AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational and Technical
A ticketing tool can record activity without controlling it. The technology is useful when it ties the approved candidate to what is deployed and makes missing decisions visible.
Control requirement
Use change-management tooling that preserves the relationship between AI change requests, evidence, approvals, deployed baselines and implementation records. Configure access and workflow rules to prevent unauthorized edits or bypasses.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls define the process and decision authority; Technical controls enforce boundaries or produce the system evidence needed to verify it.
When it applies
AI change workflows supported by tickets, repositories, deployment pipelines, configuration services or integrated governance platforms.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The change-tool owner maintains configuration; release and AI system owners define the required workflow and access boundaries.
Implementation guidance
- Map required decisions and evidence fields before selecting or configuring the tool; include prompts, retrieval and permission changes.
- Configure roles, approval transitions and immutable or protected audit history, with integration to relevant deployment records.
- Tie approval to a candidate reference and detect changes after approval; define controlled manual procedures if the tool is unavailable.
- Review privileged access and test workflow rules after integrations or configuration updates.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Attempt to bypass a required approval | The workflow blocks the transition or raises the defined exception. |
| Modify a candidate after approval | The earlier approval cannot silently authorize the changed release. |
| Trace a deployed change | Request, evidence, decision and baseline remain connected. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Workflow and access configuration
- Integration and candidate references
- Bypass and modification test results
- Privileged-access reviews
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate bypass or audit-history gaps to change and security owners. Restrict the affected deployment route until controls are restored or an approved alternative procedure is operating.
Example in practice
Hypothetical example: A deployment pipeline checks a model change ticket but ignores later prompt edits. The tool integration is revised to invalidate approval when the approved manifest changes.
Related controls
- CF01-009: AI Change Management Policy & Procedures
- CF01-011: AI Change Authorization
- CF01-012: AI System Baseline Management
Framework mappings
- CSA AICM (CCC-03)
- NIST AI RMF (MANAGE 4.2)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0