Chapter 14. Change: S9 and Gate G4
Classifying change by the risk it moves rather than the effort it takes, and why that distinction carries most of the framework’s protective value.
14.1 The classification principle
Change classification in IRGF tracks which risk dimension a change plausibly moves, not how large the change is technically. This inverts the intuition most change processes are built on.
A one-line prompt edit that grants an agent a new capability is Major. A large model version upgrade inside an already low-tier advisory system may be Minor. Effort-based classification is precisely what allows governance-relevant changes to pass as routine updates, which is the failure mode the risk-driven model exists to prevent.
Three classifications exist.
Table 38. The classification principle
| Classification | Meaning | Gate consequence |
|---|---|---|
| Minor | No plausible movement in D1–D5 | No gate; recorded only |
| Material | Plausible movement within the current tier | G4 with scoped re-assurance |
| Major | Plausible tier change, or change to purpose, autonomy, or population | Re-entry to earlier stages plus G4 |
14.2 The change type table
Table 39.
| Change type | Default classification | Gate re-triggered | Special rule |
|---|---|---|---|
| Model version update, same provider and family | Minor at Tier 1–2; Material at Tier 3–4 | None / G4 | Higher tiers need revalidation because behavior can shift |
| Provider or model-family change | Major | G2 + G4 | Treated as a new architecture decision |
| Prompt or system-instruction change, substantive | Material | G4, scoped to affected assurance areas | — |
| Prompt or formatting change, cosmetic | Minor | None | — |
| Grounding source addition or change | Material if new source sensitivity ≥ current; Minor otherwise | G4 for the material case | Lineage check re-runs regardless of classification |
| Training data change (fine-tuning) | Major | G2 + G4 | Full revalidation, not scoped |
| Autonomy increase | Major, always | S2 re-entry + G2 + G4 | Never eligible for automated or self-service classification |
| Tool or permission addition for an agent | Material to Major by blast radius | G4, or S2 + G2 + G4 | A tool granting irreversible or financial action is always Major |
| User population change | Major | S2 re-entry + G3 | Treated as re-entering deployment authorization |
| Business purpose change | Major, treated as a new opportunity | S0 re-entry | Technical assurance may be reused where still applicable; qualification and classification are redone |
14.3 The cosmetic-versus-substantive problem
The table above relies on distinguishing a cosmetic prompt change from a substantive one, and no bright-line test exists. This is a named, unresolved limitation, not an omission.
The distinction is judgment, and judgment under delivery pressure drifts toward the cheaper classification. Three practices reduce the drift without pretending to eliminate it.
Define the boundary by effect, not by text. A change is cosmetic if it cannot change what the system does, only how the output is presented. Reformatting a response template is cosmetic. Changing an instruction about when to escalate is not, however few words it touches.
Require a second opinion above a tier. [Practice recommendation] At Tier 3–4, cosmetic classification of any prompt or instruction change should be confirmed by someone other than the author. The cost is small and the classification is the control.
Sample classifications retrospectively. Include change records in the quarterly audit sample (Chapter 7, §7.7). A pattern of substantive changes classified cosmetic is a signal about pressure on the team, not about individual judgment.
14.4 Vendor-initiated change
Changes you did not make are still changes to your system. When a vendor updates a model behind an API, your system’s behavior may shift without any change on your side, without notification, and without a change record.
Three practical responses.
Pin where the tier justifies it. For Tier 3–4 systems, prefer version-pinned model access even at additional cost. Where pinning is unavailable, record that as an accepted risk at G3 rather than discovering it later.
Detect behaviorally. Vendor-side model change appears as AI-Model Behavioral Drift (Chapter 19), detected through evaluation signal rather than infrastructure telemetry. For any Tier 3–4 system on an unpinned vendor model, a periodic re-run of the evaluation suite is the only reliable detection available.
Contract for notice. Model update notification and a defined notice period belong in procurement terms. This is far easier to obtain before signature than after.
14.5 Gate G4 — Material Change
Table 40.
| Element | Content |
|---|---|
| Purpose | Re-authorize a system whose change is classified Material or Major |
| Entry criteria | Change classification record; delta assurance evidence scoped to what the change affects |
| Required evidence | Change record; affected-control re-verification; updated risk score where D1–D5 are touched |
| Decision authority | Scales with the post-change tier, using the G3 authority table |
| Outcomes | Approve / Approve with conditions / Remediate / Escalate / Reject / Retire |
| Automation | High for minor changes, which bypass the gate entirely; low for major |
Two features are worth emphasizing. Authority scales with the tier after the change, not before, which means a change that raises the tier also raises the approval authority for its own gate. And Retire is a legitimate G4 outcome: a change request that reveals the system should not continue is a valid finding, and having the outcome available makes it likelier to be used.
Scoping delta assurance
G4 does not require re-running every assurance activity. It requires re-running what the change plausibly affects. Scoping is a judgment recorded in the change record, and it should name what was re-run and what was not, with a reason.
The exception is fine-tuning, where the framework requires full revalidation rather than scoped. Training-data change can alter behavior in ways that do not respect the boundaries of what the change was intended to affect.