule quarterly penetration testing; classify AI incidents.",
          "Document an exit strategy per AI vendor and subscribe to material-change notifications."
        ]
      },
      "codify": {
        "to_2": [
          "Stand up the AI register and run the APP 1 significant-effect test over it to find automated decision-making candidates before 10 December 2026.",
          "Write acceptance criteria and an evaluation set for each agent before it leaves pilot.",
          "Define risk tiers and the human oversight each tier requires; test the override path once.",
          "Codify process knowledge for the first agents, with an owner and a model card each."
        ],
        "to_3": [
          "Keep the register current within five business days; publish ADM disclosures in the privacy policy.",
          "Run continuous evaluation with drift detection and a re-validation cadence.",
          "Log every consequential agent decision to an audit trail and sample it monthly.",
          "Version and own the knowledge assets agents run on, and evaluate them for accuracy."
        ]
      },
      "diffusion": {
        "to_2": [
          "Name the team that owns agent intake, build and run, and publish the sanctioned build route.",
          "Stand up Copilot Studio and/or Azure AI Foundry with environments, identity and cost controls.",
          "Bring the key data domains onto a governed platform, label them, and curate the grounding sources.",
          "Define the pilot-to-production path with acceptance criteria."
        ],
        "to_3": [
          "Grow the team into a platform function with reusable patterns and a catalogue across business units.",
          "Add evaluations, observability and a deployment pipeline to the platform.",
          "Publish governed data products with lineage and quality thresholds; expose them to agents through governed endpoints.",
          "Run the factory: templates, reuse, re-validation and decommissioning."
        ]
      },
      "people": {
        "to_2": [
          "Define personas and coach managers to direct and review agent work.",
          "Run a role-based literacy programme and a champions network; measure completion.",
          "Track adoption and value by persona, not by licence.",
          "Assess change impact and psychosocial risk for each deployment and consult the people affected."
        ],
        "to_3": [
          "Redesign roles for human-agent teams and build agents into workforce planning.",
          "Track skills against roles; grow specialists who build and evaluate agents.",
          "Tie adoption to process outcomes and feed it into portfolio decisions.",
          "Build WHS for digital work systems into the AI lifecycle."
        ]
      }
    },
    "moves": {
      "ambition": {
        "to_2": {
          "offer": "AI Strategy Build",
          "entry": "AI Launchpad workshops",
          "band": "$15K–$50K",
          "owner": "AISG"
        },
        "to_3": {
          "offer": "Value Measurement & Board Reporting",
          "band": "$20K–$50K",
          "owner": "AISG"
        }
      },
      "security": {
        "to_2": {
          "offer": "AI Security",
          "band": "On application",
          "owner": "AISG + Security partner"
        },
        "to_3": {
          "offer": "AI Governance Control Plane",
          "band": "Via Rapid Diagnostic",
          "owner": "AISG"
        }
      },
      "codify": {
        "to_2": {
          "offer": "Signalbox — Vendor AI & ADM Register",
          "band": "Scoped to estate",
          "owner": "AISG"
        },
        "to_3": {
          "offer": "AI Governance Framework Alignment",
          "band": "$25K–$60K",
          "owner": "AISG"
        }
      },
      "diffusion": {
        "to_2": {
          "offer": "Data Foundation Readiness",
          "then": "Fabric Foundation",
          "band": "$15K–$40K",
          "owner": "Data & AI"
        },
        "to_3": {
          "offer": "Agile Agents",
          "band": "From $25K",
          "owner": "Data & AI"
        }
      },
      "people": {
        "to_2": {
          "offer": "Copilot Adoption Program",
          "band": "$25K–$80K",
          "owner": "AISG + Modern Work"
        },
        "to_3": {
          "offer": "AI Operating Model Design",
          "band": "$40K–$120K",
          "owner": "AISG"
        }
      }
    }
  }
}

Frontier Firm Readiness v0.1.0