B · The AI build lifecycle

Chapter 14. Change: S9 and Gate G4

Classifying change by the risk it moves rather than the effort it takes, and why that distinction carries most of the framework’s protective value.


14.1 The classification principle

Change classification in IRGF tracks which risk dimension a change plausibly moves, not how large the change is technically. This inverts the intuition most change processes are built on.

A one-line prompt edit that grants an agent a new capability is Major. A large model version upgrade inside an already low-tier advisory system may be Minor. Effort-based classification is precisely what allows governance-relevant changes to pass as routine updates, which is the failure mode the risk-driven model exists to prevent.

Three classifications exist.

Table 38. The classification principle

Classification Meaning Gate consequence
Minor No plausible movement in D1–D5 No gate; recorded only
Material Plausible movement within the current tier G4 with scoped re-assurance
Major Plausible tier change, or change to purpose, autonomy, or population Re-entry to earlier stages plus G4

14.2 The change type table

Table 39.

Change type Default classification Gate re-triggered Special rule
Model version update, same provider and family Minor at Tier 1–2; Material at Tier 3–4 None / G4 Higher tiers need revalidation because behavior can shift
Provider or model-family change Major G2 + G4 Treated as a new architecture decision
Prompt or system-instruction change, substantive Material G4, scoped to affected assurance areas
Prompt or formatting change, cosmetic Minor None
Grounding source addition or change Material if new source sensitivity ≥ current; Minor otherwise G4 for the material case Lineage check re-runs regardless of classification
Training data change (fine-tuning) Major G2 + G4 Full revalidation, not scoped
Autonomy increase Major, always S2 re-entry + G2 + G4 Never eligible for automated or self-service classification
Tool or permission addition for an agent Material to Major by blast radius G4, or S2 + G2 + G4 A tool granting irreversible or financial action is always Major
User population change Major S2 re-entry + G3 Treated as re-entering deployment authorization
Business purpose change Major, treated as a new opportunity S0 re-entry Technical assurance may be reused where still applicable; qualification and classification are redone

14.3 The cosmetic-versus-substantive problem

The table above relies on distinguishing a cosmetic prompt change from a substantive one, and no bright-line test exists. This is a named, unresolved limitation, not an omission.

The distinction is judgment, and judgment under delivery pressure drifts toward the cheaper classification. Three practices reduce the drift without pretending to eliminate it.

Define the boundary by effect, not by text. A change is cosmetic if it cannot change what the system does, only how the output is presented. Reformatting a response template is cosmetic. Changing an instruction about when to escalate is not, however few words it touches.

Require a second opinion above a tier. [Practice recommendation] At Tier 3–4, cosmetic classification of any prompt or instruction change should be confirmed by someone other than the author. The cost is small and the classification is the control.

Sample classifications retrospectively. Include change records in the quarterly audit sample (Chapter 7, §7.7). A pattern of substantive changes classified cosmetic is a signal about pressure on the team, not about individual judgment.

14.4 Vendor-initiated change

Changes you did not make are still changes to your system. When a vendor updates a model behind an API, your system’s behavior may shift without any change on your side, without notification, and without a change record.

Three practical responses.

Pin where the tier justifies it. For Tier 3–4 systems, prefer version-pinned model access even at additional cost. Where pinning is unavailable, record that as an accepted risk at G3 rather than discovering it later.

Detect behaviorally. Vendor-side model change appears as AI-Model Behavioral Drift (Chapter 19), detected through evaluation signal rather than infrastructure telemetry. For any Tier 3–4 system on an unpinned vendor model, a periodic re-run of the evaluation suite is the only reliable detection available.

Contract for notice. Model update notification and a defined notice period belong in procurement terms. This is far easier to obtain before signature than after.

14.5 Gate G4 — Material Change

Table 40.

Element Content
Purpose Re-authorize a system whose change is classified Material or Major
Entry criteria Change classification record; delta assurance evidence scoped to what the change affects
Required evidence Change record; affected-control re-verification; updated risk score where D1–D5 are touched
Decision authority Scales with the post-change tier, using the G3 authority table
Outcomes Approve / Approve with conditions / Remediate / Escalate / Reject / Retire
Automation High for minor changes, which bypass the gate entirely; low for major

Two features are worth emphasizing. Authority scales with the tier after the change, not before, which means a change that raises the tier also raises the approval authority for its own gate. And Retire is a legitimate G4 outcome: a change request that reveals the system should not continue is a valid finding, and having the outcome available makes it likelier to be used.

Scoping delta assurance

G4 does not require re-running every assurance activity. It requires re-running what the change plausibly affects. Scoping is a judgment recorded in the change record, and it should name what was re-run and what was not, with a reason.

The exception is fine-tuning, where the framework requires full revalidation rather than scoped. Training-data change can alter behavior in ways that do not respect the boundaries of what the change was intended to affect.