From point scans to platform governance: an AppSec operations maturity model (L0–L4) with evidence requirements and upgrade actions per level. For security and platform leads — honest self-assessment and a single next-level goal, instead of buying new engines as a substitute for real gates and ops. Where uncertain, follow official docs and the current product version; do not assume undelivered capabilities.