---
title: "Production Action Authority — SOC 2 CC8 Change Management — KYE Protocol™ coverage"
description: "Production Action Authority — SOC 2 CC8 Change Management coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/soc2-cc8-change-management/
lang: en
source: "KYE Protocol"
---

> Production Action Authority — SOC 2 CC8 Change Management coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

Production Action Authority — SOC 2 CC8 Change Management

# Production Action Authority — SOC 2 CC8 Change Management — 100% of in-scope requirements covered.

2 requirements · 1 in scope (1 enforced) · 1 out-of-scope (outside KYE™’s authority layer). The 100% is weighted over the in-scope base.

**Source:** SOC 2 — CC8 Change Management (Common Criteria) — Trust Services Criteria attestation framework. KYE Protocol™ governs the SUBSET that resolves at the action boundary — the moment an AI-driven production action (a rollback / hotfix / infra-change) moves toward a consequential effect — under a recorded change-authority decision, with the change-class due-diligence recorded, replay-provable provenance, and named sign-off. KYE™ does not detect the incident, perform RCA, monitor the system, or operate the change-management tooling. · **License:** The SOC 2 Trust Services Criteria are published by the AICPA; KYE™ registry references the CC8 change-management criteria descriptively for mapping purposes and asserts no ownership of the criteria text.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Change management — authorization & evidence (enforced action-boundary subset) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Change development & testing (out-of-scope — engineering / qa) | 1 | 0 | 0 | 0 | 0 | **0%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `soc2-cc8-change-management.cc8-1-change-authorization` | CC8.1: an AI-proposed production change is authorized, documented, and evidenced before it is deployed | enforced | **rule\_packs**: `kye:rule-pack:production-action-authority` **dictionaries**: `internal` **engines**: `internal`, `internal`, `internal` **audit\_events**: `kye.purpose.request.v1`, `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1`, `kye.evidence.pack.v1` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/13-RESILIENCE-LOOP.md` |
| `soc2-cc8-change-management.cc8-development-testing` | Change design, development, and testing activities | out-of-scope | _(no enforcement cited)_ |

Canonical KYE™ surfaces referenced on this page: [KYE™ Production Action Authority™](https://kyeprotocol.com/governance-for-the-ai-web/) · [KYE Protocol™](https://kyeprotocol.com/).