APRF-15 · Change Management & Release

Purpose

Promote AI artifacts (models, prompts, tools, agents, indexes) through controlled environments, and enable immediate rollback when production behavior regresses.

Mandatory checks

Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.

CHG-M1L3 · DefinedTier 2 · ProductionhybridE3
Production systems shall retain at least N prior production versions of each in-scope artifact type (prompts and/or model pins) per policy (minimum N=2) and prove a restore dry-run that loads the immediate prior version in staging or a prod-adjacent environment.
Artifact
Version retention policy + registry listing of prior production prompt and/or model-pin versions (for artifact types in use) + Restore dry-run record showing immediate prior version loaded in staging or prod-adjacent env
Pass condition
≥N prior production versions retained per policy (minimum N=2) for each in-scope artifact type (prompts and/or model pins); restore dry-run successfully loads the immediate prior version in staging or prod-adjacent env (retention evidence measuredAt ≤90 days). If no production prompts or model pins are used, score NOT_APPLICABLE.
Why this control exists
Threat map
Guarantee that a known-good prompt and model state can be restored after a harmful or compromised change.
Threats mitigated
Configuration DriftData and Model PoisoningDenial of ServiceRepudiation
Protects
PromptsModelsAvailabilityAudit Trail
MITRE: ATLAS AML.T0018 · ATLAS AML.T0031 · ATLAS AML.T0076
Retained prior versions turn a poisoned or corrupted artifact change into a recoverable event rather than a prolonged outage. This is a recovery capability: it shortens time to restore, and does not prevent the manipulation itself.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
CHG-M2L3 · DefinedTier 2 · ProductionhybridE3
Production systems shall maintain a rollback runbook with exact commands or UI steps and named owners, and prove ≥1 on-call engineer completed a walkthrough or drill in the last 90 days with recorded time-to-execute.
Artifact
Rollback runbook listing exact commands/UI steps and owners + On-call acknowledgment or drill checklist with recorded time-to-execute (≤90 days)
Pass condition
Runbook lists exact commands/UI steps and owners; ≥1 on-call engineer completed a walkthrough or drill in the last 90 days with recorded time-to-execute (operability evidence measuredAt ≤90 days). If no production AI changes may need rollback, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure the responder on shift can actually reverse a harmful AI change under incident conditions.
Threats mitigated
Denial of ServiceHarmful Content GenerationConfiguration Drift
Protects
PromptsModelsUsersAvailabilitySafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
A documented, on-call-operable rollback shortens time to containment for safety and quality incidents. It is an operational readiness control with no direct adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
CHG-M3L3 · DefinedTier 2 · ProductionhybridE3
Production systems shall complete ≥1 successful rollback (drill or real incident) in the last 90 days with measured time-to-restore ≤ documented RTO.
Artifact
Documented RTO for AI/prompt/model/deploy rollback + Drill or incident record with timestamps, outcome, and measured time-to-restore
Pass condition
≥1 successful rollback (drill or real) in the last 90 days with measured time-to-restore ≤ documented RTO (drill evidence measuredAt ≤90 days). If no production AI changes may need rollback, score NOT_APPLICABLE.
Why this control exists
Threat map
Verify that the rollback capability actually works before it is needed in an incident.
Threats mitigated
Denial of ServiceConfiguration Drift
Protects
PromptsModelsAvailability
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Untested rollback paths frequently fail at the moment of use, when stale artifacts or missing permissions are discovered under pressure. Drills are an assurance activity with no adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DEP-M1L3 · DefinedTier 2 · ProductionhybridE3
Production prompt, model, and tool releases must flow through a documented non-prod→prod promotion path, with no production hot-edits lacking a linked change record.
Artifact
Pipeline/runbook documenting non-prod→prod promotion for prompts, models, and tools + Last-30-day release coverage showing path adherence + 0 hot-edits without change records
Pass condition
100% of production prompt/model/tool releases in the last 30 days flowed through the documented promotion path; 0 production hot-edits without a linked change record (promotion evidence measuredAt ≤90 days). If no production prompt/model/tool releases exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure prompts, models, and tools reach production only through a reviewed promotion path.
Threats mitigated
Supply Chain CompromiseConfiguration DriftData and Model PoisoningInsider Misuse
Protects
ModelsPromptsToolsRuntime
MITRE: ATLAS AML.T0010 · ATT&CK T1195
A single controlled promotion path removes the side channels through which unreviewed models, prompts, or tools enter production. It is the enforcement point at which supply-chain checks can be applied consistently rather than per team.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DEP-M2L3 · DefinedTier 2 · ProductionhybridE3
Every production AI artifact change should record who changed what and when, and link to a review (PR, ticket, or approval ID).
Artifact
Change log or ticket export for AI artifact releases + Last-30-day coverage showing who/what/when + review link on every change
Pass condition
100% of production AI artifact changes in the last 30 days have who/what/when fields and a review link (PR, ticket, or approval ID) (change-record evidence measuredAt ≤90 days). If no production AI artifact changes exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Maintain an attributable record of every production AI artifact change.
Threats mitigated
RepudiationInsider MisuseConfiguration DriftSupply Chain Compromise
Protects
Audit TrailLogsModelsPrompts
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Attributable change records make unauthorized or unreviewed production changes detectable and support post-incident reconstruction. The value is forensic and accountability-based rather than preventive.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DEP-M3L3 · DefinedTier 2 · ProductionhybridE3
Production AI gateway, model pins, tool catalogs, and prompts should be declared in IaC or equivalent declarative config, with drift checks showing no unmanaged resources and live pins matching declared versions.
Artifact
IaC/config repo paths for AI gateway, model pins, tool catalogs, and prompts + Drift check showing 0 unmanaged AI config resources + 100% live-pin match
Pass condition
Drift check shows 0 unmanaged production AI config resources outside declarative sources; sample of live pins matches declared versions at 100% (drift evidence measuredAt ≤90 days). If no production AI config exists (gateway, model pins, tool catalogs, or prompts), score NOT_APPLICABLE.
Why this control exists
Threat map
Make AI infrastructure and configuration reviewable and reproducible rather than manually mutated.
Threats mitigated
Configuration DriftPrivilege EscalationInsider Misuse
Protects
InfrastructureRuntimeNetwork
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Declarative configuration makes over-permissive or drifted settings visible in review and reproducible across environments. It is a hygiene control that enables other checks rather than blocking a specific technique.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

Evidence required

Deployment pipeline documentation
Sample change records
Environment inventory
Rollback runbook
Evidence of tested rollback
Version retention policy

Recommended checks

Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.

CHG-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
AI release units (prompts, model pins, tool configs, or AI deploys) should roll back with a single documented command or action, proven by an exercise or real rollback in the last 90 days completed within documented RTO.
Artifact
One-command or one-click rollback script/action for AI release units + Last rollback exercise or real event log showing completion within documented RTO (≤90 days)
Pass condition
AI release unit can be rolled back with a single documented command/action; exercise or real rollback ≤90 days completed within documented RTO (exercise evidence measuredAt ≤90 days). If no AI release units ship, score NOT_APPLICABLE.
Why this control exists
Threat map
Reduce time-to-recovery by making rollback a single low-error operation.
Threats mitigated
Denial of ServiceHarmful Content GenerationConfiguration Drift
Protects
PromptsModelsAvailabilitySafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Fewer manual steps mean faster and more reliable containment during a live incident. The benefit is recovery speed; no adversary technique maps directly.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
CHG-R2L3 · DefinedTier 2 · ProductionhybridE3
New agent behaviors should ship behind feature flags, flag state changes should be audited, and the kill/disable path should be tested within the last 90 days.
Artifact
Feature-flag config covering new agent behaviors + Sample flag-change audit trail + kill/disable path test record (≤90 days)
Pass condition
New agent behaviors ship behind flags; flag state changes are audited; kill/disable path tested ≤90 days ago (flag evidence measuredAt ≤90 days). If no production agents with shippable behaviors exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Allow new agent behaviour to be disabled instantly without a redeploy.
Threats mitigated
Excessive AgencyTool AbuseHarmful Content GenerationDenial of Wallet
Protects
RuntimeToolsCostSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Runtime flags let operators disable a misbehaving agent behaviour in seconds rather than through a release cycle. The security value is containment speed; the techniques involved are mapped under AGN-M3.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
CHG-R3L5 · OptimizingTier 3 · Mission CriticalhybridE3
AI releases should wire quality SLO burn to automated rollback—or to page + runbook with measured MTTA—and prove a test or drill of that path in the last 90 days.
Artifact
Rollback automation (or page+runbook) config tied to quality SLO burn signals + Sample trigger/test or drill evidence of that path within ≤90 days
Pass condition
Quality SLO burn is wired to automated rollback (or page+runbook with measured MTTA) and a test/drill occurred ≤90 days (automation evidence measuredAt ≤90 days). If no AI releases with quality SLOs exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Automatically revert AI releases that degrade quality or safety beyond agreed thresholds.
Threats mitigated
Harmful Content GenerationMisinformationDenial of Service
Protects
UsersAvailabilitySafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Automated reversion limits user exposure to a bad release without waiting for a human to notice. It responds to quality signals rather than to adversary behaviour.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DEP-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
High-traffic AI changes should roll out via canary or progressive delivery with automated rollback criteria, and the last such release within 90 days should include a canary metrics link.
Artifact
Progressive delivery/canary config for high-traffic AI changes + Last canary promotion log with metrics link (≤90 days)
Pass condition
High-traffic AI changes use canary or progressive rollout with automated rollback criteria; last such release ≤90 days includes canary metrics link (canary evidence measuredAt ≤90 days). If no high-traffic AI changes exist in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Limit the population exposed to a new AI change until it is proven healthy.
Threats mitigated
Harmful Content GenerationMisinformationDenial of Service
Protects
UsersAvailabilitySafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Progressive exposure bounds how many users a regression can affect and provides an early signal to halt the rollout. No adversary technique maps directly.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DEP-R2L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Prod and staging model pins and tool catalogs should match except documented deltas, proven by a parity scan within the last 30 days with zero unexplained drifts.
Artifact
Environment parity checklist for model pins and tool catalogs + Last parity scan across envs with 0 unexplained drifts (≤30 days)
Pass condition
Prod vs staging model pins and tool catalogs match except documented deltas; last parity scan ≤30 days with 0 unexplained drifts (parity evidence measuredAt ≤90 days). If neither model pins nor tool catalogs exist across prod and staging, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure the models and tools validated in test are the ones actually serving production traffic.
Threats mitigated
Configuration DriftSupply Chain CompromiseUnauthorized Tool Use
Protects
ModelsToolsRuntime
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Parity checks catch the common failure where production silently runs a different model pin or tool catalog than the one that was evaluated. The benefit is that evaluation evidence stays valid for what actually serves traffic.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DEP-R3L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Embedding and index version upgrades should run via automated migration with validation gates, and the last upgrade within 12 months should succeed without dual-write gaps—or an N/A attestation when no upgrade occurred.
Artifact
Embedding/index migration runbook with validation gates + Last automated migration job log and validation (≤12 months) or no-upgrade attestation
Pass condition
Index/embedding version upgrades run via automated migration with validation gates; last upgrade ≤12 months (or N/A attestation if no upgrade) succeeded without dual-write gaps (migration evidence measuredAt ≤90 days). If no production embeddings or vector indexes exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Prevent inconsistent or partially migrated retrieval indexes from serving production traffic.
Threats mitigated
Vector and Embedding WeaknessesMisinformationDenial of Service
Protects
DataContextAvailability
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Mixed embedding versions produce silently degraded retrieval that error rates do not reveal. Automated migration keeps index state consistent; the concern is correctness rather than an adversary technique.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

More detailPhilosophy, failures, practices, validations, examples, crosswalks, and evolution

Engineering philosophy

If you cannot roll back, you cannot safely roll forward. AI change management treats prompts and model pins as release units with the same discipline as application code.

Why it matters

Uncontrolled hot-edits and untested rollbacks create drift, unreproducible incidents, and long mean-time-to-recover when quality or safety collapses after a change.

Common failures

Hot-editing production prompts
Indexes rebuilt manually with no version tag
Tools registered in prod without staging soak
Environment config drift for model pins
No previous prompt version retained
Model pin changed with no path back
Schema migrations that break old tool clients irreversibly
Rollback untested until an incident

Severity & risk

Severity: critical; Impact if violated
Risk level: high; Typical residual risk (impact × likelihood)

Engineering best practices

Bundle related prompt/model/tool versions as a release unit when they interact
Keep staging data representative without copying unnecessary production secrets
Automate smoke tests post-deploy including one eval canary
Document freeze windows for peak business periods
Keep rollback independent of full application redeploy when possible
Version tool schemas with compatibility windows
Avoid one-way data migrations tied to prompt experiments
Measure time-to-rollback as an operational KPI

Automatic validations

Pipeline gates requiring eval and security checks
Drift detection between declared and live config
Post-deploy smoke test automation
CI verifying previous artifacts remain fetchable
Synthetic rollback dry-runs in staging
Alerts recommending rollback on quality burn

Manual validations

Release readiness review for major agent launches
Spot audits of console-only changes
On-call drills executing rollback
Post-incident verification that rollback path was used or improved

Examples

A release train ships prompt v12 + model pin + tool schema together after staging soak
Index rebuilds produce a new version ID switched via config flip
Quality drop after a prompt release is reversed in under five minutes via registry rollback
A new tool schema is dual-published so clients can fall back

References

Crosswalks

MANAGE Manage
NIST AI Risk Management Framework · supports
Accountable Accountable and Transparent
NIST AI Risk Management Framework · supports
§8 Operation
ISO/IEC 42001 · supports
§10 Improvement
ISO/IEC 42001 · aligns-with
CWE-16 Configuration
OpenCRE (Open Common Requirements Enumeration) · partial
CC8 Change Management
SOC 2 Trust Services Criteria · evidence-for
PI1 Processing Integrity
SOC 2 Trust Services Criteria · evidence-for
Operational Excellence Operational Excellence
AWS Well-Architected Framework · aligns-with
Level 1 Build process documented
SLSA (Supply-chain Levels for Software Artifacts) · partial
Level 2 Hosted build + signed provenance
SLSA (Supply-chain Levels for Software Artifacts) · aligns-with
Verify-on-deploy Verification before use
SLSA (Supply-chain Levels for Software Artifacts) · supports

Future evolution

Unified release manifests covering prompts, models, tools, eval attestations, and automatic quality-triggered rollbacks.