Organisational policy that defines the lifecycle of the mandate of each AI agent in operational use — registration, ownership, autonomy levels A0-A4, tool scope, periodic review and revocation, in alignment with REQ-AGN-001..004 of Ch. 02 and ARC-015 of Ch. 04, proportionate to the criticality level (L1, L2, L3).
Organisational policy that defines the requirements for applying secure architecture principles throughout the lifecycle of applications classified L2 and L3, including baseline definition, management of architecture decisions (ADR), review of trust boundaries, integration with threat modelling and formal approval requirements.
Organisational policy that defines the mandatory nature, methodology, execution triggers, formal approval requirements, traceability and management of threat modelling artefacts throughout the lifecycle of applications classified L2 and L3.