Direct Answer (Thesis): Before granting an AI agent permission to modify records, communicate with customers, or commit company or consumer funds, operational leaders should be able to answer seven concrete questions covering task scope, machine-readable truth, delegated identity, abstention under ambiguity, named human approval, safe execution rails, and post-error recourse. If any of these seven answers relies on hoping the language model "figures it out," the workflow is ready for staged preparation—not autonomous execution.
Epistemic note: This seven-question checklist is GAEO.ai's working framework for pre-deployment architectural review. It is shared as a practical inquiry tool, not a compliance standard, legal audit, or guarantee of error-free operation.
Why Pre-Deployment Questions Beat Post-Incident Mortems
Empirical evidence from 2026 underscores how easily capable models stumble when operational guardrails are missing. In McKinsey's August 2026 global study (1,719 respondents in 97 countries), 80 percent of participants reported personal productivity gains from AI, yet only 6 percent achieved high-performer ROI—distinguished by workflow redesign, senior commitment, and disciplined agent risk management. In parallel, Visa's November 2026 benchmark of 22 AI models across 15 shopping challenges found that 42.8 percent of runs failed and 54 percent of failed runs still completed a purchase.
Most preventable agent failures trace back to unspoken assumptions made before launch. GAEO.ai uses seven questions to surface those assumptions early.
The Seven Questions (GAEO.ai Working Checklist)
1. What is the exact boundary of the task?
Can you write down, in plain deterministic terms, the exact inputs the agent receives, the specific tools it may call, and the actions it is strictly forbidden from taking? "Help manage order issues" is an aspiration; "Stage replacement shipments for verified damaged items under a fixed threshold" is a bounded task.
2. Can the agent read the source of truth without guessing?
Are product specifications, live stock counts, fare or pricing rules, and return policies exposed in structured, machine-verifiable formats (clean HTML, aligned Schema.org JSON-LD, /llms.txt, or ACP/UCP endpoints)—or is the agent scraping inconsistent text across PDFs and banners?
3. How do systems verify who is acting and under what mandate?
Can your infrastructure distinguish a legitimate delegated agent acting for a verified customer or employee from an anonymous scraper? Every write request should bind three things: the human or enterprise principal, the agent runtime, and the scoped permission token.
4. When constraints conflict or data is missing, does the agent stop and ask?
Have you tested multi-run consistency—not just a single demo run—on edge cases where no valid option meets every user rule? Given Visa's finding that 54 percent of failed shopping runs still bought something, explicit abstention and clarification triggers are essential.
5. Who is the named human approver for consequential steps?
When a transaction exceeds automated limits or triggers an exception, which specific role receives the escalation? Does their screen show the raw policy evidence and financial impact side-by-side with the draft action so review does not decay into rubber-stamping?
6. How are payments or state changes executed without exposing raw credentials?
If money moves, does the workflow use scoped network tokens or cryptographic payment mandates (such as AP2, explored alongside the FIDO Alliance) rather than passing raw card credentials or static secrets through prompts?
7. When the agent gets it wrong, who can put it right—and how fast?
Is there an immutable log linking the original prompt, observed inventory state, permission mandate, and executed payload—paired with a deterministic cancellation or rollback hook and clear liability ownership?
Summary Pre-Flight Table
| No. | Operational Question | Stack / Autonomy Connection | Red Flag If Unanswered |
|---|---|---|---|
| 01 | What is the exact boundary of the task? | Autonomy Level (Prepares vs. Acts within limits) | Unbounded tool access with wide blast radius |
| 02 | Can it read the source of truth without guessing? | Layer 3 — Inventory (UCP, JSON-LD, clean DOM) | Hallucinated availability, pricing, or policy terms |
| 03 | How are actor and mandate verified? | Layers 1 & 2 — Identity & Permission | Legitimate agents blocked or unauthorized actions accepted |
| 04 | Does it stop and ask under ambiguity? | Multi-run consistency (34.2% 3-of-3 benchmark lesson) | Confident wrong purchases or silent constraint violations |
| 05 | Who is the named human approver? | Human-in-the-loop governance | Unmonitored queues or context-free rubber-stamping |
| 06 | How are credentials and funds protected? | Layer 4 — Payment (AP2, tokenized rails) | Raw credential exposure or false fraud declines |
| 07 | What is the recourse path when it fails? | Layer 5 — Recourse | Unresolvable disputes and customer trust loss |
Sources
- McKinsey & Company, "The state of AI in 2026: On the road to ROI" (25 Aug 2026): mckinsey.com
- Visa Press Release (5 Nov 2026), 22 AI models evaluated across 15 shopping challenges: usa.visa.com
- Google, "Agent Payments Protocol and the FIDO Alliance" (28 Apr 2026): blog.google
- GAEO.ai Working Framework, The Agent-Ready Stack: gaeo.ai/insights/the-agent-ready-stack