{
  "title": "ZeroUI Software Change Governance Control Matrix",
  "version": "0.1",
  "status": "public reference draft",
  "published": "2026-10-16",
  "canonical_url": "https://www.zeroui.dev/software-change-governance/control-matrix/",
  "publisher": "ZeroUI Technologies LLP",
  "decision_evidence_outcome_vocabulary": [
    "guide",
    "allow",
    "warn",
    "hold_for_review",
    "block",
    "correct",
    "recheck",
    "record_evidence",
    "route_for_approval"
  ],
  "decision_field_note": "Control-level decision values are descriptive workflow actions, not an enumeration constrained to Decision Evidence Record outcome codes.",
  "scope_note": "This ZeroUI reference draft does not certify compliance. Identifiers are versioned and may change in a future draft. External sources provide context; no formal control mapping, endorsement, or standards alignment is claimed.",
  "controls": [
    {
      "id": "SCG-ID-01",
      "control": "Actor identity",
      "stage": "All stages",
      "risk": "An unauthenticated or ambiguous actor changes software.",
      "actor": "Human, assistant, agent, automation",
      "decision": "Allow, hold, or block",
      "evidence": "Actor, agent, session, credential class",
      "owner": "Platform / Security",
      "remediation": "Authenticate and bind an accountable identity.",
      "recheck": "Re-evaluate after identity is established."
    },
    {
      "id": "SCG-SC-02",
      "control": "Scope and authority",
      "stage": "IDE to deployment",
      "risk": "An actor exceeds approved repositories, tools, services, or environments.",
      "actor": "Agent and human",
      "decision": "Guide, hold, or block",
      "evidence": "Requested scope, granted scope, tool actions",
      "owner": "Engineering / Security",
      "remediation": "Reduce scope or obtain scoped authorization.",
      "recheck": "Re-evaluate the bounded action."
    },
    {
      "id": "SCG-IN-03",
      "control": "Intent applicability",
      "stage": "Repository and pull request",
      "risk": "Relevant business, security, compliance, architecture, or release intent is missed.",
      "actor": "Policy system",
      "decision": "Apply controls or request context",
      "evidence": "Policy IDs, versions, scope match",
      "owner": "Accountable policy owner",
      "remediation": "Supply context or resolve conflicting intent.",
      "recheck": "Re-run applicability evaluation."
    },
    {
      "id": "SCG-PR-04",
      "control": "Change provenance",
      "stage": "IDE to repository",
      "risk": "Reviewers cannot reconstruct how a change or tool action was produced.",
      "actor": "Human, assistant, agent",
      "decision": "Allow, warn, or hold",
      "evidence": "Commit, artifact digests, actor, tool, source references",
      "owner": "Engineering",
      "remediation": "Attach missing provenance without exposing secrets.",
      "recheck": "Verify a complete provenance chain."
    },
    {
      "id": "SCG-RS-05",
      "control": "Risk classification",
      "stage": "Pull request and CI/CD",
      "risk": "A sensitive change follows a low-risk path.",
      "actor": "Policy system",
      "decision": "Route, hold, or require approval",
      "evidence": "Data, service, environment, dependency, blast radius",
      "owner": "Engineering / Risk owner",
      "remediation": "Reclassify and apply the required path.",
      "recheck": "Confirm controls for the new tier."
    },
    {
      "id": "SCG-DP-06",
      "control": "Dependency and data impact",
      "stage": "IDE through CI/CD",
      "risk": "A change crosses an unknown trust, regional, data, or runtime boundary.",
      "actor": "Human or agent",
      "decision": "Warn, hold, or block",
      "evidence": "Dependency graph, data flow, affected services",
      "owner": "Architecture / Security",
      "remediation": "Remove, isolate, or approve the boundary change.",
      "recheck": "Recalculate impact after revision."
    },
    {
      "id": "SCG-RV-07",
      "control": "Independent review",
      "stage": "Pull request and deployment",
      "risk": "The proposer approves a sensitive change or agent action without separation of duties.",
      "actor": "Proposer and approver",
      "decision": "Hold for accountable review",
      "evidence": "Reviewer identity, authority, rationale, timestamp",
      "owner": "Accountable service or policy owner",
      "remediation": "Route to an independent authorized reviewer.",
      "recheck": "Confirm review remains valid for the final artifact."
    },
    {
      "id": "SCG-VL-08",
      "control": "Validation and simulation",
      "stage": "CI/CD",
      "risk": "A change passes policy but lacks evidence that expected behavior is safe.",
      "actor": "Delivery system",
      "decision": "Allow, hold, or block",
      "evidence": "Tests, simulations, scans, exceptions, artifact digest",
      "owner": "Engineering / Quality",
      "remediation": "Run required validation or narrow the change.",
      "recheck": "Bind results to the release artifact."
    },
    {
      "id": "SCG-RE-09",
      "control": "Release authorization",
      "stage": "Deployment",
      "risk": "A valid change reaches an unauthorized environment, window, or tenant.",
      "actor": "Deployment system",
      "decision": "Allow, schedule, hold, or block",
      "evidence": "Environment, window, approver, policy snapshot",
      "owner": "Release / Service owner",
      "remediation": "Select an approved target or obtain authorization.",
      "recheck": "Evaluate immediately before deployment."
    },
    {
      "id": "SCG-RB-10",
      "control": "Recovery readiness",
      "stage": "CI/CD and deployment",
      "risk": "A high-impact change cannot be safely reversed or contained.",
      "actor": "Delivery and operations",
      "decision": "Warn, hold, or block",
      "evidence": "Rollback plan, feature control, recovery test, owner",
      "owner": "Service owner / Operations",
      "remediation": "Add a tested containment or recovery path.",
      "recheck": "Verify against the final release."
    },
    {
      "id": "SCG-EV-11",
      "control": "Decision evidence",
      "stage": "All stages",
      "risk": "A later reviewer cannot explain which policy applied or why an outcome occurred.",
      "actor": "Governance system",
      "decision": "Record or hold when evidence is mandatory",
      "evidence": "Decision Evidence Record",
      "owner": "Governance / Assurance",
      "remediation": "Complete required fields or protected references.",
      "recheck": "Validate schema, linkage, and retention policy."
    },
    {
      "id": "SCG-PL-12",
      "control": "Production learning",
      "stage": "Runtime to policy design",
      "risk": "A runtime correlation silently becomes policy or a valuable lesson is lost.",
      "actor": "Operations and policy owner",
      "decision": "Observe, propose, reject, or approve",
      "evidence": "Signals, causal tests, impact analysis, simulation",
      "owner": "Accountable policy owner",
      "remediation": "Strengthen evidence or reject the candidate.",
      "recheck": "Monitor approved policy outcomes."
    }
  ]
}