Import, approval, and promotion

Design explicit zones and states

A common pattern separates an acquisition zone, a quarantine and analysis zone, an approved transfer boundary, internal staging repositories, and production-consumption repositories. The exact number of networks or systems is less important than explicit authority over each zone and controlled, one-directional movement between them. Draw the zones onto the trust-boundary diagram from SAI-110 rather than describing them only in prose — an undocumented zone is functionally an unmanaged one.

Promotion workflow

For each artifact class:

1. Record the request, business purpose, expected origin, license, and destination.
2. Acquire through an approved channel and compute an immutable identity immediately — see Artifact identity and provenance.
3. Quarantine it from runtime and build consumption until inspection completes.
4. Verify publisher information, signatures where meaningful, provenance, dependency inventory, malware and vulnerability findings, and format-specific risks.
5. Evaluate functional and workload-specific behavior against the acceptance criteria for that artifact class.
6. Record exceptions and obtain approval from authorized roles — not the same role that acquired the artifact.
7. Transfer the exact approved bytes with a manifest and receipt.
8. Re-verify identity at the destination before promotion; a transfer that changes the object invalidates the approval.
9. Monitor findings after promotion, and revoke affected objects when a new vulnerability, license issue, or provenance concern is discovered.

Separation and bypass resistance

No single unreviewed actor should be able to acquire, approve, and place a high-risk artifact into production. Service identities, repository permissions, transfer media, administrative paths, mirrors, caches, and emergency processes must all respect the state model — a well-designed workflow that can be bypassed through an emergency script or a shared administrative credential provides no real assurance.

Evidence should show who made each decision, which immutable object it covered, which rules applied, and whether the destination accepted the same object. Use the control-objective pattern to state each promotion gate as a testable requirement rather than a description of intended process.