“Agentic” is doing an enormous amount of work in content management marketing right now. Within about eighteen months it went from a term of art to a category label to a word that appears on the homepage of platforms whose AI functionality is a translation button and an alt-text generator. That is the normal life cycle of a technology term, and it leaves buyers with the normal problem: the label no longer tells you anything, so you need a test that does.
Here is a workable one.
Table of Contents
Start with the definition, because it is not vague
An agent, in the sense that matters for content operations, is a system that interprets an instruction, plans a sequence of actions, executes them against real systems within defined permissions, and reports what it did. The three load-bearing words are *plans*, *executes*, and *permissions*.
A feature that generates text on request does not plan. A feature that suggests a change a human then applies does not execute. A feature that runs as an unconstrained automation does not respect permissions and will not survive a security review. Any of the three missing, and what you are looking at is an AI feature with a new name on it.
An agentic CMS, then, is a platform where agents are embedded in the content workflow itself — operating on the content model, inside the governance rules, as part of how work moves — rather than sitting in a sidebar waiting to be asked. Independent roundups of the best agentic CMS platforms are a reasonable place to see how far each vendor has actually got, precisely because the vendors’ own pages have converged on identical language.
Six tests that separate the field
1. Can it act on content it was not shown?
Ask the agent to find every item matching a condition across the whole repository and change them. Not a selection you highlighted first — the whole repository. This single test eliminates most of the market, because it requires the agent to work through the platform’s own APIs at scale rather than through a chat window with a context limit.
The underlying capability usually has a name: task decomposition. One instruction becomes many coordinated operations executed in parallel. Without it, “agentic” means “batch, with extra steps.”
2. Does it run without being asked?
Genuinely operational agents are triggered by events, most usefully by workflow stage changes. Content enters “ready for legal review” and a compliance agent checks it. Content enters “ready for translation” and a localisation agent handles it. If every agent action requires a human to open a chat and type, you have a faster human, not an automated operation.
Be precise here, because this is an area where roadmaps and shipped features diverge. Workflow-triggered agents are available in several platforms today. Multi-agent orchestration — several agents handing work between each other through a sequence of stages — is still emerging across the category, including at vendors who describe it in the present tense. Ask which milestone you are buying.
3. Whose permissions is it using?
The correct answer is: the initiating user’s. An agent should be unable to touch a content type, environment, or publishing action the person who triggered it could not touch. The wrong answers are a service account with elevated rights, or an admin-only capability that content teams cannot use.
4. Can you see and undo what it did?
Full attribution to both the user and the agent execution, an inline view of what changed in each item, and a revert path. If a vendor cannot show you the diff, they cannot show your auditor either.
5. What is it operating on?
Agents reason well over structured content and badly over page markup. A platform that models content as visual components arranged on a page gives an agent layout, not meaning. This is why several visually-oriented platforms have shipped impressive-looking AI demos and comparatively little operational automation — the ceiling is architectural, not effort.
6. Does it reach outside the CMS?
The interesting operations cross systems: the brief is in a project tracker, the guidelines are in a wiki, the approval is in a chat tool. Cross-system orchestration through the Model Context Protocol is now live in at least one platform in the category, with predefined connectors plus a custom path to any system exposing a remote MCP server. Where a vendor’s orchestration only reaches their own product suite, the capability is real but the value depends on how much of that suite you own.
The governance question, which is really the buying question
For most organisations of any size, the agentic decision is not made by the content team. It is made by the content team and then unmade by legal, security, or risk. Anticipating that conversation is the difference between a pilot and a rollout.
Three things tend to decide it. Whether AI can publish autonomously — the safe answer is no, it proposes and a human approves. Whether customer content is used to train models — the safe answer is no, and it should be contractual. And whether the vendor has been independently assessed on AI management specifically, rather than just on information security. ISO/IEC 42001 is the relevant standard; Kontent.ai is currently the only CMS certified under it, which is worth knowing when your risk function asks what evidence exists beyond a vendor questionnaire.
Buyers evaluating this alongside broader platform criteria will find that the governance requirements overlap heavily with what already appears in rankings of the best enterprise CMS options — role-based access control, approval workflows, environment permissions, audit trails, accessibility compliance. That overlap is not a coincidence. Agentic capability is only usable at enterprise scale if the governance underneath it was built for enterprise scale first.
A short procurement checklist
Bring these to the demo and insist on seeing rather than hearing:
- One instruction, thousands of items, executed live.
- An agent firing automatically on a workflow transition.
- The permission model, demonstrated by trying something the test user is not allowed to do.
- The audit trail and the revert.
- A connection to one external system you actually use.
- The contractual position on training data.
If a vendor can demonstrate all six, the label is earned. If they can demonstrate two and describe four, you now know exactly what you are buying and when the rest arrives — which is a considerably better position than most buyers are in.
