Agentworthy Enterprise™
Two questions come before any AI programme: will our data and secrets stay ours, and can we govern what the AI does? This framework answers both with mechanisms — and lets AI earn its autonomy one workflow at a time.
Safe data. Real governance.
Most enterprises stall in the same place: the pilot works, then security asks where the data goes and the auditors ask who decided. The framework is built around those two conversations.
Will our data stay ours?
A data boundary sets where each tier of data may be processed, and one gateway sees every prompt and agent call — classifying, pseudonymising, routing and logging. The model answers usefully without seeing names, bank details or secrets.
Can we govern what the AI does?
Autonomy is granted per workflow through a value gate and an assurance gate. Agents holding risky combinations are capped. Governance runs in three layers that line up with the standards your auditors already use.
Data decides where the model runs
Classify what a workflow touches. The most sensitive tier sets the zone. Restricted data never leaves infrastructure you control.
Autonomy is earned per workflow
Each workflow climbs from A0 to A5 only through two gates — measured value and assurance evidence. The lower score wins.
Agents stay agentworthy, continuously
The eight pillars of Continuous Agentworthiness™ are the assurance gate — run like continuing airworthiness, not a one-off certificate.
Where maturity models stop
The published AI maturity models agree on the foundations — strategy, data, talent, responsible-AI principles. They were shaped for copilots and centres of excellence, and say much less about agents that write into systems of record.
They score the company, not the workflow
An enterprise-wide maturity level says little about whether invoice matching or MRO planning is ready. Risk and value both live in workflows.
Data safety is a principle, not an architecture
“Protect sensitive data” appears everywhere. Which data may reach which model, through what boundary, with what retention, rarely does.
Built for copilots, not agents
They assume a person uses AI. Agents act on their own — so the question becomes which decisions an agent may take, within what limits.
Principles without the authority to ground
Fairness and transparency are policies. Running agents need change control, directives with proof of closure, and the power to pull one instantly.
A side-by-side review of the major firms’ published frameworks is on scandiccloud.com/framework.
Keep your data — the boundary and the gateway
Your most sensitive data decides where the model runs. Select a tier or a zone. Most work runs in your own cloud tenant; restricted data never leaves infrastructure you control; credentials never enter a prompt, anywhere.
| Data tier | |||||
|---|---|---|---|---|---|
| With protection | Allowed | Allowed | Allowed | Allowed | |
| Not allowed | Allowed | Allowed | Allowed | Allowed | |
| Not allowed | With protection | Allowed | Allowed | Allowed | |
| Not allowed | Not allowed | With protection | Allowed | Allowed |
Unpublished financials, contracts, supplier bank details, customer personal data, source code
Your cloud tenant by default. An enterprise service only with zero retention and identifiers pseudonymised first.
Data stays in your cloud subscription and chosen EU region, with private networking and your own keys.
Near-frontier capability with real control. The provider’s home jurisdiction still applies.
The gateway — one control point for every prompt and agent call
Follow a real accounts-payable question through nine steps. The provider answers it without ever seeing the supplier, the bank account or the person. Example data is fictitious.
Single sign-on for the person, a unique identity for the agent. No shared keys.
Why is invoice 5100023417 from Nordvik Stål AS (IBAN NO93 8601 1117 947) blocked? Approver: Kari Hansen.
The same pattern on a blocked supplier invoice — evidence gathered, action proposed, accountant approves — is walked through step by step on scandiccloud.com/finance.
An EU region reduces exposure but does not remove a non-EU provider’s home jurisdiction, and provider retention terms change — in 2026 at least one major provider introduced mandatory 30-day retention for its newest models. Pseudonymised data is still personal data under GDPR. The boundary is a decision you revisit, not a setting you make once.
Earn autonomy — the ladder
Every workflow sits on a level from A0 to A5. Climbing takes two gates: measured value against the workflow’s own baseline, and assurance evidence from the eight Agentworthiness pillars. If a gate metric breaks, the workflow steps down — grounding, applied gradually.
A2 · Recommend
Assurance is the binding gate — value would justify A3. Close the evidence gap first.
- A2 · Recommend
- AI: Proposes the action with evidence. People: Approves each one.
- Value gate
- Acceptance rate above threshold; measured effort reduction.
- Assurance gate
- Versioned prompts, models and tools; evaluation suite passes; every proposal logged.
- P3 Authorization & Access ControlP4 Configuration ControlP5 Monitoring & Observability
What each level does to cost per transaction, payback and cash is worked through in the AI ROI model on scandiccloud.com.
Keep the business safe — the rule of two
Filters reduce prompt-injection risk; adaptive attackers get past them. Architecture is what holds. An agent may read untrusted content, touch sensitive data, or act externally — any two, never all three without a person approving each action.
All three — capped at A2 Recommend
Every side effect needs human approval, or split the agent so no single one holds all three.
Supplier PDFs are untrusted input. Postings go through maker-checker until the gates say otherwise.
Builds on Simon Willison’s “lethal trifecta” (2025) and Meta’s “Agents Rule of Two” (2025), mapped to the OWASP Top 10 for LLM and Agentic Applications. The A2 cap is this framework’s rule.
Govern once. Gate every workflow. Operate every agent.
One control set, three cadences — evidenced once and reused for every regulator. Select a standard to see where its requirements land.
Certifiable AI management system
Govern
- AI policy and AI-literacy measures
- Registry of every AI use case and agent, with an owner
- Risk tiering and the prohibited-practice check
- Data-boundary policy: tiers, zones, approved providers
- Supplier due diligence and contract terms
- Cl. 5 Leadership
- Cl. 6 Planning
- Cl. 7 Support
Gate
- Value gate against the workflow’s own baseline
- Assurance gate against the pillars the level requires
- Data tier and zone decision
- DPIA / FRIA where triggered
- Rule-of-two check; recorded sign-off or recorded stop
- Cl. 8 Operation
- A.5 Impact assessment
Operate
- The eight Continuous Agentworthiness™ pillars in force
- Logs tied to identity, kept at least six months
- Incident and near-miss reporting
- Directives with proof of closure
- Grounding drills and return-to-service checks
- Cl. 9 Evaluation
- Cl. 10 Improvement
- A.6 Lifecycle
EU AI Act dates as amended by Regulation (EU) 2026/1744. The AI Act is not yet incorporated into the EEA Agreement, so it is not yet Norwegian law; companies selling into the EU are already in scope. General information, not legal advice.
Put Agentworthiness to work in your enterprise
Thirty minutes applying the frameworks to your own agents and data. You bring a workflow; we bring the model.
- One of your AI agents or workflows checked against the eight pillars
- A first read on which of your data may go where — and what must never leave
- A straight answer on the next step, including where AI is not worth it
30 minutes · video call · no slides, no obligation — you keep the notes
Disclosure Satya Neerupudi is the founder of Scandic Cloud Solutions AS, which delivers these frameworks for enterprises.
Copyright & attribution
Agentworthy Enterprise Framework™ © 2026 Scandic Cloud Solutions AS, which uses it as an unregistered mark. It builds on Continuous Agentworthiness™ © 2026 Satya Neerupudi. You’re welcome to quote and share the framework and its pillars with attribution to Satya Neerupudi. See the terms & privacy.