Scorecard · Updated July 13, 2026

The Permission, People, Programs Scorecard

One page. Grade your company on the three pillars that decide whether AI changes how you work, and find the one to fix first.

How to use this

One rule. Score your company from 0 to 3 on each of the three pillars, using the tables below. Do it with the people who own the work, not alone at your desk, and score the company you have, not the one on the strategy slide. Then read your result by your lowest pillar, not your average, because Permission, People, and Programs grow together or none of them grows.

Permission: the space to move

Score	What it looks like
0 · Absent	No usable policy, or a blanket ban people quietly route around. Nobody can say cleanly which data goes in which tool.
1 · Stated	A policy exists on paper, but it is a data policy in disguise, and your people cannot answer the Tier 1 versus Tier 2 question without checking.
2 · Practiced	Two data tiers are clear, approved environments exist for each, and accountability and decision rights are named. People know where they are allowed to move.
3 · Native	You revisit permission as the capability changes. Governance creates speed instead of braking it, and you review each gate for its shape rather than freezing it.

People: the capacity to move

Score	What it looks like
0 · Absent	Access without adoption. A handful of enthusiasts, and everyone else works exactly the way they did last year.
1 · Stated	Training happened, a rollout or a webinar or a license, but behavior has not moved and there is no peer anyone is copying.
2 · Practiced	Respected people use it in view of others, the examples look like real work, and adoption is spreading by imitation.
3 · Native	Changing how the work is done is normal. People bring their own AI ideas, and new capability turns into new habits without a program pushing it.

Programs: the capability itself

Score	What it looks like
0 · Absent	No programs, or scattered pilots that never change how the institution operates.
1 · Stated	Tools get shipped, but every request defaults to the same reflex, a pilot or a purchase or a custom build, whatever the room reaches for.
2 · Practiced	Requests get routed on purpose, and the smallest builds are winning the adoption that unlocks the bigger ones. The learning is kept.
3 · Native	You keep re-routing your builds and your buys as the line moves. The institution operates measurably differently than it did a year ago, on purpose.

Read your score

Pillar	Your score (0-3)
Permission
People
Programs

Your true level is your lowest pillar. Two things are almost always true when leaders score themselves honestly. Permission comes in high, because writing a policy feels like progress and it threatens no one. People comes in low, because behavior is the hardest and least visible thing to change. If Permission is your highest score and People is your lowest, you are not behind, you are normal, and you now know exactly where the work is.

The move

Take your lowest pillar and raise it one level this quarter. Operator heuristic One level per quarter is a healthy default pace, not a law; a higher-risk or earlier-stage company should set its own target. Not all three, and not the one you like to show off. One level, on the pillar you are worst at. The question of which pillar to fix first has its own answer, and the full model is on Permission, People, Programs.

Score it in the next exec meeting, out loud, before anyone has time to round themselves up. Then put a date on the calendar ninety days out, and score again.