← Control library
G03 · Governance and scope
Versioned system inventory
A result is attributed to components, prompts or tools that have since changed.
Requirement
Bind the assessment to model, prompt, retrieval sources, tools, policies and deployment configuration with immutable versions.
Expected evidence
- Signed inventory and dependency bill.
- Hashes or release identifiers for assessed artefacts.
Proposed verification
- Reconstruct the assessed release from identifiers.
- Compare a live sample with the recorded inventory.
Limit
Third-party services may change behaviour without exposing a precise build identifier.