Microsoft publishes the Agentic AI Adoption Maturity Model to help organizations reason about the organizational readiness to adopt AI agents — governance, data posture, talent, identity, integration, and operations. CARL and Microsoft's model answer different questions. They are meant to be used together.
The short version
- Microsoft's model → "Is our organization ready to adopt AI agents at scale?"
- CARL → "Is this codebase ready for AI agents to work on it?"
You can be organizationally mature and have L0 Manual codebases (common in enterprises with significant legacy). You can be organizationally early and have L2 Tested codebases (common in agent-native startups). The two axes are largely independent.
What Microsoft's model covers that CARL doesn't
- Organization strategy — policy for agent use, risk appetite, procurement, governance.
- Data posture — data classification, retention, access control for training and fine-tuning.
- Talent — hiring, training, role design for teams that build and operate agents.
- Identity and access — how human and agent identities are managed across systems.
- Responsible AI — bias mitigation, safety reviews, incident response for AI systems.
These are organizational capabilities. Measuring them requires surveys, interviews, policy reviews — not file inspection.
What CARL covers that Microsoft's model doesn't
- Codebase artefacts — presence and quality of README,
AGENTS.md, ADRs, runbooks. - Enforcement mechanisms — linters, type checkers, pre-commit hooks, CI gates.
- Test posture — coverage, E2E journeys, flake handling.
- Runtime signals — logs, traces, errors, metrics, SLOs.
- Delivery substrate — CI feedback time, rollback mechanisms, DORA metrics.
- Security substrate — branch protection, secret scanning, CODEOWNERS, dependency hygiene, SBOMs.
These are file- and configuration-level artefacts. Measuring them requires a tool that reads a repository.
Where the two overlap
Both frameworks acknowledge that:
- Adoption is staged, not binary.
- Process maturity matters, not just tool choice.
- Organizational alignment affects technical outcomes and vice versa.
Both frameworks recommend starting where you are, measuring, and targeting the next stage deliberately.
Using them together
A realistic adoption roadmap uses both:
- Assess the organization against Microsoft's model to understand your strategic posture and gaps.
- Assess your codebases against CARL to understand which repositories are ready for agents today and which need investment first.
- Prioritize investment accordingly. If your organization scores well but your codebases are mostly L0 Manual, the highest-leverage work is on the codebase side — agent adoption is gated by codebase readiness, not by organizational readiness. The reverse can also be true.
- Re-assess on a cadence. Both frameworks benefit from periodic measurement — CARL recommends 90 days or on substantial infrastructure change.
Are they both "maturity models"
Yes, but in different senses. Both use the staged-maturity form that originates with CMMI. Microsoft's model is an organizational self-assessment. CARL is a machine-checkable codebase assessment with a reproducible report.
Neither is a certification. Neither requires licensed appraisers. Both benefit from honest use.
Related
- CARL vs. CMMI — the structural ancestor of both frameworks.
- Guides: Getting to Level 2 — the technical substrate work to raise codebase readiness.
- Governance — how CARL is published and maintained.