All resources · Frameworks · Open
SDLC Automation Maturity Model
Four levels we use to describe a delivery path, from private ritual to a path a new team can join. A description, not a league table.
Updated October 22, 2026
Cross-industry · Banking · Agencies
Teams ask where they sit. This model is a shared vocabulary for that conversation. It describes practices on one class of change, for one team. It does not say what percentage of firms sit at a level, because we are not publishing that.
Automation here means the path from a decision to production carries its own evidence. An agent that opens a pull request can live at any level. An agent that approves its own release is a missing control at every level.
The four levels
1 — Manual
The path lives in people’s heads and in chat.
- Environments are prepared by hand, and only a few people can do it.
- The link between ticket, commit, and deploy is reconstructed after the fact.
- Approval is a message, not a record tied to an artifact.
2 — Assisted
Some steps are scripted. The scripts are private.
- A pipeline exists, and teams still keep a side door for the changes that matter.
- Test evidence is available to the person who ran the job, not to the person who must explain it later.
- AI help, if any, drafts text. It is not on the approval.
3 — Repeatable
Ordinary changes take one path, and the path leaves evidence.
- The share of changes that use the path is known, because someone counts it.
- Rollback is a documented action, and it has been tried.
- Reviewers see the diff and the evidence, not a model’s summary standing in for either.
4 — Operated
The path is production, with an owner.
- The pipeline has an owner, a change process, and a way to tell that it is wrong.
- A new team can ship an ordinary change without a private orientation.
- Secrets, customer fixtures, and cardholder data are not in vendor traces. Someone checked.
How to place a team
Place the team at the lowest level where a practice is still missing. Do not average. A repeatable pipeline with no owner is not operated. Write the placement next to the baseline you are willing to measure: lead time, failed deployments, and the share of changes on the path. ISO 27001 change control and PCI DSS separation of duties, where they apply, are satisfied by the record, not by the level’s name.