The Agent Runtime Governance Maturity Model
Agent Governance Readiness Assessment
Score your organization against the 12 Principles and see your maturity level.
The 12 Non-Negotiable Principles for Agent Runtime Governance tell you what to build. They do not tell you where you stand today, or what to do first. That is what the maturity model is for.
It has five levels, from agents running with no governance at all to fully governed multi-agent operations. Most organizations deploying agents today are at Level 0, whether they have named it or not. The goal is not to leap to the top. It is to make deliberate, measurable progress toward governed agent operations, one level at a time.
Find where you sit
Read down the table and stop at the row that matches your reality today. That is your level.
| Level | What it looks like today | Governance in place |
|---|---|---|
| Level 0 Unmanaged | Teams spin up agents ad hoc. No inventory of what agents exist, what they access, or who owns them. No authorization framework, no audit trail, no incident plan. | None |
| Level 1 Identified | Agents are inventoried. Basic identity is established, with known owners. Logging exists but may be inconsistent. Policy enforcement is manual and reactive. | Identity, purpose, basic logging |
| Level 2 Controlled | Agents operate through policy-enforced control planes. Actions are validated before execution. Authority is scoped and time-limited. Policy is code, evaluated at runtime, and can be revoked immediately. | Scoped authority, control planes, lifecycle, runtime policy |
| Level 3 Governed | Full lifecycle governance is operational. Human-in-the-loop is a designed capability. Memory is governed. Behavior is observable at operational, behavioral, and compliance levels. Failure modes are tested. Tools and services are registered and access-controlled. | Human oversight, governed memory, full observability, safe failure, tool governance |
| Level 4 Optimized | Multi-agent orchestration is governed and observable. Continuous compliance monitoring is automated. Cross-enterprise orchestration is secure and auditable. Governance data drives performance, and enables speed rather than constraining it. | Multi-agent governance, automated compliance, optimization |
The path from one level to the next
Maturity is not a leap. Each level is unlocked by adding a specific set of the 12 Principles. This is the sequence.
| Move | Principles to add | What you unlock |
|---|---|---|
| Level 0 to 1 | 1, 2, and basic logging (9) | Agent registry, identity, basic logging, ownership |
| Level 1 to 2 | 3, 4, 5, 7 | Scoped authority, control planes, lifecycle, runtime policy |
| Level 2 to 3 | 6, 8, 9, 10, 11 | Human oversight, memory governance, full observability, safe failure, tool governance |
| Level 3 to 4 | 12, plus continuous improvement across all principles | Multi-agent governance, automated compliance, optimization |
The level that matters most
You do not need to reach Level 4 to be safe. The decisive move is getting from Level 0 or 1 to Level 2, Controlled, where actions are authorized against policy before they execute and authority is scoped and revocable. That is the point at which an agent program stops being a liability you hope behaves and becomes a system you can put into production. Organizations that reach Level 2 and 3 will scale agentic AI with confidence while others spend their time firefighting governance incidents.
How to move up
Getting mature is a sequence of deliberate steps, and each one has a starting point.
- Measure where you are. The Agent Governance Readiness Assessment scores your organization against the 12 Principles and places you on this model, with the specific gaps that are holding you at your current level.
- Design the path. Our Authorization and Runtime Control Architecture workshop helps your team design the identity, authorization, and runtime enforcement that move you from Level 1 to Level 2 and beyond, alongside your existing IAM and PAM stack.
- Deploy the control plane. Watchlight AI Beacon implements the runtime governance principles that carry an organization from Level 0 to Level 2 and through most of Level 3. You can see exactly which principles are available today, and the one still on the roadmap, in The 12 Principles, Implemented.
The choice facing every enterprise is straightforward. Govern your agents, or be governed by their failures.
Related reading: the 12 Non-Negotiable Principles for Agent Runtime Governance, The 12 Principles, Implemented, and Agent Runtime Governance Is Becoming Critical Infrastructure.
Put runtime governance in front of every agent action
Watchlight AI Beacon is available now, fully on-premises and air-gapped. Request a demo to see it in your environment.
Agent Governance Readiness Assessment
Evaluate your governance posture against the 12 principles. Get a maturity score and roadmap.
2-3 days · Download one-pager (PDF)