Use the highest level consistently supported by evidence, including earlier levels. If evidence is unknown, select Exploratory and record the gap.

01 / Strategy and scope

Is the workflow bounded, connected to a business outcome and owned?

Evidence: Workflow charter, exclusions, accountable sponsor and baseline.

02 / People and operating model

Are decision rights, reviewer capacity and exception ownership explicit?

Evidence: Responsibility map, staffed escalation and training evidence.

03 / Data readiness

Can the team demonstrate authorized, current and fit-for-purpose context?

Evidence: Data inventory, access tests, quality checks and retention rules.

04 / Architecture and integration

Are tool actions constrained independently of model instructions?

Evidence: Boundary diagram, scoped adapters and denied-action tests.

05 / Governance and assurance

Is approval supported by repeatable evaluation and change control?

Evidence: Agent register, approval record, evaluation results and change log.

06 / Security and risk

Have abuse paths and consequential actions been tested and bounded?

Evidence: Threat model, adversarial results, least privilege and accepted risks.

07 / Operations and reliability

Can operators detect, contain and recover from a failed action?

Evidence: Service objectives, sampled traces, incident exercises and rollback.

08 / Value realization

Are outcomes and total costs compared with a credible baseline?

Evidence: Quality measures, rework, cost ledger and benefits ownership.