Chapter 27. The Minimum Viable Framework
The 20% that delivers most of the value, for organizations that cannot adopt the whole thing.
27.1 What the MVF is
Applying an 80/20 test against the framework’s own evidence produces a specific answer, and it is not the governance body structure. The highest-leverage element is independent risk-tier verification, because unverified self-scoring was the most confirmed weakness across the entire adversarial review.
The MVF is six commitments.
1. Run S0–S2 on all new AI initiatives, with mandatory independent countersignature. This is the cheapest, highest-leverage control in the framework. If you adopt one thing, adopt this.
2. Operate five gates, but make Tier 1–2 self-service by default. Only Tier 3–4 requires formal review. The gates exist; most work does not touch them.
3. Merge the two governance bodies if you cannot credibly staff both. In organizations without the depth to populate two distinct groups, the separation collapses informally anyway. The MVF makes it a declared simplification rather than an unacknowledged pretence. Record it as a local variation.
4. Keep three records, not sixteen. Risk Classification, Data Lineage and Sensitivity, and ADR. Defer the rest.
5. Agent Card only where there is real tool access or autonomous action. Advisory-only systems do not need one.
6. Regulatory Overlay Reference only if you operate in a named regulated sector.
27.2 What the MVF gives up, honestly
Adopting the MVF is a real trade, and the losses should be visible.
Table 75. What the MVF gives up, honestly
| Given up | Consequence |
|---|---|
| Continuous comparison | Drift is found at review, not detected. The framework’s central claim is not realized |
| Full artifact set | Several of the seventeen questions cannot be answered without reconstruction |
| Separation of architecture and deployment authority | One body decides both “is this right” and “is this safe,” losing an independent check |
| Audit sampling | Countersignature covers initial scoring; nothing covers later drift in tier accuracy |
| Evidence-as-code | Evidence is assembled manually, so gate cost stays high |
The MVF is a credible starting position, not a destination. What it preserves is the part that most determines whether everything else is pointed at the right systems.
27.3 Growing out of the MVF
Three signals indicate the MVF is no longer sufficient.
Tier 3–4 volume exceeds what one merged body can review without lead times that cause routing-around. Split the bodies.
Agentic systems reach production. The Control Plane’s boundary comparison becomes materially more valuable than any documentation control, because a boundary nobody can verify is not a boundary.
A drift incident occurs that periodic review would not have caught. This is the argument for the Control Plane that no business case makes as effectively.