Methodology · Rubric v0.1
What makes a tool AI-friendly.
One question, answered the same way for every tool in the catalog: if an organization adopts this tool, how much can AI actually do with it - safely? The answer is a weighted sum across seven dimensions, 0 to 100.
AI-friendliness is not the same as "has an AI feature." A chatbot bolted onto a closed system scores worse than a plain tool with a great API. The line we open every engagement with
The seven dimensions
Weighted for what matters in practice.
Integration surface and AI interoperability are 45 of the 100 points, because they decide whether anything is possible at all. Marketing gets 5.
01
25 pts
API & Integration Surface
Can software - and therefore an AI agent - programmatically do what a human can do in the user interface?
- Public, documented REST or GraphQL API covering core features, not a lone token endpoint
- Webhooks and event subscriptions, so AI can react instead of polling
- API access available on small-business pricing tiers, not enterprise-gated or partner-only
- Write access, not read-only
02
20 pts
AI Interoperability
Is the tool already part of the AI ecosystem, or does someone have to build the bridge?
- An MCP server, official or well-maintained community - the single strongest signal in 2026
- Native assistant features that are genuinely useful, not chatbot veneer
- Listed connectors in Zapier, Make or Microsoft Power Automate
- An AI agent can complete a real end-to-end task, such as pulling last pay period's overtime by department
03
15 pts
Data Accessibility & Portability
Your data is only AI-usable if you can get at it.
- Structured export in CSV or JSON, bulk export, scheduled or automated export
- Machine-readable data models - not scanned PDFs or locked reports
- No punitive lock-in; reasonable data egress if you leave
04
15 pts
Security & Governance
AI access has to be grantable safely. This is the dimension HR audiences care most about, and rightly so.
- OAuth 2.0, scoped API keys or service accounts, so an agent gets least-privilege access
- SSO and SAML support; role-based permissions that apply to API access too
- Audit logs - you can see what the AI did
- SOC 2 or relevant compliance, and clear terms on whether your data trains their models
05
10 pts
Documentation & Developer Experience
Increasingly, AI writes the integration. It can only do that from documentation it can read.
- Current, public API docs, an OpenAPI spec and real SDKs
- A sandbox or test environment - you can build against it without touching production payroll
- Docs that are public rather than behind a login wall
06
10 pts
Automation Depth
How much can be automated inside the tool before you need to leave it?
- A built-in workflow builder with triggers, conditions and actions
- Reasonable API rate limits and batch operations
- A template or recipe ecosystem
07
5 pts
Vendor AI Posture
Where the vendor is heading, and whether they break integrators on the way.
- A published AI roadmap and a stated AI usage policy
- Transparency about AI features - which model, which data
- A track record of API stability
The tiers
What the number means on Monday morning.
| Score | Tier | Meaning for the client |
|---|---|---|
| 85–100 | AI-Native | AI agents work with it today, out of the box. |
| 70–84 | AI-Ready | Solid integration story; modest setup effort. |
| 50–69 | AI-Workable | Possible, but gated or partial - expect friction or middleware. |
| 30–49 | AI-Limited | Data gets in, rarely comes out; manual bridging required. |
| 0–29 | AI-Hostile | Closed box. Recommend replacement in an AI-forward stack. |
Scoring rules
Honest beats flattering.
These rules exist so a score means the same thing in six months, and so no vendor can buy a better number.
Today, not roadmap
We score what exists now. Announced features only move dimension seven, vendor posture.
The tier you'd actually buy
If API access is enterprise-only, a small organization is scored without it. You are not billed for capabilities you cannot reach.
Provisional until verified
Every score starts provisional and is flagged as such until it has been checked line by line against vendor documentation.
Re-reviewed every six months
An MCP server or a deprecated endpoint can move a tool a full tier. Stale scores are worse than no scores.
Why security is inside the score
A tool you can't grant safely is a tool you can't use.
Some vendors treat governance as the opposite of capability. We score it as part of capability. If you cannot give an AI agent scoped, revocable, logged access, then the only safe amount of access is none - and the tool's API might as well not exist.
That is why OAuth scopes, role-based permissions that extend to the API, audit logs and model-training terms carry 15 points. For HR and payroll systems holding personal data, it is the dimension we look at first.
Next step
Run the rubric on your own stack.
We will score your tools against these seven dimensions and give you the gap report - whether or not you hire us to fix it.