Templates: Assurance and Authorization
The evidence that a system works, the map from risks to controls, and the decision that authorizes it to run — the record every later drift comparison refers back to.
These three records are read together at G3. The assurance summary says what was tested and what the result was; the control matrix says which risk each control answers; the authorization record says who accepted the remaining risk, on what evidence, at what tier. Missing any one of them turns the gate into a conversation.
[Practice recommendation] Fields are marked All, T2+, T3+ or T4. A Tier 1 record that fills every Tier 4 field is not more rigorous, it is less honest: the fields stop being answered and start being completed. Delete what your tier does not require and keep the record short enough that people read it.
AI Assurance Summary
- Purpose
- What was evaluated, against what criteria, with what result
- Owner
- System Owner
- Created at
- S6
- Approval
- Consumed at Gate G3
- Update
- Re-issued after delta assurance following any Material change
- Retention
- Life of system plus 3 years, or the regulatory record period if longer
- Related
- Control Matrix, Deployment Authorization Record, Risk Classification Record
| Field | Required at | What good looks like |
|---|---|---|
| Scope of evaluation | All | What was tested and what was not. The second half is the part that matters at G3. |
| Pass criteria, and when they were set | All | Defined before the run, with the date. Criteria set afterwards are results with a label. |
| Datasets and populations used | All | Including how the held-out set was constructed and why it represents deployment conditions. |
| Results against criteria | All | Per criterion, pass or fail, with the number. Aggregate scores hide the direction that matters. |
| Directional error rates | T2+ where errors are asymmetric | False accept and false reject reported separately, because one of them is usually the harm. |
| Subgroup or stratum results | T3+ | Performance across the groups the system will actually meet, with sample sizes that make the number meaningful. |
| Adversarial and misuse testing | T3+ | Prompt injection, jailbreaks, data exfiltration attempts and boundary probing for anything that acts. |
| Failure analysis | T2+ | What the failures had in common. A failure list without analysis is a log. |
| Referenced external assurance | T2+ where it exists | Model validation, clinical evaluation, device clearance, certification — referenced, never restated. |
| Open issues at authorization | All | What is unresolved, with an owner and a date. Open issues are normal; unrecorded open issues are not. |
| Reproducibility | T3+ | Whether the evaluation can be re-run and produce the same result. |
How to fill it. The most common defect in this record is a scope statement that omits what was not tested. Write that section first. The second most common is a single accuracy figure standing in for a criterion; replace it with the specific behaviours the system must and must not exhibit.
Plain-text version to copy into your own tooling
AI ASSURANCE SUMMARY
System: Version: Tier: Date:
Scope: what was evaluated / what was NOT evaluated:
Pass criteria (and date set, which must precede the run):
Datasets and populations; held-out construction:
Results per criterion (pass/fail, value):
Directional error rates (false accept / false reject):
Subgroup results and sample sizes (T3+):
Adversarial and misuse testing (T3+):
Failure analysis (what the failures had in common):
Referenced external assurance:
Open issues, owner, date:
Reproducibility:
Control Matrix
- Purpose
- Every control mapped to the specific risk it answers and the standard it satisfies
- Owner
- Risk and Compliance Lead
- Created at
- S6
- Approval
- Gate G3
- Update
- On any risk re-score, control change or regulatory change
- Retention
- Life of system plus 3 years
- Related
- Risk Classification Record, Assurance Summary, Regulatory Overlay Reference
| Field | Required at | What good looks like |
|---|---|---|
| Risk | All | The specific failure, not the dimension. “Model recommends an ineligible claimant for fast-track settlement”, not “D1 = 3”. |
| Control | All | What actually reduces it, named precisely enough to test. |
| Type | All | Preventive, detective or corrective. Standing-authority Tier 3–4 agents require at least one preventive control; detection after an irreversible action is not a control. |
| Enforcement point | T2+ | Where it operates: policy engine, pipeline, workflow, or a person. |
| Evidence produced | All | What it emits that can be checked later. A control that produces nothing is an intention. |
| Owner | All | Named, and usually not the same person as the system owner. |
| Standard or obligation satisfied | T2+ | Which external requirement this answers, from the Regulatory Overlay Reference. Prevents duplicate controls for the same obligation. |
| Test method and frequency | T3+ | How you know it still works, and how often that is checked. |
| Residual risk accepted | T3+ | What remains after the control, and who accepted it. |
How to fill it. Build the matrix from the risks, never from a control catalogue. Starting from a catalogue produces coverage; starting from the risks produces defence. Any control with no evidence column entry should be deleted or redesigned — it cannot be assured, so it cannot be relied on.
Plain-text version to copy into your own tooling
CONTROL MATRIX
System: Tier: Date:
Per row: Risk (specific failure) | Control | Type (preventive/detective/corrective) |
Enforcement point | Evidence produced | Owner | Standard satisfied | Test method and frequency |
Residual risk and acceptor
Deployment Authorization Record
- Purpose
- The G3 decision: this system, in this configuration, at this tier, is authorized to run
- Owner
- System Owner, or the AI Governance Body at Tier 3–4
- Created at
- S7
- Approval
- Tier 1 System Owner; Tier 2 System Owner with AI Governance Lead notified; Tier 3 AI Governance Body; Tier 4 AI Governance Body plus Enterprise Governance Sponsor
- Update
- Re-taken on Major change; conditions tracked to closure
- Retention
- Life of system plus 3 years, or the regulatory record period if longer
- Related
- Assurance Summary, Control Matrix, Agent Card, Drift/Alert Record
| Field | Required at | What good looks like |
|---|---|---|
| Authorized configuration | All | Model version, grounding sources, action surface and environment, precise enough for a machine to compare against. This field is the baseline for all drift detection. |
| Tier and classification reference | All | With the date of the classification it relies on. |
| Evidence relied on | All | The assurance summary and control matrix versions, by reference. |
| Named accountable owner | All | A person who can be asked, and who can stop it. |
| Human oversight point | T2+ | Where the person sits, what they see, what they can do, and how much time they have. |
| Decision | All | Approve / Approve with conditions / Remediate / Escalate / Reject. |
| Conditions | All where applicable | Each with a named owner and a date. Unowned conditions are wishes. |
| Machine-readable boundary | T3+ agentic | The enforceable permission set, referenced by location and version. |
| Kill-switch conditions | T3+ agentic | Objectively evaluable, pre-approved, narrow. Defined here, never invented at runtime. |
| Monitoring commitments | T2+ | Which signals will be watched, at what threshold, by whom — the input the Control Plane needs. |
| Re-authorization trigger | All | What forces this decision to be taken again. |
| Dissent recorded | T3+ | Any member's objection and its disposition. A body with no recorded dissent is not being asked hard questions. |
How to fill it. The authorized configuration field is what makes continuous assurance possible at all. Write it as data, not prose: a version, a source list, an action list, an environment. If it cannot be compared automatically against what is running, drift detection for this system will be a manual exercise nobody performs.
Filled example
Decision. Approve with conditions. Configuration: model enterprise-general/2026-03 pinned; grounding = claims manual v14, policy wording repository (daily refresh, max staleness 48h); action surface = read-only, recommendation displayed in adjuster queue; environment = production EU. Oversight: adjuster approves each routing, sees the two top categories and the retrieved passage, no time target applied to the decision. Conditions: (1) override-rate instrumentation live within 30 days — owner Claims Ops Manager; (2) subgroup routing review at first assurance cycle — owner Risk Lead. Re-authorization: any model version change, any grounding source addition, or override rate below 5%.
Plain-text version to copy into your own tooling
DEPLOYMENT AUTHORIZATION RECORD (G3)
System: Tier: Date: Authority:
Authorized configuration (model+version, grounding sources, action surface, environment):
Classification reference and date:
Evidence relied on (assurance summary v, control matrix v):
Named accountable owner:
Human oversight point (who, sees what, can do what, time available):
Decision: [approve / approve with conditions / remediate / escalate / reject]
Conditions (each with owner and date):
Machine-readable boundary location and version (agentic):
Kill-switch conditions (agentic, T3+):
Monitoring commitments (signal, threshold, owner):
Re-authorization triggers:
Dissent recorded: