The AI Change
Governance Field Manual

Autonomous AI change governance is the operating system of policies, identity controls, technical validation, human escalation, audit evidence, and recovery controls that decides whether an AI-initiated action may execute. It converts governance intent into an enforceable decision before production changes.

A CAB is designed for human-paced review and scheduled change. AI agents can propose and execute actions continuously. Governance must therefore become machine-enforceable: routine actions are validated automatically, consequential actions stop for a named human, and every outcome remains traceable.

No. Human review should be risk based. Low-risk, reversible, tightly scoped actions can proceed when every required automated gate passes. High-impact, privileged, regulated, or irreversible actions should require a named human decision before execution.

Preserve who acted, why the action was requested, the exact change, its targets and dependencies, the approved window, all validation results, the named human decision when required, and the tested recovery plan. The record should be sufficient to reconstruct the decision without relying on the model conversation.

The gates operationalize outcomes across NIST AI RMF GOVERN, MAP, MEASURE, and MANAGE. They add decision points and evidence requirements around identity, context, testing, human authority, monitoring, and recovery. The mapping in this manual is an AuthorityGate interpretation, not a NIST endorsement or certification.

Begin with discovery and a narrow pilot. Inventory machine actors and their authorities, select two production action classes, assign risk tiers and accountable owners, run the gates in observe-only mode, challenge them with real failure scenarios, and enforce only after the evidence path and rollback have been tested.

It is the enforcement layer that places a decision point in the path of protected changes. It resolves the actor, operation, target, risk, ticket, gate state, and approved scope, then returns allow, audit, hold, or block. The implementation differs by platform: protected-write control for Active Directory, an inline management path for vCenter, and scoped authorization grants with drift checks for Windows and Linux.

The protected action does not receive authority to execute. Keystone creates or routes a governance work item, records the attempted actor and scope, and sends the request through the required validation and approval path. The action must be retried through the approved path; creating a ticket does not retroactively authorize the original attempt.

No. Keystone maintains the validation and decision record and can link or route it to the enterprise ITSM workflow configured for the deployment. The ITSM system remains the system of engagement for change process; AuthorityGate is the enforcement and validation layer that prevents a ticket number alone from becoming authority.

No. Native audit sources are essential for attribution and reconstruction, but they usually describe an event that was attempted or completed. Governance also requires a pre-execution decision: is the actor authorized, is the requested scope covered, did the required gates pass, and is recovery ready?

No product should make that claim. Enforcement applies to configured protected resources, operation types, and risk tiers. Lower-risk classes may run in audit mode, while protected classes can fail closed. Coverage, bypass paths, fail-safe behavior, and agent health must be measured and tested in each deployment.

Availability behavior is policy driven. Protected, high-impact paths should fail closed or hold until authority can be re-established; lower tiers may be configured to audit. The deployment must test loss of connectivity, stale policy, emergency access, recovery, and reconciliation of any activity that occurred during an outage.

Policy states intent. Validation tests the requested action against identity, change context, security, dependencies, observed behavior, human authority, and recovery before impact. AuthorityGate then binds the decision to a narrow execution scope and records the result. That closes the operating loop between governance language and production behavior.

No. AuthorityGate can produce evidence and operating controls that support an organization's control objectives, but compliance depends on scope, implementation, testing, legal obligations, and independent assessment. The crosswalk in this manual is implementation guidance, not certification or endorsement.

Operational Data Resilience is the combined outcome of two necessary disciplines. Data resilience keeps trusted data backed up, intact, and recoverable. Operational resilience keeps critical business services available and behaving correctly through change. AuthorityGate does not position validation as a replacement for backup or disaster recovery; it connects prevention, bounded execution, and proven recovery so that both the service and its data are protected.

A human can approve intent and accept residual risk, but cannot manually reproduce every dependency, inspect every machine-speed action, or predict runtime behavior from a ticket summary. Human authority remains essential for consequential decisions. Automated validation gives that human decision-grade evidence and prevents the approved action from expanding beyond its actor, target, operation, and window.

ITSM and change-control platforms are essential systems of record and workflow, but they are also software. Their rules, integrations, agents, permissions, upgrades, and auto-approval logic can change production authority. Keystone validates both the payload routed through the platform and changes to the control plane itself, without replacing the enterprise ITSM process.

Keystone treats the vendor as the author, not as the final authority. It verifies artifact provenance and security, matches the change to an approved ticket and scope, checks dependencies, observes behavior against the organization's known-good baseline in a representative environment, routes consequential risk to a named human, and requires a tested recovery path before bounded release.