## Maturity Levels

### Level 1

#### Visibility Layer

Minimal Disruption

Passive discovery from validation traffic with no change in current issuance. 3AM distributes trust stores and routes CRL/OCSP validation while existing issuance paths remain untouched.

**Data Flows:**

- Trust store / client repository distribution
- Network and host discovery by software clients
- (Optional) CRL/OCSP traffic through 3AM

### Level 2

#### Issuance Bridge

Centralized Control

### Level 3

#### Policy Control

Governance Layer

### Level 4

#### Zero-Touch Intelligence

Executive Oversight

## Visibility Layer

Passive discovery from validation traffic (no change in current issuance)

**Trust/Validation**

3AM CENTRAL HUB Web Clients Browsers / Apps Agents Servers / IoT Services Microservices Internal PKI Enterprise CA Public CAs e.g., Digicert, Sectigo Cloud CAs AWS / Azure / GCP CMDB ServiceNow / Jira Trust Store Clients Direct Issuance (Bypasses 3AM)

- Clients → 3AM
- 3AM → CAs
- 3AM ↔ CMDB
- 3AM → Exec