The old control objectives stay; the enforcement changes. For each play:
| Play | Enforced | Evidence | Logged where | Who approves |
|---|---|---|---|---|
| Capture intent | intent is a committed file with author + timestamp; PO decision is the merge/close | intent.md history |
git (intent home) | product owner |
| Requirements & design | policies applied while the spec is written (skills), conflicts flagged not resolved | spec.md, skills_applied, intent_commit |
git; skill invocations in session traces | product owner; policy owners per flagged concern; tech lead if high risk |
| Plan mode | no code before an accepted plan; plan and diff kept in sync | plan.md, Departures section, plan-sync Stop hook |
git; PR compliance pass | engineer; tech lead/architect if high risk |
| CLAUDE.md | the agent’s instructions are reviewable like code | file history | git, CODEOWNERS | code owners |
| Skills | advisory control, backed by a hook or review pass where it must hold | skill text + owner header | git; traces | policy owner |
| Parallel sessions | controls come from repo configuration, not the person watching | hooks, permissions in repo | OTel export, attributed to the engineer | — |
| Feedback loop | verification before “done”; agent cannot edit tests during a fix | literal tool output; .sdlc/fix-lock; test-guard hook |
transcript (OTel), PR check run | code owner |
| Continuous evals | config changes gated on pass rate | evals/results/latest.json |
CI job summary + artifacts | team owning the config change |
| AI in PR review | identical passes on every PR; agent cannot approve | findings, tally line, fixes, ratings | PR history (the audit record) | code owner through branch protection |
| Hooks as approval gates | every action matching a gate is checked, for everyone | allow/ask/block with timestamp | .sdlc/gate.log, OTel |
release manager / change management |
| Role-scoped commands | a role can only invoke the /sdlc:* commands roleCommands lists for it, whether typed or reached through a natural-language request; roles union |
roles/roleCommands in sdlc.config.json, role-gate PreToolUse hook |
.sdlc/gate.log |
platform engineer owns sdlc.config.json |
| CI/CD integration | agent acts up to the production gate; writes land only as PRs; no standing prod credentials | pipeline logs under the agent’s identity | CI | release manager via environment protection |
| Closing the loop | detection deterministic; tiers from versioned config; production access denied | detection JSON, incident intent, triage decision | CI logs, git | service owner |
settings.json denies gh pr merge
and gh pr review --approve; branch protection requires a code owner; the CI bot token has Developer role only).RELEASE_APPROVAL (hook), environment approval (CI), and, in regulated
orgs, a managed-settings hook the engineer cannot disable.git config user.email (overridable by SDLC_ROLE, itself disable-able via
roleGate.allowEnvOverride: false), and sdlc.config.json is protected only by the protectedPaths hook,
which an engineer with shell access can still edit. The hard version — a role genuinely cannot bypass it —
is the Skill(...) deny rules in managed settings, applied by MDM/admin console, which the engineer cannot
edit at all.templates/managed-settings.example.json plus managed-settings.README.md describe each key in control
terms. Note allowManagedHooksOnly disables plugin hooks; the gates you must keep are re-declared in the
managed file pointing at a managed copy of hooks/scripts/.
Exceptions do not route through a committee. They are recorded where they happen: an override flag in an
artifact’s frontmatter (override:), a departure entry in plan.md, a needs-human label on a PR, or a
dismissal with band tuning in monitoring/bands.yaml. Each is a commit with an author.