AAO™ — Part 2: The Agentic Internet Arrived. Is Your Business Ready?

Ten months ago I published a framework called AAO™ — Actionable Agent Optimisation. The wave I described has arrived, and it's moving faster than I expected. Here's what it actually looks like, and how to know if your business is ready.

A moment I didn't expect

I remember hitting publish on the original AAO™ post on 12 August 2025 — equal parts excited and nervous. Excited because the idea felt important. Nervous because, honestly, I wasn't sure anyone would care.

The concept was simple, but ahead of its time: AI agents were no longer just finding information. They were starting to act — booking, ordering, transacting, scheduling. And if your business systems weren't built to be executed by those agents, you'd become invisible in a way no amount of SEO could fix.

I called this new layer AAO™ — Actionable Agent Optimisation.

Ten months on, I'm not nervous anymore. The wave I described has arrived — and it's moving faster than even I expected.

This is Part 2. It's for those who read the original and wondered, "Okay, but what does this actually look like?" And for those who didn't — but are now feeling the pressure to define an AI strategy and not quite knowing where to start.

What happened while we were watching

When I wrote Part 1, a few things were happening quietly in the background.

Anthropic had just released MCP — the Model Context Protocol — in November 2024. It didn't make headlines outside developer circles, but I remember reading it and thinking: this is the plumbing.

OpenAI followed with its first autonomous web agent in January 2025. Google launched Agentspace for enterprise in February 2025. After that, the pace of releases became genuinely hard to track.

I won't pretend I predicted the speed. I didn't. But the direction was clear — and that part was right.

What's changed most isn't the technology. It's the attitude.

Twelve months ago, "agentic AI" was something you said at a conference to sound forward-thinking. Today, it's showing up in procurement conversations, strategy decks, and boardroom questions from people who, six months ago, were still asking if ChatGPT was a fad.

MCP is being adopted across hundreds of platforms. Developers are treating it as a baseline — the way REST APIs once were. The question has quietly shifted from "Will agents connect to external systems?" to "Which systems will they connect to — and is mine one of them?"

The part nobody was talking about

When I wrote Part 1 — and even now — one thing stood out: most of the conversation around agentic AI focused on the agents themselves.

Which model is best. Which platform to use. How to prompt them. How to build them.

The businesses those agents interact with barely got a mention.

That's the gap AAO™ addresses.

Look at it from the agent's perspective — because increasingly, that's what matters. An AI agent acting on behalf of a customer doesn't care about your brand story or homepage hero image. It's trying to complete a task.

Book a table. Place an order. Schedule a call. Retrieve a balance. Return a product.

If it can do that cleanly, you win the transaction. If it hits friction — a static form, a phone number, a PDF — it moves on.

The businesses that are AAO-ready become the default. The ones that aren't become invisible.

What this looks like in practice

Let's make it concrete.

Imagine a Wellington café — a busy lunch spot in Thorndon that fills up every weekday.

Without AAO: A customer asks their AI assistant to book lunch for four at 12:30 on Thursday. The agent finds a phone number and stops. It can't call. It hands the task back to the user. Maybe they follow through. Maybe they pick another café that takes 10 seconds.

With AAO: The agent reaches the café's booking API, checks availability, confirms four seats, charges the saved card, and sends a confirmation — all before the customer finishes their coffee.

Zero friction. Zero human involvement. The café wins the booking.

That's not futuristic. That's possible now.

Swap the café for a law firm handling enquiries, a retailer managing reorders, a healthcare provider scheduling follow-ups, or a SaaS platform resolving support. The principle holds:

If an agent can execute with you, you win. If it can't, you lose to someone who can.

The AAO™ framework: updated for 2026

In Part 1, I introduced AAO™ as a concept. Since then, the framework has sharpened.

There are six layers every business needs to become agent-ready. I call it the IIWTMA stack — not catchy, but useful for an honest audit.

1. Identity — Can an agent verify who you are?

This is the front door — and many businesses have effectively locked it to machines.

Agents need to confirm they're dealing with a legitimate system. OAuth, API keys, token-based auth — these are standard. The failure mode isn't missing tech; it's human-first design. CAPTCHAs, SMS codes, "click the traffic lights." The moment a machine hits one, the flow breaks.

Your agent is left standing outside.

2. Inbox — Can an agent receive and send on your behalf?

This layer surprised me.

We assume communication is solved — email, messaging, done. But human-readable isn't the same as machine-usable.

Agents need structured signals: webhooks, notification APIs, clear state transitions, and formats that don't require parsing prose. Email helps, but it's not sufficient.

The shift is from messaging to programmatic handshake.

3. Wallet — Can an agent transact for you?

This is where even strong teams stumble.

You can have clean APIs everywhere — until payment requires a human to type in a card. At that point, the loop breaks.

Agents need tokenised payments, pre-authorised limits, and compatible rails. These exist today. The question is whether your system supports them.

4. Tools — Can an agent trigger your systems?

This is where MCP changed the game.

Your core logic — booking, ordering, updating, searching — must be exposed as callable functions with deterministic responses.

Not a webpage. Not a PDF. An interface.

The ecosystem is maturing quickly, but most businesses still expose read-only APIs and assume that's enough. It isn't.

5. Memory — Does the agent know your context?

If a customer's agent has interacted with you three times, does it remember anything?

Preferences. History. Patterns.

In most cases, no — because that context isn't exposed in a usable way.

This layer isn't just storage. It's making CRM, history, and profiles callable so the agent doesn't start from zero every time.

6. Audit — Can the agent verify what happened?

I added this after repeated conversations with clients: "How does the agent know it worked?"

If a booking or transaction completes but your system doesn't return structured confirmation — what, when, by whom — the agent is operating on guesswork.

Agents that can't verify become conservative. They retry. They escalate uncertainty. Or they avoid you entirely.

Every agentic action needs a clean, machine-readable close.

Where most businesses are right now

Honestly? Most are at zero.

That's not criticism — it's timing.

The infrastructure behind AAO™ only became real in 2024–2025. The mainstream conversation is catching up in 2026.

So if you're thinking, "We haven't done any of this," that's normal. You're not behind.

But the window for meaningful early advantage is closing.

One thing I keep coming back to: defaults matter more here than they did in search.

In Google, ranking second still gets traffic. In an agentic world, the agent picks one option, executes, and moves on.

If it learns your competitor is reliable and frictionless, that becomes the default — every time.

They don't need to outrank you. They just need to be trusted first.

That's a different kind of competitive pressure.

Three questions worth asking this week

You don't need to overhaul everything at once. But these three questions cut straight to the core:

1. Can a machine complete your most common customer transaction without human help?
Don't theorise. Try it. Use an AI agent, simulate a real task, and see where it fails.

2. Do you have an API — and does it actually do anything?
Many APIs are read-only. That's not enough. If an agent can't trigger an action, you're only halfway there.

3. When something completes, how does your system say so?
If success is communicated via a "thank you" page meant for humans, that's a gap. Agents need structured confirmation.

What's next

I'm building the AAO™ Readiness framework into a practical tool — something you can run your business through to see where you stand across all six layers.

If that's useful, I'd like to hear from you.

Part 1 was the "why." This is the "what." Part 3 will be the "how" — a step-by-step path to making your systems agent-ready from wherever you are today.

The agentic internet isn't coming. It arrived while most of us were still debating whether to take it seriously.

We spent years optimising to be found (SEO), then to be understood (SAO). The next layer is execution — whether an agent can get something done with your business end-to-end, without a human in the loop.

That's AAO™.

And unlike the previous waves, this one won't give you five years to catch up.

So — which of the six layers is missing in yours?

AAO™ — Actionable Agent Optimisation is an original framework first published by BMK Lakshminarayanan on 12 August 2025. Read Part 1 →