<!-- Generated by tools/toolkit.py from toolkit/maturity-model.yaml. Edit the YAML, not this file. -->

# Executive Maturity Model for Governed Agents

Version 0.1 · CC BY-NC 4.0 — attribute to Hanif Karimi, contextualagentic.com

Six dimensions, five levels. Written so that a level is claimed by pointing at something, not by feeling ready — and so that being at level 2 is an honest, respectable answer.

> Drafted for the companion material of The Contextual Agentic Enterprise. Maturity models are a communication device, not a measurement. Treat a level as a prompt for a conversation, not as a score.

## Levels

1. **Demonstrated** — It works in a demo. Nothing is claimed beyond that.
2. **Bounded** — It runs somewhere real, inside limits someone wrote down.
3. **Governed** — Controls are enforced outside the model and produce evidence.
4. **Assured** — The evidence supports an argument a reviewer accepts.
5. **Routine** — New agents inherit the controls. Adding one is not a project.

## Entries

### Context

**Level 1** — Retrieval over a document pile.

**Level 2** — A curated corpus with known freshness.

**Level 3** — A semantic model queried directly, with provenance recorded.

**Level 4** — Context correctness is measured and regressions are caught.

**Level 5** — New use cases reuse the model rather than building a corpus.

### Authority

**Level 1** — The agent's credentials are whatever was convenient.

**Level 2** — A dedicated identity with a documented permission set.

**Level 3** — Scoped, time-bound grants, revocable in one action.

**Level 4** — Grants are reviewed on a cycle and narrowed when unused.

**Level 5** — Authority is requested and issued through a standard path.

### Enforcement

**Level 1** — The prompt says what not to do.

**Level 2** — Application-level checks around the write path.

**Level 3** — An enforcement point the agent cannot bypass.

**Level 4** — A second independent boundary, and disagreements alert.

**Level 5** — Enforcement is platform capability, not per-project code.

### Evidence

**Level 1** — Debug logs.

**Level 2** — Structured logs of actions taken.

**Level 3** — Records written on every path, refusals included.

**Level 4** — Tamper-evident storage and deterministic replay.

**Level 5** — Assurance cases are assembled from the record, not written by hand.

### Human oversight

**Level 1** — Someone watches the output.

**Level 2** — A person approves before anything ships.

**Level 3** — Escalation holds the action until a named approver decides.

**Level 4** — Reviewers see enough context to disagree usefully, and sometimes do.

**Level 5** — Oversight load is measured and stays inside what people can actually do.

### Economics

**Level 1** — A per-task cost from a vendor slide.

**Level 2** — Measured cost of the tasks the agent completed.

**Level 3** — Cost including the failures, the reviews and the rework.

**Level 4** — A denominator everyone agrees on, and a comparison to the old way.

**Level 5** — The number survives contact with finance without being re-derived.


---

## Purpose and professional-use notice

This book, course and related articles are designed to help readers understand, discuss and apply practical approaches to real enterprise challenges involving artificial intelligence, architecture, governance, security, data and operating models.

The material is educational. It is intended to support informed thinking, better questions, stronger design decisions and meaningful professional work. It is not a ready-made solution for every organisation or situation.

Adapt what you learn to your own context. Before applying any idea, framework, pattern, checklist or technical approach, consider your organisation's objectives, people, systems, data, risk appetite, contractual commitments, laws, regulatory obligations and governance requirements. Obtain the appropriate internal approvals and independent professional advice where needed.

The material does not constitute legal, financial, investment, tax, regulatory, privacy, cyber-security, safety, employment, procurement, audit, medical or other professional advice. It should not be relied on as a substitute for advice tailored to your particular circumstances.

The views, frameworks and examples are the author's independent professional perspectives. They do not represent the views, policies, strategies, recommendations or endorsement of any employer, client, partner, vendor, regulator or other organisation.

Application requires organisation-specific architecture, security, privacy, legal, regulatory, operational, safety, accessibility, commercial and governance review, together with appropriate approvals. Full disclaimer: https://contextualagenticenterprise.com/disclaimer/