<!-- Generated by tools/toolkit.py from toolkit/maturity-model.yaml. Edit the YAML, not this file. -->

# Executive Maturity Model for Governed Agents

Version 0.1 · CC BY-NC 4.0 — attribute to Hanif Karimi, contextualagentic.com

Six dimensions, five levels. Written so that a level is claimed by pointing at something, not by feeling ready — and so that being at level 2 is an honest, respectable answer.

> Drafted for the companion material of The Contextual Agentic Enterprise. Maturity models are a communication device, not a measurement. Treat a level as a prompt for a conversation, not as a score.

## Levels

1. **Demonstrated** — It works in a demo. Nothing is claimed beyond that.
2. **Bounded** — It runs somewhere real, inside limits someone wrote down.
3. **Governed** — Controls are enforced outside the model and produce evidence.
4. **Assured** — The evidence supports an argument a reviewer accepts.
5. **Routine** — New agents inherit the controls. Adding one is not a project.

## Entries

### Context

**Level 1** — Retrieval over a document pile.

**Level 2** — A curated corpus with known freshness.

**Level 3** — A semantic model queried directly, with provenance recorded.

**Level 4** — Context correctness is measured and regressions are caught.

**Level 5** — New use cases reuse the model rather than building a corpus.

### Authority

**Level 1** — The agent's credentials are whatever was convenient.

**Level 2** — A dedicated identity with a documented permission set.

**Level 3** — Scoped, time-bound grants, revocable in one action.

**Level 4** — Grants are reviewed on a cycle and narrowed when unused.

**Level 5** — Authority is requested and issued through a standard path.

### Enforcement

**Level 1** — The prompt says what not to do.

**Level 2** — Application-level checks around the write path.

**Level 3** — An enforcement point the agent cannot bypass.

**Level 4** — A second independent boundary, and disagreements alert.

**Level 5** — Enforcement is platform capability, not per-project code.

### Evidence

**Level 1** — Debug logs.

**Level 2** — Structured logs of actions taken.

**Level 3** — Records written on every path, refusals included.

**Level 4** — Tamper-evident storage and deterministic replay.

**Level 5** — Assurance cases are assembled from the record, not written by hand.

### Human oversight

**Level 1** — Someone watches the output.

**Level 2** — A person approves before anything ships.

**Level 3** — Escalation holds the action until a named approver decides.

**Level 4** — Reviewers see enough context to disagree usefully, and sometimes do.

**Level 5** — Oversight load is measured and stays inside what people can actually do.

### Economics

**Level 1** — A per-task cost from a vendor slide.

**Level 2** — Measured cost of the tasks the agent completed.

**Level 3** — Cost including the failures, the reviews and the rework.

**Level 4** — A denominator everyone agrees on, and a comparison to the old way.

**Level 5** — The number survives contact with finance without being re-derived.