ModulesSAI-250
SAI-250 table of contents
Governance, Assurance, and Evidence
Turn policies and control objectives into verifiable runtime, release, decision, and audit evidence.
Learning outcomes
What you should be able to do
- Map controls to technical evidence
- Define audit events and evidence retention
- Verify model, container, configuration, and decision provenance
Curriculum
Work through 5 sections in order.
The chapters are individually addressable documentation pages. You can link directly to a concept from another program, architecture decision, or implementation guide.
Assurance foundations
Establish precise sovereignty terms, dimensions, control objectives, and evidence principles.
Introduction to governance, assurance, and evidence
Connect policy intent to owned controls, technical enforcement, verifiable evidence, and decisions.
Sovereignty control dimensions
Evaluate data, model, infrastructure, operational, and evidence control as separate but connected dimensions.
Sovereignty terminology
Distinguish sovereignty from privacy, residency, localization, autonomy, portability, and security.
Write effective control objectives
Translate sovereignty goals into testable statements of what must be allowed, prevented, approved, observed, retained, and recovered.
Evidence by design
Design evidence alongside controls so important decisions, releases, configurations, and operating events can be verified.
Traceability and ownership
Connect obligations and risks to owned, tested, evidenced controls.
Control mapping, ownership, and traceability
Trace obligations and risk decisions to control objectives, owners, implementations, tests, and evidence.
Artifact identity and provenance
Identify software, models, data, prompts, policy, and configuration with verifiable origin and lineage.
Identity propagation and policy decisions
Preserve user, workload, service, and tool identity across AI boundaries and make policy decisions explicit.
System and release assurance
Assemble the system passport, evaluation evidence, and operational evidence used in release decisions.
System passports and release evidence
Create a versioned system record that makes scope, components, evaluations, approvals, and limitations inspectable.
Evaluation and release gates
Turn acceptance criteria into repeatable promotion decisions with recorded evidence and rollback conditions.
Observability and operational evidence
Design signals that explain service health, AI behavior, policy outcomes, change, and incidents without leaking sensitive content.
Review, exceptions, and change
Govern exceptions and material change with explicit decisions and reversal conditions.
Assurance reviews, exceptions, and change
Run proportionate reviews, document exceptions, trigger reassessment, and preserve independent challenge.
Controlled change and versioning
Version complete AI behavior, assess change impact, approve promotion, support rollback, and retire superseded assets.
Architecture decision records
Record context, options, control consequences, evidence, dependencies, limitations, and reversal triggers for material decisions.
Apply and assess
Produce an assurance package and evaluate its decision usefulness.
Practical completion package
- Control-to-evidence traceability matrix
- Ownership and review model
- Versioned AI system passport
- Release assurance recommendation
- Exception, change, and reassessment register
Current release boundary
This public curriculum supports technical assurance practice. It is not legal advice, regulatory certification, an audit opinion, or production approval. Required evidence and independence must be tailored to the organization and applicable obligations.