Teams improve AI outcomes faster when they know where they are and what the next level requires—not when they buy another copilot. Skipping levels is tempting: leadership wants “Level 5 analytics” while the organization is still at ad hoc chat with no shared eval. The result is expensive tools on top of vibe prompting, then a board question you cannot answer with metrics.
This ladder names five levels, gives honest self-checks, and proposes one 90-day jump at a time. Use it with 10 signs your company is vibe prompting for diagnosis and governance roles when you reach governed scale. If you are debating another model purchase while at Level 1, read your company does not need more AI tools before the invoice is approved.
The hero diagram shows a related idea at prompt-input maturity (primitive vs structured prompts producing inconsistent vs predictable outputs). That is not the same as organizational maturity in the table below—but teams at Level 1 often confuse better wording with a better system. Use the ladder for org artifacts (owners, eval, logs); use Chaos vs Control Prompting when the gap is input design.
How to assess honestly
Anecdotes are not evidence. For each level, ask for artifacts, not enthusiasm.
- Can you name one workflow ID and its owner—not “we use ChatGPT”?
- Is there an eval pass rate or only demo stories?
- Can you replay a case from logs without asking who prompted what?
- Did Legal or IT approve data boundaries, or only a team lead?
If artifacts are missing, you are likely at the lower level—even if spend is high. Northline B2B rated themselves Level 2 during copilot hype; audit of ticket #4821 proved they were Level 1 until registry, eval, and RACI existed.
Pick one level jump per quarter. Document the target in the risk register; measure at ninety days. Do not announce “AI transformation” without a workflow metric tied to business outcomes.
Level 1 — Ad hoc
Individuals use chat tools without shared standards. Success is personal: a strong operator gets strong drafts; the next hire does not. Leadership hears anecdotes in steering meetings, not pass rates or override counts. IT sees shadow integrations; Legal is engaged only after a scare.
Self-check: No shared prompt library; no workflow ID in logs; no eval set; “everyone owns AI” means no incident owner.
What good looks like (not yet): You are building awareness that chat is not the system—see the model is not the system.
90-day move: Run the vibe prompting diagnostic; pick one pilot workflow with a named process owner and a single metric (e.g., tier-2 draft acceptance rate). Pause net-new tool purchases until that workflow has a canvas on the workflow template.
Level 2 — Repeatable pilots
One or two workflows have templates and informal review. Pilots work in one team; they break when staff rotate or when policy packs change without notice. Context may live in side documents; prod might still load prompts from memory.
Self-check: Pilots exist but versions are not pinned; eval is manual or skipped under deadline; boundaries are prompt-only, not connector-enforced.
What good looks like: Same workflow produces similar quality across two operators on the same case fixture.
90-day move: Document context spec and eval set for the pilot; assign owners in RACI; introduce evaluation hooks smoke gate in CI for prompt changes.
Level 3 — Operational workflows
Workflows have versioned prompts, integrations, and defined handoffs. You can replay a case from audit trails; changes go through a named approver and registry row. Overrides are logged and reviewed weekly.
Self-check: workflow_id and workflow_version appear in logs; prod prompt pin matches registry; eval pass rate reported to forum monthly.
What good looks like: Promotion is blocked when smoke fails; near-misses become new eval cases within a week.
90-day move: Add data boundaries matrix enforced in integration layer; link audit schema to structured prompt system releases; start monthly risk review cadence.
Level 4 — Governed scale
Policy, data boundaries, and risk review apply across multiple workflows—not only the first pilot. Governance roles are staffed; incidents trigger process updates with owners and due dates. Tool sprawl is challenged in forum; new connectors require matrix updates.
Self-check: Risk register lists workflow × risk × mitigation; forum minutes show decisions, not demos only; mean time to process update after incidents is tracked.
What good looks like: Second workflow launches by cloning governance pattern, not reinventing it.
90-day move: Quarterly deep dive on retention and classification; reduce duplicate copilots; tie workflow KPIs to outcome mapping article practices.
Level 5 — Continuous improvement
Metrics drive prompt, context, and model changes; regression tests block bad deploys. Model swaps are routine with eval gates—not emergency firefighting. Business outcomes tie to workflow KPIs; leadership questions pass rates and customer impact, not only license utilization.
Self-check: Regression in eval blocks release; shadow traffic changes require forum vote; outcome metrics reviewed alongside pass rate.
What good looks like: You can explain what improved last quarter without mentioning a new model name first.
90-day move: Benchmark outcome metrics per workflow; invest in eval coverage for denial paths and policy changes; mentor another business unit through Level 2→3 using the same canvas and registry patterns.
Pick one jump (Level 2 → 3 example)
Many readers sit at Level 2. A realistic ninety-day program:
Days 1–30: Canvas + context spec + twenty-case eval set; registry row in dev only.
Days 31–60: Smoke in CI; pilot at bounded traffic; weekly pass rate to owner.
Days 61–90: Audit schema complete; first monthly risk forum with decision log; prod pin with changelog.
Success criteria: replay drill passes on three tickets; pass rate ≥ agreed threshold for four consecutive weeks; no promotion without eval link in registry.
Anti-patterns on the ladder
- Buying Level 5 tools at Level 1 behavior — analytics on ungoverned chats.
- Skipping eval to “move fast” — fast to customer incident.
- Declaring governance with a PDF — no RACI, no forum, no logs.
- Level inflation in steering decks — call Level 3 only when artifacts exist.
Where memory and context fit
Level 3+ requires explicit memory types and context architecture choices—not bigger windows alone. Level 4+ requires boundaries and retention aligned with audit policy.
The ladder is a map, not a badge. Honest placement saves quarters of rework—and keeps the model in its proper place inside the system around it.
