AI Control Library / CF-01: Lifecycle Governance
Designation: Supplemental | Control types represented: Operational and Technical
A sound baseline does not prevent drift in live settings. Undetected changes to prompts, retrieval sources or permissions can undermine the conditions on which approval depended.
Control requirement
Detect material deviations between the approved AI baseline and the deployed environment. Cover behaviorally significant configuration and access settings, route findings to accountable owners, and reconcile authorized changes without masking unexplained differences.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls define the process and decision authority; Technical controls enforce boundaries or produce the system evidence needed to verify it.
When it applies
AI environments where runtime configuration, artifacts or supplier behavior can diverge from the approved deployment record.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The configuration owner operates detection; system and security owners assess deviations and authorize remediation.
Implementation guidance
- Define observable baseline elements, materiality and detection intervals; include identities, tools and external endpoints where relevant.
- Collect actual-state information using protected comparison mechanisms and record limitations for externally managed components.
- Route differences for triage against authorized changes; retain the original finding before accepting a new baseline.
- Test detection with controlled changes and verify correction or documented risk treatment for unresolved deviations.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Introduce an unapproved permission change | Detection identifies the change within the approved interval. |
| Make an authorized baseline update | The comparison reconciles it without concealing unrelated differences. |
| Disable a collection source | Loss of visibility generates a finding or explicit operational response. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Comparison scope and configuration
- Detected deviation records
- Change reconciliation decisions
- Detection and visibility-loss tests
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate material unknown deviations or lost visibility to system and security owners. Restrict consequential capability until the deployed state and its approval status are established.
Example in practice
Hypothetical example: An agent’s tool allowlist is changed outside the release process. Comparison detects the extra tool and blocks continued use of the expanded scope while the owner investigates.
Related controls
- CF01-012: AI System Baseline Management
- CF01-011: AI Change Authorization
- CF01-S01: Change Management Technology
Framework mappings
- CSA AICM (CCC-07)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0