An analyst receives a suspicious email and asks an AI assistant to examine its headers. The response identifies an IP address, describes signs of phishing and recommends immediate blocking. The explanation sounds coherent. But the address belongs to a shared relay: applying that recommendation without establishing the target’s role could interrupt legitimate communications.
The problem begins when an answer becomes a decision. A useful explanation establishes neither that the target is correctly identified, that the proposed intervention is proportionate, nor that its author has authority to initiate it.
What I call level 1
In my maturity scale for AI use, level 1 describes a one-off interaction: a person makes a request, assesses an answer and maintains continuity of the work. This framework examines an activity and its responsibilities. It is not a certification standard.
The level is not defined by a product lacking a memory feature. An assistant may retain preferences or retrieve earlier conversations without holding qualified business context for the operation at hand. The relevant questions concern information actually available, its provenance and its validity for the decision.
A one-off response may be sufficient to rephrase a paragraph or explore a hypothesis. When it supports a change to an information system, the conditions under which it will be used need examination.
One address, different consequences
An address in email headers may identify a relay, shared infrastructure or a system actually controlled by an adversary. Its presence in a message does not settle those alternatives.
Before deciding to block it, the analyst needs to establish its role in the message route, compare indicators with appropriate sources and identify services depending on the target. The analyst also needs to know the scope of their authority, intervention conditions and how to reverse a change if its effects become undesirable.
An apparently good answer does not replace establishing the target’s role or obtaining authority to act on it.
AI can help organise questions and compare available evidence. Missing information must remain visible. Converting it into a silent assumption makes a recommendation smoother while making the decision harder to examine.
What the next levels need to contribute
Level 2 business context describes the environment, resources and constraints. Level 3 reusable methods formalise expected checks. Level 4 controls need an observable result and an explicit account of what they can block. Level 5 coordination organises responsibilities and recovery across tasks or agents.
These capabilities address different needs. Their presence does not guarantee a correct analysis, and not every task requires automation. A written procedure can be skipped; a control may cover only one path; several agents can share the same incorrect source.
Level 6 therefore asks how action is controlled: which authority remains valid at execution, which conditions are actually checked before the effect, and which evidence allows the decision to be examined afterwards? My work on Swarm addresses this transition from proposed reasoning to governed execution.
Assessing maturity through actions
For the phishing case, counting generated answers is insufficient. Investigators should be able to recover the indicators used, uncertainties retained, selected target, human or technical decision and observed result of the intervention. Choosing not to block may be justified; rapid blocking may be a mistake.
The purpose of this scale is to make those differences visible. Maturity should be assessed through the ability to support a decision and control its consequences within a defined scope.
References: original article, 2 April 2026, context engineering, reusable Agent Skills.