Program maturity grades the enterprise’s governance system.
The policies, the agent inventory, the guardrails, the oversight mechanisms, the incident handling. It is the unit a steering committee finds intuitive, because it maps onto every governance maturity model the organization has ever run, from CMMI to NIST tiering. That familiarity is the hazard. The board reads a program grade as a verdict on the whole agentic posture, when it is a verdict on one of three units — and, as the previous post established, a high program grade does not certify any single decision the program governs.
Two stewards grade this unit with real rigor.
OWASP: deployment against governance
OWASP’s Enterprise Adoption Maturity Model refuses to grade the program in isolation. It crosses two scales. A deployment axis runs from AT0 (shadow AI, adopted outside any governance) through AT5 (custom in-house agents the enterprise built and controls). A governance axis runs from Level 0 (no agent-specific policies, generic IT incident handling) to Level 3 (autonomy ladders, real-time drift dashboards, kill switches, governance-as-code).
The model’s operating instruction is the matrix between them. An organization plots each agentic workflow by what it has deployed and by how well it governs that class of deployment. Where governance matches deployment, the cell is green. Where deployment has outrun governance, the cell is red. The guidance is blunt: do not operate in the red cells. The discipline OWASP imposes is that program maturity is meaningless as a standalone number — it is only legible relative to what is actually running. A Level 2 program governing AT2 platform tools is in good standing; the same Level 2 program governing AT4 code-executing agents is in the red.
This is the first crack in the single-number instinct, delivered by a steward: even within the program unit, the grade has no meaning detached from the deployment it is supposed to cover.
SANS: built to assume you’re inflating
SANS grades the program along three pillars — Protect AI, Utilize AI, Govern AI — across five stages, Stage 1 (Unaware / Ad Hoc) through Stage 5 (Optimizing / Adaptive). On its face this is a conventional maturity ladder. The substance is in the scoring discipline, which is constructed on the assumption that the holder is inflating the score.
Two mechanisms enforce that assumption. The first is weakest-link capping: an organization’s overall stage cannot sit more than one level above its weakest pillar. The second anchors the whole assessment to governance: the overall grade cannot exceed the Govern pillar by more than one stage. The consequence is direct — an enterprise with Stage 4 detection tooling and a Stage 1 governance pillar does not get to claim Stage 4. The tooling spend does not buy the grade.
SANS also contributes original agentic guidance that the program unit specifically needs: the Principle of Least Agency — the agentic counterpart to least privilege — and an explicit focus on Non-Human Identity, where most programs have a blind spot. Its author, Chris Cochran, co-authored the prEN 18282 standards work and leads the Agentic AI Task Force on the OWASP AI Exchange, which places the SANS and OWASP models in conversation rather than competition.
Where the empirical weight actually sits
It would be convenient to point to a study showing that higher program maturity produces better outcomes, and one exists in proposal form. The Agentic AI Governance Maturity Model (AAGMM) lays out a five-level framework across twelve governance domains grounded in NIST AI RMF and ISO/IEC 42001, and reports large, statistically significant outcome differences between maturity levels. We cite it as a framework proposal, not as proof. Its validation comes from 750 simulation runs across synthetic enterprise scenarios, not field data, and it is a single-author preprint. Under our sourcing discipline, a synthetic, single-source result does not anchor the empirical claim that governance maturity drives outcomes. It shows what grading the program looks like when taken seriously; it does not establish that the grade predicts reality.
The field evidence for the program gap comes from elsewhere, and it is more sobering than any maturity ladder. The systematic study of agents in production (MAP) — first-hand data from practitioners, not simulation — finds reliability to be the top development challenge in deployment, addressed through systems-level design rather than model improvement. A separate analysis of enterprise agentic evaluation documents a 37% gap between laboratory and production performance and reliability that degrades from roughly 60% to 25% once systems leave the benchmark. The governance program is not failing for lack of a maturity model; it is failing because the operational substrate the program is supposed to govern is harder than the pilot suggested.
Industry surveys layer corroboration on top. Deloitte’s 2026 study (N = 3,235, director to C-suite, 24 countries) found that only 21% of organizations have a mature agent-governance model while roughly three-quarters plan to deploy within two years. Gartner’s projection that more than 40% of agentic AI projects will be canceled by 2027 attributes the cancellations to governance and ROI failure, not model failure. These are survey and analyst figures, reported here as corroboration on top of the empirical corpus — not as its foundation.
The inflation problem, restated
The reason program maturity is the dangerous unit is not that the models are bad. OWASP’s matrix and SANS’s capping are, between them, the most disciplined grading in the entire landscape. The danger is that the program is the unit the board most wants a single confident number for, and the unit where the holder has the most incentive and the most room to supply one. SANS’s entire scoring apparatus exists because, left alone, the program grade drifts upward. The architect’s posture is the one SANS designs for: treat the grade as a claim to be defended against its weakest pillar, not a number to be reported at its strongest.
And even a defended program grade certifies only the program. It says nothing about whether a given agent has earned the autonomy it has been handed — which is the next unit.
Program maturity is the grade most worth having and least safe to trust at face value, because it is graded by its owner. The two stewards who grade it well — OWASP by tying the score to deployment, SANS by capping it at its weakest pillar — both encode the same warning: the program score inflates unless something forces it down to evidence.
Adopt the score as a defended position. Never report it as a verdict on the agents or the fabric it does not measure.
