Organisational policy that defines the lifecycle of the mandate of each AI agent in operational use — registration, ownership, autonomy levels A0-A4, tool scope, periodic review and revocation, in alignment with REQ-AGN-001..004 of Ch. 02 and ARC-015 of Ch. 04, proportionate to the criticality level (L1, L2, L3).
Cross-cutting organisational policy that defines the formal process for the submission, assessment, approval, recording and reassessment of exceptions to mandatory security controls, with approval authorities proportional to the application's risk level. It applies to all SbD-ToE chapters in which there are controls with formal mandatory status.
Organisational policy that defines how security requirements must be selected, documented, traced, validated and maintained throughout the lifecycle of each application, proportionally to its classified risk level.
Cross-cutting organisational policy that defines the traceability requirements between requirements, controls, validation evidence, build artefacts and operational events, ensuring that the security posture is auditable continuously and in proportion to the application's risk level.