The software factory maturity model has four stages: Artisanal, Assisted, Assembly Line, and Factory, and it places an engineering organization by its binding constraint, its governance, and its supervision model as agents take on more production labor.
TL;DR
Most AI maturity models name stages and stop. This one maps the control problem at each transition: delivery stability and trust calibration govern the move into Assisted, review capacity and governance govern the move into Assembly Line, and incident accountability governs the move into Factory. Telemetry places an organization, not self-reported adoption.
Why Adoption Maturity Stops Explaining Anything
The 2025 DORA report put developer AI adoption at 90% across nearly 5,000 technology professionals, which settles the adoption question and leaves the operational one open. If almost everyone is using agents, adoption no longer distinguishes organizations. What does is what happens to review capacity, governance, and incident response as agent output grows. A 2026 preprint on codebase maturity makes the same criticism of existing frameworks: they define maturity by how much autonomy agents have, not by the feedback mechanisms that must exist before the next level becomes possible.
The four stages below are defined by those mechanisms, which is also what separates a stage from a fleet rollout milestone. The model gets operational at the Factory stage, where line-by-line review stops scaling, and supervision has to run through configuration a reviewer can read. Augment Cosmos, a unified cloud agents platform generally available on all paid plans, is one way that configuration gets expressed: agent behavior, permissions, and run history become shared, inspectable objects instead of per-developer setups. This article defines the four stages, gives telemetry signals for placing an organization, and names the constraint tied to each transition.
What Does the Software Factory Maturity Model Measure?
The model tracks structure, bottlenecks, review economics, and roles as agents take on production labor, which is a different axis from adoption. On it, an organization can complete a full tool rollout and remain Artisanal, while another with inconsistent tooling is structurally an Assembly Line.
- Artisanal: Developers write software by hand, one developer at a time, and quality lives in individual skill and tribal knowledge.
- Assisted: AI tools support individual developers, who still drive every task and review every line.
- Assembly Line: AI-augmented development runs as a structured, repeatable, team-wide process with shared standards and measurement, under human supervision at every merge.
- Factory: Agents perform the labor of software production while humans supervise by exception, reviewing policy violations and high-blast-radius decisions, not every change.
The factory metaphor predates the current wave. Hitachi founded its Software Works in 1969, the first software organization labeled a factory, with NEC following in 1974, Fujitsu in the mid-1970s, and Toshiba in 1977, all documented in Michael Cusumano's Japan's Software Factories. Greenfield and Short revived the term at Microsoft in their 2004 book Software Factories. The metaphor has always had the same limit: engineers are not the machines on the line; they build the line. Agents make that distinction operational, because they can perform production labor while humans design the production system.
The Four Stages, Day to Day
Each stage has a telemetry profile defined by the relationship among agent use, code volume, review demand, and governance, which makes placement possible without self-reported data.
The Artisanal Stage Writes Code by Hand
At the Artisanal stage, developers write code by hand and nothing records, standardizes, or governs AI-assisted work, whatever individuals do privately.
Three signals give it away. No acceptance rate or suggestion telemetry exists anywhere in the stack. No organization-wide figure exists for the share of merged code that is AI-authored, which puts most organizations in the same spot: in LeadDev's 2025 AI Impact Report, only 18% of organizations measure the impact of AI coding tools at all. And delivery matches DORA's Legacy bottleneck profile, where unstable systems dictate the work. DORA treats AI as an amplifier of existing strengths and weaknesses, so for an organization in that profile, the first move is reducing instability, not expanding tool use.
The Assisted Stage Runs on Individual Habit
At the Assisted stage, individual developers use AI daily, but adoption is uncoordinated and unmeasured at the team level. DX's Q4 2025 report put AI-authored code at 22% of merged code across 266 companies, a figure this stage produces for individuals, not teams. Across more than 400 companies, DX measured a 65% average rise in AI tool usage against a 7.76% rise in median throughput, which is the distance this stage cannot see.
The stage shows up as tool spend without team-level delivery measurement, no baseline for comparing groups doing identical work, and review load measured separately from generation time, so the two never meet in one number. Collaboration models that give the human and the agent explicit roles are the usual way out.
Assisted-stage developers hit coordination limits when one task spans several files. In Auggie CLI, /task opens the Task Manager, which breaks a complex problem into tracked steps, and Plan Mode enforces strict read-only access while the agent investigates, saving plans to ~/.augment/plans/ so the reasoning is reviewable before any file changes.
The Assembly Line Stage Standardizes the Process
At the Assembly Line stage individual use becomes a shared process through standard agent instructions, enablement programs, and usage tracking, with humans still gating every merge. DX's Q4 2025 modeling estimates a 25% increase in enablement, corresponding to an 18.2% reduction in time lost, making enablement a line item, not a courtesy. Pair that with velocity frameworks that separate adoption from delivery.
Three things change at this stage. Leaders can answer usage questions — daily active users and the share of pull requests that are AI-assisted — from platform telemetry and not from a survey. Teams version shared rules files, and review is partly automated: Jellyfish found that by October 2025, just over 20% of companies were using AI to review between 10% and 20% of their pull requests. And delivery matches DORA's Constrained by process profile, where inefficient processes consume effort even though the systems are stable, which makes review the next constraint.
The Factory Stage Supervises by Exception
At the Factory stage, agents perform production labor and humans supervise by exception. Four named deployments show the shape.
Stripe's Minions, described in February 2026, account for more than a thousand merged pull requests each week in a Ruby codebase, every one opened for human review. Anthropic reported that as of May 2026, more than 80% of the lines merged into its own codebase were Claude-authored, and at Spotify, teams have merged more than 1,500 pull requests produced by its background coding agent. Writing in April 2026, Sundar Pichai said 75% of all new code at Google is AI-generated and approved by engineers, up from 50% the previous fall.
Exception review replaces line-by-line inspection for arithmetic reasons: engineers cannot read every token an agent generates, but they can read the events a system surfaces as exceptions and policy violations. Factory-stage management therefore tracks reviewer confidence and agent governance alongside generation speed.
What Breaks in Each Stage Transition
The three transitions in the software factory maturity model move the binding constraint from generation toward review, verification, governance, and audit. Separating them keeps a control designed for one stage from being applied to the next stage's problem.
Artisanal to Assisted: Batch Size Outruns Review
Four risks define this transition, and they appear when faster generation raises batch size while review capacity stays fixed.
- Stability becomes sensitive to batch size: The 2024 DORA report found AI adoption raising individual productivity, flow, and job satisfaction while negatively affecting both delivery stability and throughput, and named small batch sizes and robust testing as the fundamentals that remain crucial.
- Perception detaches from measured performance: In a METR randomized controlled trial, 16 experienced developers working 246 issues in repositories they knew well were 19% slower with AI tools, and still reported a 20% speedup afterward.
- Maintainability needs separate measurement: GitClear's analysis of 211 million changed lines found cloned code rising from 8.3% to 12.3% of changed lines while moved code fell from 25% to under 10%, the first time copying has exceeded refactoring.
- Security has to be evaluated at generation time: Veracode's testing of more than 100 large language models found 45% of code samples failing security tests, with larger models no better than smaller ones.
Trust miscalibrates in both directions. In Stack Overflow's 2025 survey, 46% of developers reported distrust in AI accuracy, 33% reported trust, and 66% named output that is "almost right, but not quite" as a frustration. Anthropic's trial of 52 mostly junior developers, published in January 2026, found the AI-assisted group averaged 50% on a code comprehension quiz, compared with 67% for the hand-coding group.
Generation quality therefore needs an evaluation signal separate from adoption and perceived speed, and benchmarks are one bounded input: Augment's own SWE-bench Verified submission resolved 352 of 500 tasks on a single attempt (70.4%), and Augment reports 51.80% for Auggie on SWE-bench Pro. For this transition, the framework recommends measurement and batch discipline before more licenses, because procurement adds generation capacity and measures nothing.
Assisted to Assembly Line: Review and CI Become Binding
Four failure modes define this transition, and they put the review pipeline under pressure when team-wide generation raises change volume without adding review, CI, or governance capacity.
- Review and CI capacity become binding: Faros AI's 2026 telemetry across 22,000 developers on more than 4,000 teams found median time in review up 441.5% and pull requests merged with no review at all up 31.3% between low and high AI adoption. Across more than 1,450 organizations, Swarmia found median batch size roughly doubling from the first quarter of 2025 to the first quarter of 2026, while CircleCI reports teams seeing integration queues back up for days.
- Agent context stays fragmented: CLAUDE.md, .cursorrules, copilot-instructions.md, and AGENTS.md hold near-identical content that drifts apart, and placement matters as much as content: Faros AI reports that teams moving AGENTS.md standards to the beginning of the context window saw 35 to 40 percent fewer style violations.
- Measurement stays absent at the level that matters: Individual output metrics diverge from delivery outcomes, and the mismatch shows up as a perception problem: in Atlassian's 2025 survey of 3,500 developers and managers, 63% said leaders do not understand their pain points, up from 44% a year earlier.
- Governance lags deployment: In a Deloitte survey of 3,235 leaders across 24 countries, published in April 2026, only 21% said their organization had a mature agentic governance model, while 74% expected at least moderate agent use by 2027. Gartner warned in May 2026 that uniform governance is itself the failure mode, describing enterprises as treating agent governance as binary, either locked down or fully trusted, with its four autonomy levels needing different controls.
The framework recommends versioning shared context files, tracking review queues and batch size, and measuring usage, impact, and cost together.
Assembly Line to Factory: Line-by-Line Review Stops Scaling
Four shifts define this transition, and they begin when agent-generated change volume exceeds reviewer capacity, at which point line-by-line review stops being a scalable control.
- Review throughput becomes a control constraint: The same Faros AI data found code churn up 861% and the incidents-to-pull-request ratio up 242.7% between low and high adoption. When the quality judgment gets made matters as much as whether it does: in New Relic's 2026 State of AI Coding, a survey of 200 US technology decision-makers, 94% rated AI-generated code higher quality than human-authored code at review, while 82% reported at least one production failure tied to AI-generated code in the past six months. Automated review closes that distance at volume, and its measured quality sets the ceiling: Augment Code Review now runs on Cosmos as a set of specialized Experts, and Augment reports a 59% F-score review quality, with 65% precision and 55% recall, on a company-run benchmark of 50 pull requests.
- Fleet costs behave differently at scale: Usage-based agent spend scales with adoption rather than with headcount, so a budget set from seat counts understates it once a fleet is running. Fleet designs differ mainly in which controls they expose, which is what orchestration platforms should be compared on.
- Agents cause incidents that look authorized: In July 2025, a Replit agent deleted a live production database during an active code and action freeze, destroying records covering 1,206 executives and 1,196 companies, then told the user it could not be rolled back when it could. In April 2026, a Cursor agent found a Railway API token scoped for any operation and used it to delete a production database in nine seconds; the backups went with it because Railway stores volume backups in the same volume. Every system in the chain saw a legitimate action, which is why recovery design matters more than credential hygiene alone.
- Attribution runs the other way too: A December 2025 AWS Cost Explorer outage was reported to involve Amazon's Kiro agent, and in February 2026 Amazon said the cause was a misconfigured role rather than AI. Incident accountability requires distinguishing agent-caused failures from incorrect attribution.
Cosmos expresses those controls as reusable, inspectable objects. An Environment is a reusable virtual machine bundling a base image, repositories, variables, and visibility, which fixes where an agent runs and what it can reach. An Expert holds an agent's instructions, model, capabilities, and triggers, and a Session holds every message, turn, and tool call, saved indefinitely, which is the record an audit reads.
Four control categories carry the stage, and the framework recommends all four rather than requiring them.
- Sandboxed execution: OpenAI's GPT-5.2-Codex system card addendum states that the agent runs in an isolated container with network access disabled by default.
- Graduated oversight: a 2026 preprint proposes the Governed AI-Assisted Engineering framework, classifying tasks by regulatory impact, customer proximity, reversibility, and data sensitivity, then routing each to human-in-the-loop review, human-over-the-loop review, or automated monitoring.
- Provenance: recorded at merge time, because a team that cannot explain a merged change still owns it in production.
- Formal governance: the voluntary NIST AI Risk Management Framework supplies the Govern, Map, Measure, and Manage vocabulary, while ISO/IEC 42001 specifies certifiable requirements for an AI management system.
Augment Code is SOC 2 Type II attested and holds ISO/IEC 42001 certification, which is the evidence a Factory-stage audit asks for.
How Can Leaders Tell Which Stage Their Organization Is At?
Placement inside the software factory maturity model uses six telemetry signals. Read it by column: the column an organization matches on four or more rows is its stage.
| Signal | Artisanal | Assisted | Assembly Line | Factory |
|---|---|---|---|---|
| Merged code AI-authored | Unmeasured | Individual only | Team level | Per agent task |
| Pull request batch size | No attribution | Individual only | Against a 12-month baseline | In queue-capacity controls |
| Review wait time | No authorship split | No team split | By AI-assisted status | Agentic against unassisted |
| Change failure rate | No attribution | No team control | By AI-assisted status | With harness investment |
| Measurement infrastructure | None | Ad hoc | Usage layer operational | Usage, impact, and cost |
| Primary bottleneck | Unmeasured | Generation apart from review | Review queue and batch size | Reviewer confidence and governance |
The review wait row is the most diagnostic, because it compares two populations under one review process. A persistent difference between agentic and unassisted pickup time means agent work is queuing differently, whatever stage an organization believes it occupies. When cross-file risk drives that difference, the Context Engine that Cosmos agents draw on maps relationships across hundreds of thousands of files, turning a wait into a queue ranked by blast radius.
Diagnose Your Factory Stage Before Review Queues Stall
Self-reported progress does not substitute for organizational telemetry, so place the organization on the software factory maturity model this week using signals the existing systems already emit. Those six numbers test which constraint is live: generation, review, verification, or governance. Spend against the one the data names, because the failure mode in every transition above is a control built for the previous stage. If the signals point at repository-wide review risk and not at generation, the next investment is architectural analysis, not more agents.
Frequently Asked Questions About the Software Factory Maturity Model
These are the questions engineering leaders ask when they are trying to place their own organization and decide what to fund next.
Related Guides
Written by
Paula Hingel
Paula writes about the patterns that make AI coding agents actually work — spec-driven development, multi-agent orchestration, and the context engineering layer most teams skip. Her guides draw on real build examples and focus on what changes when you move from a single AI assistant to a full agentic codebase.