How to use it
Use the v0.1 control IDs, map each control to your own policies and systems, decide which evidence is mandatory, name the accountable owner, and test the remediation and re-check path. Identifiers are versioned and may change in a future draft. The matrix is not a certification, legal opinion, or universal control set.
Matrix v0.1
Twelve controls across the change lifecycle.
| Control | Stage | Risk addressed | Possible decision | Core evidence | Accountable owner |
|---|---|---|---|---|---|
| SCG-ID-01Actor identity | All stages | An unauthenticated or ambiguous actor changes software. | Allow, hold, or block | Actor, agent, session, credential class | Platform / Security |
| SCG-SC-02Scope and authority | IDE to deployment | An actor exceeds approved repositories, tools, services, or environments. | Guide, hold, or block | Requested scope, granted scope, tool actions | Engineering / Security |
| SCG-IN-03Intent applicability | Repository and pull request | Relevant business, security, compliance, architecture, or release intent is missed. | Apply controls or request context | Policy IDs, versions, scope match | Accountable policy owner |
| SCG-PR-04Change provenance | IDE to repository | Reviewers cannot reconstruct how a change or tool action was produced. | Allow, warn, or hold | Commit, artifact digests, actor, tool, source references | Engineering |
| SCG-RS-05Risk classification | Pull request and CI/CD | A sensitive change follows a low-risk path. | Route, hold, or require approval | Data, service, environment, dependency, blast radius | Engineering / Risk owner |
| SCG-DP-06Dependency and data impact | IDE through CI/CD | A change crosses an unknown trust, regional, data, or runtime boundary. | Warn, hold, or block | Dependency graph, data flow, affected services | Architecture / Security |
| SCG-RV-07Independent review | Pull request and deployment | The proposer approves a sensitive change or agent action without separation of duties. | Hold for accountable review | Reviewer identity, authority, rationale, timestamp | Accountable service or policy owner |
| SCG-VL-08Validation and simulation | CI/CD | A change passes policy but lacks evidence that expected behavior is safe. | Allow, hold, or block | Tests, simulations, scans, exceptions, artifact digest | Engineering / Quality |
| SCG-RE-09Release authorization | Deployment | A valid change reaches an unauthorized environment, window, or tenant. | Allow, schedule, hold, or block | Environment, window, approver, policy snapshot | Release / Service owner |
| SCG-RB-10Recovery readiness | CI/CD and deployment | A high-impact change cannot be safely reversed or contained. | Warn, hold, or block | Rollback plan, feature control, recovery test, owner | Service owner / Operations |
| SCG-EV-11Decision evidence | All stages | A later reviewer cannot explain which policy applied or why an outcome occurred. | Record or hold when evidence is mandatory | Decision Evidence Record | Governance / Assurance |
| SCG-PL-12Production learning | Runtime to policy design | A runtime correlation silently becomes policy or a valuable lesson is lost. | Observe, propose, reject, or approve | Signals, causal tests, impact analysis, simulation | Accountable policy owner |
Control details
Remediation and re-check are part of the decision.
SCG-ID-01
Actor identity
- Actors
- Human, assistant, agent, automation
- Remediation
- Authenticate and bind an accountable identity.
- Re-check
- Re-evaluate after identity is established.
SCG-SC-02
Scope and authority
- Actors
- Agent and human
- Remediation
- Reduce scope or obtain scoped authorization.
- Re-check
- Re-evaluate the bounded action.
SCG-IN-03
Intent applicability
- Actors
- Policy system
- Remediation
- Supply context or resolve conflicting intent.
- Re-check
- Re-run applicability evaluation.
SCG-PR-04
Change provenance
- Actors
- Human, assistant, agent
- Remediation
- Attach missing provenance without exposing secrets.
- Re-check
- Verify a complete provenance chain.
SCG-RS-05
Risk classification
- Actors
- Policy system
- Remediation
- Reclassify and apply the required path.
- Re-check
- Confirm controls for the new tier.
SCG-DP-06
Dependency and data impact
- Actors
- Human or agent
- Remediation
- Remove, isolate, or approve the boundary change.
- Re-check
- Recalculate impact after revision.
SCG-RV-07
Independent review
- Actors
- Proposer and approver
- Remediation
- Route to an independent authorized reviewer.
- Re-check
- Confirm review remains valid for the final artifact.
SCG-VL-08
Validation and simulation
- Actors
- Delivery system
- Remediation
- Run required validation or narrow the change.
- Re-check
- Bind results to the release artifact.
SCG-RE-09
Release authorization
- Actors
- Deployment system
- Remediation
- Select an approved target or obtain authorization.
- Re-check
- Evaluate immediately before deployment.
SCG-RB-10
Recovery readiness
- Actors
- Delivery and operations
- Remediation
- Add a tested containment or recovery path.
- Re-check
- Verify against the final release.
SCG-EV-11
Decision evidence
- Actors
- Governance system
- Remediation
- Complete required fields or protected references.
- Re-check
- Validate schema, linkage, and retention policy.
SCG-PL-12
Production learning
- Actors
- Operations and policy owner
- Remediation
- Strengthen evidence or reject the candidate.
- Re-check
- Monitor approved policy outcomes.
Portable assets
Use the matrix in documents, tests, and policy design.
The human-readable page and downloadable files share the same versioned identifiers. Link to this page when you adapt the framework so readers can resolve each control’s meaning.
Context and limits
A transparent ZeroUI reference—not a substitute for assurance.
The matrix is a ZeroUI conceptual organization of software change controls. The sources below provide relevant external context; no formal control mapping, endorsement, or standards alignment is claimed. Organizations should add, remove, and refine controls according to their systems, threats, laws, contractual requirements, and risk appetite.