Executive summary
AI agents are software systems that can take a goal, use tools and data, and carry out steps towards it. Businesses are experimenting with them, and the main software and cloud vendors are building protocols so agents can reach tools and talk to each other. Adoption is still early and uneven, and analysts expect many early projects to fail for reasons that have little to do with the model itself: unclear value, rising cost and weak risk controls.
This paper argues that the limiting factor for most companies will be readiness rather than intelligence. An agent can only act on information it can find, trust and is allowed to use, through interfaces that behave predictably, under rules that someone has written down and enforced. Most business processes were built for people who fill those gaps with judgement, phone calls and memory.
We propose a working definition of an agent-ready business, a six-stage maturity model, a reference architecture that reuses existing systems and standards, and a staged plan any business can follow. We separate observed evidence from forecasts and from Zelleo's own thesis throughout.
This is research and a proposed operating model. It does not report results from Zelleo deployments, and "agent-ready" is a design and operational maturity concept, not a certification or a legal standard.
What this means for a business
- You do not need to replace your ERP, CRM or procurement system to prepare. Most of the work is documenting rules, cleaning core data and exposing narrow, permissioned interfaces.
- The first step is choosing one high-value workflow with clear rules, not buying an agent.
- Decide early what agents may read, request, recommend and do, and enforce it in the systems themselves, not in the instructions given to a model.
- Keep people in charge of commitments above agreed limits, and keep a record of every action and approval.
- Measure against your own baseline. Faster is only better if errors, exceptions and risk do not rise with it.
The shift from human-mediated to agent-mediated coordination
Much of the work between businesses is coordination: finding a supplier, asking for a quotation, checking whether something is in stock, confirming a delivery window, chasing an order, querying an invoice, getting an approval. Today a person does most of these steps, reading an email, checking a spreadsheet, calling a colleague and replying.
The change now under way is that software agents are starting to take on some of these steps. Three things should be kept apart when discussing it.
- Observed trend. Vendors and standards bodies are building the plumbing for agents. The Model Context Protocol (MCP), which connects AI applications to tools and data, released a new specification revision on 28 July 2026 and is now developed under Linux Foundation governance (MCP project blog, 28 July 2026; Linux Foundation, 9 December 2025). The Agent2Agent (A2A) protocol for communication between agents reached version 1.0.0, and the Linux Foundation reported in April 2026 that more than 150 organisations support it, with integrations in Google, Microsoft and AWS platforms (A2A specification; Linux Foundation, 9 April 2026).
- Forecast. Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls, and that by 2028 at least 15% of day-to-day work decisions will be made autonomously through agentic AI, up from none in 2024 (Gartner, 25 June 2025). Forecasts are estimates, not measurements.
- Zelleo's thesis. We think that as agents become a normal way to request and coordinate work, businesses that can be understood and safely used by authorised agents will be easier to work with, and those that cannot will be slower to deal with. This is a strategic view, not an established fact, and it may unfold more slowly or differently than we expect.
How businesses work today
A typical mid-sized business runs on a mixture of systems: an ERP or accounting system, a CRM, spreadsheets, email, messaging apps, supplier and customer portals, a few APIs, and people who know how things really work. Rules about prices, discounts, credit, substitutions and approvals often live in people's heads or in long email threads.
This works for people because people can interpret ambiguity. A sales manager knows that "the usual discount" for one customer is different from another's, that a stock figure in a spreadsheet is a week old, and that a request from an unfamiliar address needs a call before anyone commits.
Software agents do not have that context unless it is given to them explicitly. A process that is perfectly workable for a person can be unusable, or unsafe, for an agent.
The problem: having AI does not make a business agent-ready
The challenges below are common, but they do not apply equally to every company.
- Fragmented and inconsistent data. The same customer, product or supplier is recorded differently in different systems. Gartner reported in February 2025 that it expects 60% of AI projects unsupported by AI-ready data to be abandoned through 2026 (Gartner, 26 February 2025).
- Unwritten business rules. Pricing limits, approval thresholds and exceptions are known but not documented in a form software can apply.
- No machine-readable description of what the business offers. Services, inventory, prices, lead times and constraints are published as PDFs, web pages or not at all.
- Identity. It is hard to know which agent is calling, on whose behalf, and whether that party is who it claims to be.
- Permissions and delegation. A person can delegate a task to an agent, which may call another agent. Current identity standards handle simple cases but leave open problems for highly autonomous, cross-organisation agents, including recursive delegation (OpenID Foundation, October 2025).
- Incompatible interfaces. Every system has its own API, or none, and workflows differ between companies.
- Approvals and liability. It is often unclear who is responsible when an automated action goes wrong, and which commitments need a person.
- Stale information. An agent acting on a week-old stock figure can make a confident, wrong commitment.
- Audit and disputes. If a decision is not recorded with its inputs and approvals, it cannot be reviewed or contested.
- Attack surface. Agents that read untrusted content can be manipulated. OWASP lists prompt injection as the first risk and excessive agency as the sixth in its 2025 Top 10 for LLM Applications (OWASP, 2025). IBM's 2025 breach research found that 97% of organisations that reported an AI-related breach lacked proper AI access controls (IBM, 30 July 2025).
- Legacy systems and integration cost. Connecting older systems takes time and money, and the benefit has to justify it.
Defining "agent-ready"
We use the following working definition.
An agent-ready business is one in which defined tasks can be requested, performed or supported by authorised software agents, using accurate and current information, through documented interfaces, within enforced permissions and approval rules, with every consequential action recorded and reviewable by people.
"Agent-ready" and "agent-compatible" mean the same thing in this paper. We avoid "agent-compliant": compliance implies conformity with a defined law, standard or certification, and no such standard for business agent-readiness has been identified. Nothing in this paper describes a certification.
A proposed maturity model
This is Zelleo's proposed framework, offered as a planning tool. It is not an external standard, and reaching a stage does not make an organisation legally compliant with anything.
| Stage | What is true at this stage | Typical work to get there |
|---|---|---|
| 1. Documented | Key processes, rules, exceptions and approval limits are written down | Workflow mapping with the people who do the work |
| 2. Structured | Core business information is consistent and machine-readable | Master data clean-up, common identifiers, data owners |
| 3. Connected | Authorised systems exchange information through defined interfaces | APIs or connectors with documented schemas |
| 4. Governed | Identity, delegation, permissions, approvals, logging and exception handling are enforced | Access control, policy enforcement, audit logging |
| 5. Agent-enabled | Defined tasks are performed by authorised agents under tested constraints | Narrow pilots with human oversight and evaluation |
| 6. Cross-business ready | The business can interact with external agents under agreed identity, discovery, request and transaction rules | Agreed protocols, trust tiers and contracts with counterparties |
Most organisations will be at different stages for different workflows, and many workflows should stop at stage 4 or 5.
A reference architecture
An agent-ready business does not need to replace its systems. It needs a set of layers, most of which can reuse what already exists.
| Layer | What it does | What can usually be reused |
|---|---|---|
| Source-of-truth systems | Hold the records the business already relies on | ERP, CRM, accounting, inventory, scheduling tools |
| Business context and service descriptions | Describe entities, rules and what the business offers in a consistent, machine-readable form | Existing data models; OpenAPI and JSON Schema for interfaces |
| Interfaces and connectors | Let authorised systems read and request things in defined ways | Existing APIs, integration platforms, MCP servers |
| Identity, delegation and policy | Decide who or what may do what, on whose behalf, and enforce it outside the model | OAuth 2.0, OpenID Connect, token exchange, existing identity providers |
| Agent orchestration | Plans and performs the steps of a defined task | Agent frameworks and runtimes |
| Human approval and exceptions | Routes consequential or uncertain decisions to a named person | Existing approval workflows |
| Logging, evaluation and audit | Records what was asked, what data was used, what was decided and who approved it; tests behaviour before release | Existing logging and monitoring; evaluation suites |
| External communication and trust boundary | Handles requests from other organisations' agents under agreed rules | A2A or similar protocols, contracts, rate limits |
The rule that holds the architecture together is simple: state changes only through defined, permissioned actions, and every such action is recorded.
Worked example: builder, supplier and transporter
This is an illustrative scenario, not a description of an existing deployment.
- A builder's construction programme shows that 18 tonnes of reinforcing steel are needed on site on Thursday.
- An authorised agent working for the builder checks the requirement against the approved budget and the approved supplier list.
- It asks the suppliers' published interfaces for a quotation with availability, grade and delivery constraints, within the builder's delegated limits.
- A supplier's system returns a structured quotation. Anything outside the supplier's own rules, such as a price below its floor, goes to a person at the supplier.
- A transporter's system confirms capacity for the accepted delivery window.
- The builder's system checks the offer against the schedule, the contract terms and the approval limits. A commitment above the limit is sent to the project manager, with the evidence attached, for approval.
- Every status change is recorded. If the delivery slips, the exception is raised to the people affected rather than handled silently.
None of the steps requires the parties to share their internal systems. Each exposes only what it chooses to, to counterparties it has agreed to work with.
Security and governance
The most important principle is that instructions to a model are not a security boundary. A model can be persuaded, confused or manipulated, so the limits on what an agent can do must be enforced by the systems it uses.
- Least privilege and scoped credentials. Give each agent only the access its task needs. The IETF's OAuth 2.0 security best current practice recommends that access token privileges be restricted to the minimum required and that tokens be restricted to a specific resource server (RFC 9700, January 2025).
- Explicit delegation. Record that an agent acts on behalf of a particular person or organisation, rather than letting it impersonate them. OAuth 2.0 Token Exchange distinguishes delegation from impersonation and can record the acting party (RFC 8693, January 2020).
- Consent, approval and revocation. Make it easy to grant, limit, expire and withdraw an agent's authority.
- Policy enforcement outside the model. Check every action against written rules before it runs.
- Rate limits and query budgets. Prevent an external agent from extracting a full price list or stock position through many small queries.
- Provenance and logging. Record which data was used and where it came from, so decisions can be reviewed and disputes settled.
- Monitoring, red-teaming and recovery. Test against prompt injection and over-broad permissions before release, watch behaviour in operation, and be able to reverse actions.
The NIST AI Risk Management Framework (January 2023) and its Generative AI Profile (July 2024) provide a voluntary structure for governing these risks across the Govern, Map, Measure and Manage functions (NIST).
Existing approaches and standards
None of these is a complete answer, and none is secure by default. Each solves part of the problem.
| Approach | What it helps with | What it does not solve on its own |
|---|---|---|
| OAuth 2.0 and OpenID Connect | Delegated authorisation and identity for users and applications | Cross-organisation agent identity and multi-step delegation, which remain open questions (OpenID Foundation, 2025) |
| OAuth 2.0 Token Exchange (RFC 8693) | Recording delegation and the acting party | Deciding what an agent should be allowed to do |
| OpenAPI (3.2.1, September 2026) and JSON Schema | Describing interfaces and data so software can call them predictably | Business meaning, trust and authority |
| Model Context Protocol (spec 2026-07-28) | Connecting AI applications to tools and data in a standard way, with authorisation guidance | Business rules, liability and cross-business trust |
| Agent2Agent protocol (1.0.0) | Agent discovery through Agent Cards, task exchange and messaging between agents | The commercial meaning of a request and agreements between firms; the specification notes that messages are not a reliable delivery mechanism for critical information |
| Industry exchange standards | Shared vocabularies within a sector, such as telematics or e-invoicing formats | Coverage varies widely by industry and country |
| NIST AI RMF and OWASP LLM Top 10 | Risk management structure and known threat categories | Implementation details for a specific business |
Researchers have also noted that current agent protocols do not express governance functions such as deliberation or preserved dissent, and argue that governance is a missing layer above interoperability standards (Kang and Diponegoro, arXiv, June 2026). Standards in this area are changing quickly, so any implementation should check current versions.
What existing enterprise systems still do well
ERP, CRM, procurement and integration platforms remain the reliable record of what a business owns, owes and has agreed. Automation tools already handle many routine, rule-based tasks well. Agent readiness builds on these systems: it makes their data and actions usable by authorised agents, with the same controls that apply to people. Claims that this software is obsolete are not supported by the evidence.
Where Zelleo fits
Zelleo's thesis is that a business becomes agent-ready most reliably when infrastructure, business context and agents are designed together.
| Component | Role in the thesis | Status |
|---|---|---|
| Infrastructure | A controlled environment, on site or in a chosen location, where the business's records and agents run | Offered as a scoped deployment; each configuration is agreed and documented per customer |
| Platform | Organises business information, permissions and workflow access in one record | Products shown with interactive demos on sample data |
| Agentic Workforce | Specialised agents that work within defined rules and approval limits | In development |
| Agent-readiness work | Making a business's processes and interfaces understandable to authorised agents | Research and proposed approach |
| Cross-business agent coordination | Agents representing different firms exchanging requests under agreed rules | Future direction, not offered today |
Zelleo's first operational setting is real-estate development and construction, where coordination between builders, suppliers and transporters is frequent, time-critical and largely manual.
A practical roadmap
A business can follow these steps whether or not it works with Zelleo.
- Map two or three high-value workflows, end to end, with the people who do them.
- Identify the source-of-truth data for each, and name an owner for it.
- Write down the rules, exceptions and approval limits that people currently apply from memory.
- Standardise the key data and describe the services involved in a consistent form.
- Expose safe, narrowly scoped interfaces for those workflows.
- Put identity, delegation, permissions and logging in place before any agent acts.
- Test one narrow workflow with human oversight, running beside the existing process.
- Measure the outcome against a baseline, and expand only after evaluation.
How to measure progress
Every measure needs a baseline taken before the change. Faster task completion is not an improvement if errors, exceptions or risk increase alongside it.
- Share of priority workflows documented.
- Share of required data fields complete and current.
- Integration success and error rates.
- Share of actions that need human intervention.
- Exception rate and time to recover.
- Policy violations found in testing.
- Time to complete a defined task.
- Accuracy of status and availability information.
- Cost per successfully completed workflow.
- Human override and reversal rates.
- Security incidents and completeness of the audit trail.
Limitations and unresolved questions
- Trust between organisations. Agreeing which external agents may do what is as much a commercial and legal question as a technical one.
- Liability. Responsibility for an agent's mistakes is not settled, and contracts will need to address it.
- Incentives. A business may not want to make its prices or capacity easy for any agent to query.
- Identity and delegation. Standards for agent identity across organisations are still developing.
- Fragmentation. Several protocols overlap, and they may not converge.
- Some tasks should stay human. Negotiations, sensitive approvals and relationship decisions may be better left to people.
- Uncertain pace. Forecasts about agent adoption may prove wrong in either direction.
Conclusion
Agent readiness is not a matter of installing a model. It means making a business's information, authority, interfaces and workflows usable by authorised software, with people keeping control of the decisions that matter. Most of the work is unglamorous and reuses what already exists. Zelleo is exploring a connected infrastructure, platform and agent approach to this problem, starting with construction coordination.
Sources
Standards, protocols and official documentation
- Model Context Protocol, "The 2026-07-28 Specification", David Soria Parra and Den Delimarsky, MCP blog, 28 July 2026. https://blog.modelcontextprotocol.io/posts/2026-07-28/
- Agent2Agent (A2A) Protocol Specification, version 1.0.0, a2a-protocol.org, accessed 25 October 2026. https://a2a-protocol.org/latest/specification/
- Linux Foundation, "Linux Foundation Announces the Formation of the Agentic AI Foundation", 9 December 2025. https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation
- Linux Foundation, "A2A Protocol Surpasses 150 Organizations, Lands in Major Cloud Platforms, and Sees Enterprise Production Use in First Year", 9 April 2026. https://www.linuxfoundation.org/press/a2a-protocol-surpasses-150-organizations-lands-in-major-cloud-platforms-and-sees-enterprise-production-use-in-first-year
- OpenAPI Initiative, OpenAPI Specification 3.2.1, 10 September 2026. https://spec.openapis.org/oas/latest.html
- IETF, RFC 9700, "Best Current Practice for OAuth 2.0 Security", January 2025. https://www.rfc-editor.org/rfc/rfc9700
- IETF, RFC 8693, "OAuth 2.0 Token Exchange", January 2020. https://www.rfc-editor.org/rfc/rfc8693
- NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), 26 January 2023, and Generative AI Profile (NIST AI 600-1), 26 July 2024. https://www.nist.gov/itl/ai-risk-management-framework
- OWASP GenAI Security Project, "OWASP Top 10 for LLM Applications 2025". https://genai.owasp.org/llm-top-10/
Research
- OpenID Foundation, "Identity Management for Agentic AI", T. South et al., 7 October 2025 (arXiv:2510.25819, 29 October 2025). https://arxiv.org/abs/2510.25819
- R. Kang and Y. Diponegoro, "Governance Gaps in Agent Interoperability Protocols: What MCP, A2A, and ACP Cannot Express", arXiv:2606.31498, 30 June 2026. https://arxiv.org/abs/2606.31498
Industry research and forecasts
- Gartner, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027", press release, 25 June 2025. https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027 (Gartner's site blocks automated access; the figures were checked against W.Media's report of the release, 27 June 2025: https://w.media/over-40-percent-of-agentic-ai-projects-could-face-the-axe-by-end-of-2027-gartner/)
- Gartner, "Lack of AI-Ready Data Puts AI Projects at Risk", press release, 26 February 2025. https://www.gartner.com/en/newsroom/press-releases/2025-02-26-lack-of-ai-ready-data-puts-ai-projects-at-risk
- IBM, "IBM Report: 13% of Organizations Reported Breaches of AI Models or Applications, 97% of Which Reported Lacking Proper AI Access Controls", 30 July 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls