[
 {
  "id": "sf",
  "name": "Salesforce Agentic Maturity Model",
  "short": "Salesforce",
  "publisher": "Salesforce",
  "date": "2025-04-10",
  "url": "https://www.salesforce.com/news/stories/agentic-maturity-model/",
  "rates": "the agent's use case",
  "kind": "vendor article",
  "licence": "Salesforce's; quoted briefly with the source",
  "read": "2026-11-09",
  "caveat": "A vendor's news story with no scoring rubric. Its lists of how to advance are advice, not tests."
 },
 {
  "id": "eaamm",
  "name": "Enterprise Agentic AI Maturity Model (EAAMM)",
  "short": "EAAMM",
  "publisher": "S. Emelyanov, ICAIMT 2026",
  "date": "2026-04-22",
  "url": "https://www.icaimt.com/2026/agentic-ai.html",
  "rates": "the agent's use case",
  "kind": "conference paper",
  "licence": "the author's; quoted briefly with the source",
  "read": "2026-11-09",
  "caveat": "One author; a convenience sample of 136 who rated themselves. Its five levels are the five user roles of Feng, McDonald and Zhang, Levels of Autonomy for AI Agents (arXiv 2506.12469), which we have not yet read at source."
 },
 {
  "id": "owasp",
  "name": "State of Agentic AI Security and Governance 2.01",
  "short": "OWASP",
  "publisher": "OWASP GenAI Security Project",
  "date": "2026-06-01",
  "url": "https://genai.owasp.org/resource/state-of-agentic-ai-security-and-governance/",
  "rates": "the deployed agent (tier) and the organisation (governance)",
  "kind": "open report",
  "licence": "CC BY-SA 4.0",
  "read": "2026-11-10",
  "caveat": "Its matrix is described by OWASP as a self-assessment and roadmapping tool, not a binding compliance verdict."
 },
 {
  "id": "mcp",
  "name": "Model Context Protocol, Authorization (draft)",
  "short": "MCP authorization",
  "publisher": "Model Context Protocol project",
  "date": "draft, read 2026-11-09",
  "url": "https://modelcontextprotocol.io/specification/draft/basic/authorization",
  "rates": "the agent's published endpoint",
  "kind": "protocol specification",
  "licence": "the project's; requirements quoted with the source",
  "read": "2026-11-09",
  "caveat": "A draft page. Fifteen requirements chosen by us as a first cut, not the whole specification. It applies only where an endpoint of this kind is published."
 },
 {
  "id": "aagmm",
  "name": "Agentic AI Governance Maturity Model (AAGMM)",
  "short": "AAGMM",
  "publisher": "V. Acharya, arXiv 2604.16338",
  "date": "2026-03-13",
  "url": "https://arxiv.org/abs/2604.16338",
  "rates": "the organisation",
  "kind": "preprint",
  "licence": "CC BY-NC-ND 4.0: cited by domain name only, not adapted",
  "read": "2026-11-09",
  "caveat": "One independent author; validated by simulation (750 runs), not in production. Only its twelve domain names are used here."
 },
 {
  "id": "ms",
  "name": "Agentic AI adoption maturity model",
  "short": "Microsoft",
  "publisher": "Microsoft Learn",
  "date": "read 2026-11-09",
  "url": "https://learn.microsoft.com/en-us/agents/adoption-maturity-model/",
  "rates": "the organisation",
  "kind": "vendor guidance",
  "licence": "Microsoft's; quoted briefly with the source",
  "read": "2026-11-09",
  "caveat": "A self-assessment that refers to Microsoft products. The 88 items are the bullets of its quick reference table, as the page served them."
 },
 {
  "id": "nist",
  "name": "AI Risk Management Framework 1.0, subcategories",
  "short": "NIST AI RMF",
  "publisher": "NIST",
  "date": "2023-01-26",
  "url": "https://airc.nist.gov/airmf-resources/playbook/",
  "rates": "the organisation and the AI system",
  "kind": "framework",
  "licence": "a United States government work; freely reusable",
  "read": "2026-11-10",
  "caveat": "About AI in general, not agents. The 72 subcategories are taken from NIST's playbook data file."
 },
 {
  "id": "aiact",
  "name": "Regulation (EU) 2024/1689 (the AI Act), selected articles",
  "short": "EU AI Act",
  "publisher": "European Union",
  "date": "2024-06-13",
  "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
  "rates": "the AI system, its provider and its deployer",
  "kind": "law",
  "licence": "EU law; freely reusable",
  "read": "2026-11-10",
  "caveat": "Eleven articles chosen by us, by title only. Most bind only for high-risk systems. A later amending regulation exists and is not reflected. This is not a legal reading."
 }
]