The enterprise AI maturity model is a way to place where your organization actually is — from individuals using a personal copilot, to a team running its work on agents that act, on a schedule, under audit. It is a ladder, not a switch, and each rung asks for two things at once: a new capability, and the governance that makes that capability safe to rely on. This is that ladder, level by level.
Most “are we doing AI?” conversations collapse two different questions into one. The first is whether anyone is using AI at all. The second — the one that actually predicts value — is how they are using it: as a private assistant that helps one person write faster, or as a governed system the whole team depends on to run real work. Those are years apart in capability and in risk, and calling both “AI adoption” hides the distance between them.
A maturity model exists to make that distance legible. It gives you a shared vocabulary for where you are, a sense of what the next rung requires, and — this is the part organizations skip — a reminder that every increase in capability has to be matched by an increase in governance. An agent that can act without an approval step is not a more advanced version of a chatbot; it is a larger blast radius. The levels below pair the two deliberately, so that moving up is a decision you make on purpose rather than one you drift into.
This model is vendor-neutral by design: the levels describe a progression any organization moves through, on any platform. Where a level maps onto a real capability in Insulin — the general-purpose AI platform for business work, built by Suger — this post names it plainly, and only with features that exist today. The point is the ladder, not the logo.
What is the enterprise AI maturity model?
The enterprise AI maturity model is a five-level framework describing how an organization’s use of AI progresses — from individuals using personal copilots, to teams running governed agentic operations — where each level adds a capability and the governance that capability requires. It is a diagnostic, not a scorecard. Its job is to tell you which rung you are on and what the next one actually demands, so that “let’s use more AI” becomes a specific, sequenced decision instead of a slogan.
The two axes matter equally. Capability is what the AI can do: answer, ground its answers, act, act unattended. Governance is what keeps that safe: citations you can check, scope that bounds what an agent reaches, approval on the irreversible step, a run history you can audit, roles that assign accountability. A level is only real when both are present. Capability without governance is the failure mode every AI incident post-mortem eventually names — an agent that could act, and nothing that decided whether it should.
The five levels
Each level, what it looks like on the ground, the capability that makes it possible, and the governance without which it is a liability rather than an asset. Read down the table to find where you are; read across a row to see what that rung actually requires on both axes.
| Level | What it looks like | Capability it needs | Governance it needs |
|---|---|---|---|
| L1 — Personal copilots | Individuals use a chat assistant to draft, summarize, and brainstorm; value is private and per-person | General-purpose conversational AI | Data-handling clarity: is anything you type used to train a model? |
| L2 — Grounded team chat | Teams ask questions and get answers from their documents, not the model’s guess, with sources attached | Retrieval-time knowledge grounding with citations | Checkable citations; retrieval, not training, on your data |
| L3 — Scoped agents that act | An agent takes a real action — drafts a reply, updates a record — within a bounded set of systems | Agents with per-agent integration scope | Human approval on consequential actions; scope as a hard boundary |
| L4 — Scheduled & event-driven jobs | The same agent runs unattended — on a schedule or a trigger — without anyone watching it | Scheduled and event-driven execution | A durable run history; inherited scope that holds while unattended |
| L5 — Governed agentic operations | Many agents and jobs run across teams as maintained systems, each with a named owner | Reusable, role-scoped components across surfaces | Role-based access and audit: who may change what, and who is accountable |
The rest of this section walks each rung in turn.
L1 — Personal copilots: AI as a private assistant
Level 1 is individuals using a general-purpose chat assistant to draft, summarize, and think out loud — real productivity, but private and unaccountable. This is where almost every organization starts, and it is genuinely useful: a copilot that helps one person write a first draft or unstick a problem earns its place. What it does not do is compound. The value lives in individual accounts, invisible to the team, and it disappears when that person is out.
The capability at this rung is just strong conversational AI. The governance question is narrower than people expect but not optional: is anything you type used to train a model? At L1 the sensitive thing is not what the AI does — it only talks — but what happens to what you tell it. An organization that never asks this ships confidential context into a training set by accident. In Insulin, chat is the front door, and Suger does not use your documents or conversations to train models — the L1 governance question answered before you climb any higher.
L2 — Grounded team chat: answers from your material, not the model’s guess
Level 2 is a team asking questions and getting answers grounded in their own documents, with a citation on every answer they can open and check. This is the first rung where AI stops being generic. An ungrounded assistant is fluent about how contracts, pricing, or a provider’s rules usually work, and confidently wrong about how yours do. Grounding closes that gap by having the AI read your content at the moment the question is asked.
The capability is retrieval-time grounding. The governance is the citation: an answer you cannot check is an answer you must trust on faith, which enterprise work cannot do. Two things separate real grounding from a demo trick — retrieval happening at query time rather than baked into a model months ago, and a source on every answer you can open. Insulin knowledge bases are searched at query time to ground an answer, each result returns the source document it came from with a relevance score, and retrieval is hybrid — combining keyword and semantic matching — so an internal codename and a plain-English question both find the right passage. We go deeper on the tradeoff in choosing an enterprise AI agent platform.
L3 — Scoped agents that act: from answering to doing
Level 3 is an agent taking a real action — drafting a reply, updating a record — within a bounded set of systems, with a human approving the consequential step. This is the rung where the risk profile changes, because the AI stops talking and starts doing. An agent that acts is worth far more than one that answers, and it is also the first thing that can be wrong in a way you cannot take back.
Two governance mechanisms make this rung safe, and both are required. First, scope: each agent should reach only the integrations its job needs, so a support agent physically cannot touch finance data and the blast radius of a mistake is bounded. Second, approval: nothing consequential runs until a person confirms it. In Insulin, each agent is scoped — you allowlist the integrations it may use, and scope is the boundary, so an agent cannot reach data outside its job — and tool execution runs through approval workflows in chat, where you see the plan before it runs and decide whether it runs at all. That approval step is the whole subject of human approval for AI agents: approval sits on the action, preventively, not after it as a log entry.
L4 — Scheduled & event-driven jobs: the agent runs without you
Level 4 is the same scoped agent running unattended — on a schedule or triggered by an event — so work happens without anyone starting it. This is where AI moves from a tool you operate to a system that operates on its own. A month-end reconciliation that runs at 06:00, a triage that fires when a ticket arrives — the value is enormous precisely because no human is in the loop, which is also exactly what makes governance non-negotiable at this rung.
The capability is unattended execution. The governance is a durable run history — because the moment you put an agent on a schedule you give up watching it, so trust has to come from a log you can open after the fact. It is also inherited scope: the boundary you set at L3 has to hold at 3 a.m. In Insulin, scheduled and event-driven jobs inherit the integration scope of the agent they run, which is what makes them safe to leave running, and every job has a runs table — one row per execution showing when it started, its status, and its duration, expandable to the result, the error, or the triggering payload. Even a filtered trigger is a row, so the absence of a run is as visible as its presence. Crossing this rung deliberately is the subject of the pilot-to-production readiness checklist.
L5 — Governed agentic operations: many agents, one accountable system
Level 5 is many agents and jobs running across teams as maintained systems, each governed by role-based access and each with a named owner. This is the top of the ladder: AI is no longer a project but infrastructure — a set of grounded, scoped, audited components that teams across finance, sales, operations, and support depend on daily. The defining property is not that there are more agents; it is that each one is owned and governed, so the fleet does not drift into a set of black boxes nobody maintains.
The capability is reusable, role-scoped components that travel across surfaces — chat, shared channels, jobs, custom apps — without being rebuilt each time. The governance is roles and accountability: who may change an agent’s configuration, who may only run it, and — the line teams skip because it feels like paperwork — who owns it. In Insulin, agents carry role-based access (owner, admin, editor, user, viewer), so you can say precisely who may edit and who may only use, and the same grounded, scoped agent deploys as a job or as a custom app under those same roles. An agent with no owner drifts: its knowledge base goes stale, a run starts failing, and nobody is accountable to notice. L5 is the rung where every agent has a home.
How to use the model
Place yourself honestly, then climb one rung at a time. The most common mistake is trying to jump from L1 to L4 — buying “AI that runs your operations” before the team has grounded a single answer or scoped a single agent — which is how organizations end up with unattended automations nobody trusts. The ladder is sequential for a reason: each rung’s governance is the prerequisite for the next rung’s capability. You cannot safely run an agent unattended (L4) if you have not first bounded its scope and gated its actions (L3), and you cannot bound scope meaningfully if its answers were never grounded and checkable (L2).
Two levels are worth naming as the ones that pay for the whole climb. L2 to L3 is the leap from AI that tells you things to AI that does things, and it is where governance stops being a data-privacy question and becomes an approval-and-scope question. L3 to L4 is the leap from attended to unattended, where a run history stops being nice-to-have and becomes the only thing standing between you and an audit you cannot answer. Get those two transitions right — with real governance, not a promise of it — and L5 is a matter of coverage, not a matter of risk.
Frequently asked questions
What is the enterprise AI maturity model? A five-level framework describing how an organization’s AI use progresses: L1 personal copilots, L2 grounded team chat, L3 scoped agents that act, L4 scheduled and event-driven jobs, L5 governed agentic operations. Each level adds a capability and the governance that capability requires.
What are the levels of AI maturity? Five: personal copilots (private chat assistants), grounded team chat (answers from your documents, cited), scoped agents that act (bounded actions with human approval), scheduled and event-driven jobs (unattended runs with a run history), and governed agentic operations (many owned, role-scoped agents across teams).
Why does each maturity level need governance, not just capability? Because capability without governance is a larger blast radius, not a better tool. An agent that can act needs approval and scope; an agent that runs unattended needs a run history. Each rung’s governance is the prerequisite that makes the next rung’s capability safe to rely on.
How do I know which AI maturity level my organization is on? Ask what your AI actually does. Only chatting is L1; answering from your own documents with citations is L2; taking bounded actions with approval is L3; running unattended on a schedule or trigger is L4; many owned, role-governed agents across teams is L5.
What is the hardest transition in the AI maturity model? Usually L3 to L4 — moving an agent from attended to unattended. It is where a durable run history and inherited scope stop being optional, because once no human watches a run in the moment, an auditable log is the only thing that makes the work trustworthy.
Where does Insulin fit on the maturity model? Insulin supports the climb across all five levels: chat at L1 (with no training on your data), cited knowledge bases at L2, scoped agents with approval at L3, scheduled and event-driven jobs with run history at L4, and role-based access across agents, jobs, and custom apps at L5.
Takeaways
- Enterprise AI adoption is a ladder, not a switch: five levels from personal copilots (L1) to governed agentic operations (L5), each pairing a new capability with the governance it requires.
- The two axes move together. Capability without governance is a larger blast radius — an agent that can act needs approval and scope; an agent that runs unattended needs a run history you can audit.
- Climb one rung at a time; each rung’s governance is the prerequisite for the next rung’s capability. Jumping from L1 to L4 is how you get automations nobody trusts.
- The transitions that pay off are L2→L3 (from telling to doing, gated by approval and scope) and L3→L4 (from attended to unattended, backed by a durable run history).
- The model is vendor-neutral, but Insulin supports every rung today: cited chat and knowledge bases, scoped agents with approval, scheduled and event-driven jobs with run history, and role-based access across agents, jobs, and custom apps.
Place your organization on the ladder, then climb deliberately: ground your team’s answers with knowledge bases, give a scoped agent its first approved action, and let the same agent run unattended as a scheduled or event-driven job with a run history you can audit. When you are ready to see the rungs in one place, try Insulin.
Stay Updated
Get the latest Cloud GTM insights, product updates, and marketplace strategies delivered to your inbox.