Grade the Deployment, Not the Organization

Every instrument in OMB M-25-21 that carries consequences is attached to a use case, not to an agency. The high-impact determination is made per use case. The AI Impact Assessment is completed before deploying each high-impact use case and signed by the individual accepting that use case’s risk. A waiver is granted for a specific covered AI application after a system-specific and context-specific risk assessment. And the memo’s only hard stop reads: if a particular high-impact use case is not compliant with the minimum practices, the agency must safely discontinue use of the AI functionality.

Nothing in the memo says “this agency is at level two, so it may deploy level-two things.” The agency-level obligations (a Chief AI Officer, a governance board, a strategy, a compliance plan) are about capability to govern. Permission to run a given system comes from that system’s own assessment. The same split has been the spine of federal security for two decades: SP 800-37 authorizes a system inside a defined boundary, and no agency has ever held an ATO for itself.

The Governed Autonomy Maturity Model does it the other way around.

What the Maturity Model says

Three levels. Level 1, Identified: agents are inventoried, owned, credentialed, mission-scoped, with basic logging; the page calls this a defensible operational posture. Level 2, Governed: runtime enforcement, cross-system policy, human oversight interfaces; the page says that at Level 2 the gap identified in the Declaration is closed. Level 3, Continuous: every handoff type (delegation, orchestration, tool invocation, subagent spawning) explicitly governed, drift detection, full forensic reconstruction. The closing rule: never deploy agents beyond your current governance maturity.

Each level is mapped to Laws. Level 1 to Law 1. Level 2 to Laws 2, 3 and 5. Level 3 to all five, which means Law 4, Trust Does Not Travel, arrives only at Level 3.

Now hold that next to the Laws page, which presents the five Laws as what must be true for any governed agent, and to Law 4’s own scope, which names tool invocation as a handoff. A Level 2 organization running a tool-using agent is, by the Maturity page, governed. By Law 4, one of the five things that must be true of any governed agent is not required of it. Both pages are current doctrine. They cannot both be right.

This is not a wording slip. It is what happens when one number is asked to do three jobs: describe how far an organization has come, certify which controls are in place, and license what may be deployed. The proposed conformance layer makes the third job explicit, binding Level 1 to Tier 1 actions, Level 2 to Tier 2, Level 3 to Tier 3, and states that levels are sorted by implementation cost rather than by risk. Sorting by cost is the right thing for a maturity model to do. It is the wrong basis on which to license an irreversible action.

Why the federal instrument is better

Grading the deployment does three things a level cannot.

It puts the consequence where the risk is. A benefits-adjudication agent and a document-summarization agent in the same agency, at the same organizational maturity, do not deserve the same license. M-25-21’s presumed high-impact list is a list of use cases, not of agencies, because the memo’s authors understood that the same organization runs both kinds.

It makes the Laws invariant. If the Laws bind every governed deployment, then a deployment that involves handoffs must satisfy Law 4 regardless of what level the organization has reached, and an organization that cannot yet satisfy Law 4 may only run deployments in which there are no handoffs to govern. That is a coherent position. “Governed at Level 2 without Law 4” is not.

It makes evidence the currency. The CISA and NSA guidance recommends, in its introduction, that agentic AI be used only for low-risk and non-sensitive tasks. Read against a maturity model, that sounds like a ceiling on the organization. Read against a per-deployment grade, it is simply the starting tier, and the way out of it is evidence about a specific system: what it can reach, what it did under adversarial input, whether its stop path worked under load. Autonomy expands one use case at a time, and every expansion has a signature on it.

Three instruments instead of one

The structure we think the doctrine should move to, and that a federal program can adopt today without waiting for it, separates the three jobs.

A deployment baseline. The Laws, restated as invariants of any governed deployment: the agent is an identity, enforcement happens at runtime outside the agent, governance spans every system the deployment touches, no authority is inherited across a handoff, a human can prevent or halt at the stakes the deployment carries. Non-waivable. If a deployment cannot meet one, it is not governed, whatever the organization’s level.

A use-case assurance profile. For each deployment: the action classes it may take (pre-authorized, consequential requiring authorization before commit, prohibited), the evidence that each class is actually bounded, the recovery capability measured end to end rather than as detection latency alone, and a named risk acceptor. This is the AI Impact Assessment with runtime teeth. It is assessed the way SP 800-53A assesses anything: stated method, preconditions, sample, evidence retained.

An organizational maturity measure. How consistently the agency operates and improves those capabilities across deployments. Useful for planning and budget. Not a license.

Under this structure the Maturity Model keeps its levels and loses one sentence: the one that says the gap is closed at Level 2. The gap closes per deployment, when that deployment’s profile is met, and the level tells you how many deployments the organization can carry.

What it means for an agency now

An agency does not have to wait for the doctrine to resolve this. It already has the instrument. The high-impact determination, the impact assessment, the signed risk acceptance and the discontinuation rule are per use case, and an agentic deployment is a use case. Attach the Laws to the assessment as invariants, add the action-class profile and the measured recovery capability, and the agency has a per-deployment grade that cites the doctrine and satisfies the memo.

What it should not do is read a maturity level as permission. The doctrine’s own Laws say it is not, even where the doctrine’s Maturity page says it is.