Production Action Authority — SOC 2 CC8 Change Management

Production Action Authority — SOC 2 CC8 Change Management — 100% of in-scope requirements covered.

2 requirements · 1 in scope (1 enforced) · 1 out-of-scope (outside KYE™’s authority layer). The 100% is weighted over the in-scope base.

Production Action Authority: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. cc8-1-change-authorization · enforced

    CC8.1: an AI-proposed production change is authorized, documented, and evidenced before it is deployed

    Rule packs: kye:rule-pack:production-action-authority · Audit events: kye.purpose.request.v1, kye.purpose.admissibility.v1, kye.evidence.decision_map.v1, kye.evidence.pack.v1 · Constitution: 12…

  2. cc8-development-testing · out-of-scope

    Change design, development, and testing activities

    (no enforcement cited)

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: SOC 2 — CC8 Change Management (Common Criteria) — Trust Services Criteria attestation framework. KYE Protocol™ governs the SUBSET that resolves at the action boundary — the moment an AI-driven production action (a rollback / hotfix / infra-change) moves toward a consequential effect — under a recorded change-authority decision, with the change-class due-diligence recorded, replay-provable provenance, and named sign-off. KYE™ does not detect the incident, perform RCA, monitor the system, or operate the change-management tooling. · License: The SOC 2 Trust Services Criteria are published by the AICPA; KYE™ registry references the CC8 change-management criteria descriptively for mapping purposes and asserts no ownership of the criteria text.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Change management — authorization & evidence (enforced action-boundary subset)11000100%
Change development & testing (out-of-scope — engineering / qa)100000%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
soc2-cc8-change-management.cc8-1-change-authorizationCC8.1: an AI-proposed production change is authorized, documented, and evidenced before it is deployedenforcedrule_packs: kye:rule-pack:production-action-authority
dictionaries: internal
engines: internal, internal, internal
audit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1, kye.evidence.decision_map.v1, kye.evidence.pack.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/13-RESILIENCE-LOOP.md
soc2-cc8-change-management.cc8-development-testingChange design, development, and testing activitiesout-of-scope(no enforcement cited)

Canonical KYE™ surfaces referenced on this page: KYE™ Production Action Authority™ · KYE Protocol™.