Chapter 34. Module Reference: Autonomy, Assurance, Operating Model, Evidence

Modules M10 to M20, to the same template. The four groups here are what turn a set of documented decisions into a governed estate: they constrain what acts, detect what changed, decide who says yes, and record what happened.

34.1 Autonomy

M10 — Agent Governance Chain

Table 98.

An allow-list rather than a deny-list is deliberate. Deny-lists fail open, and for a component that acts, failing open is the wrong default.

M11 — Autonomy Change Control

Table 99.

Open tension. The rule was narrowed during revision from “any autonomy increase” to “boundary-widening changes only,” and the interaction between that narrowing and audit sampling has never been tested. Weight your sample toward agentic systems until you have your own evidence.

34.2 Continuous Assurance

M12 — Control Plane

Table 100.

Sequencing warning. Connect no telemetry source until the corresponding approved-state field exists and is populated for the Tier 3–4 estate. Telemetry before records is the most common way this module fails.

Novelty status. The mechanism is not novel; it applies existing posture-management and policy-as-code practice. What is specific to IRGF is the comparison target — a named Decision under a stated tier — plus the AI-specific drift categories and the feedback into pattern decisions.

M13 — Drift Taxonomy

Table 101.

Two categories were deliberately excluded as not telemetry-detectable: capability drift and strategic drift. Both are assessed rather than observed, and claiming otherwise would overstate what the mechanism can do.

The separation of category 5 from category 6 is one of the framework’s few original mechanisms. Its value is diagnostic: when behavior changes, the first question is whether the model changed or its grounding changed, and separated signals answer it immediately.

M14 — Policy- and Evidence-as-Code

Table 102.

Roughly two-thirds of the minimum evidence set is automatable. The remaining third — human oversight confirmation, the substance of control mapping, change classification judgment, knowledge preservation — requires human input by nature. This module is where real burden reduction lives, since gate consolidation did not deliver it.

34.3 Operating Model

M15 — Two Standing Bodies

Table 103.

Known limitation. The model does not scale on volume within a single jurisdiction. Only the geography axis was addressed, through a conditional Region or Legal Entity level. Expect to hit this if adoption succeeds, and respond by improving tiering accuracy and expanding patterns before adding capacity.

M16 — Decision Rights and RACI

Table 104.

Open gap. The Security Architect is consulted and can block, but is never accountable anywhere in the RACI. Independent review found this under-weighted relative to security’s role in agent failure modes. Elevating the role to co-accountable at G3 for agentic systems is a defensible local variation.

M17 — Escalation and Exceptions

Table 105.

Recurring exceptions are design feedback, not compliance failures. Review the recurring types quarterly as candidates for a framework variation or a new pattern.

34.4 Evidence

M18 — Primary Records

Table 106.

M19 — Derived Views

Table 107.

The AI System Card is the artifact practitioners most want and the one most dangerous to maintain manually. A confidently displayed summary that is quietly stale is worse than a visible absence, because nobody checks it.

M20 — Reference Pattern Library

Table 108.

Track pattern coverage. The share of new builds using an unmodified pattern is the best available proxy for whether the library is reducing load, and it is the number that justifies continued investment in maintaining it.

34.5 Module dependency summary

Table 109.

Two dependency facts are worth extracting from this table. M5 feeds more modules than anything else, which is why classification accuracy matters more than any individual review. And M12 depends on M18 before it depends on telemetry, which is why the Control Plane is a later adoption phase rather than an early tooling purchase.