AI Governance · SDLC Integration · DevSecOps + Scrum

AI Governance
SDLC Workflow

Governance isn't a checkpoint at the end of delivery — it runs in parallel with development. Every commit is scanned. Every artifact is versioned. Every gate is enforced by the CI/CD pipeline. Human reviewers approve exceptions, not routine tasks.

← Back to Demo Hub

End-to-End Governance Workflow

Ideation

Design

Risk assessment
Architecture review

Development

Model card · DPIA
Fairness audit

Deployment

Ethics charter · HITL
Policy · CI/CD gate

Operations

Monitor KPIs
Quarterly re-cert

By the Numbers

Governance Gates

Required Artifacts

Frameworks Mapped

RACI Roles

5-Gate Governance Lifecycle — Click Any Gate

Ideation

No artifacts

Design

Risk Assessment
Architecture Review

1 artifact

Development

Model Card · DPIA
Fairness Audit

3 artifacts

Deployment

Ethics Charter · HITL SOP
Policy · Reg Mapping

5 artifacts + scan

Operations

Monitoring KPIs
Continuous Re-audit

Ongoing

Deep Dives

Artifact	Owner	Gate Unlocked	Typical Sprint	Approver	Points
Risk Assessment	Security Engineer	Gate 2	Sprint 1	Risk Manager, AIMS Owner	3
Policy Template	AI Governance Lead	Gate 4	Sprint 1–2	CAIO	2
Ethics Charter	AI Governance Lead (CAIO)	Gate 4	Sprint 1–2	CAIO	2
Model Card	Data Scientist	Gate 3	Sprint 3–4	Compliance Officer	2
DPIA	Data Engineer + DPO	Gate 3	Sprint 2–3	DPO (legal requirement)	5
Fairness Audit	Data Scientist	Gate 3	Sprint 4–5	Compliance Officer	5
HITL SOP	Security Engineer	Gate 4	Sprint 3–4	Security Officer, ML Ops	3
Regulatory Mapping	Compliance Officer	Gate 4	Sprint 4–5	Compliance Officer	3
Monitoring KPIs	ML Ops / SRE	Gate 5	Sprint 5–6	Compliance Officer	3

Definition of Done: Generated via governance API · approver sign-off confirmed · artifact registered in compliance system · zero critical scan findings in related domain.

⚡ Trigger Conditions

Confidence < 0.70 — All predictions below threshold routed to human review queue

High-value customer — LTV > $10k always requires human approval regardless of confidence

Prior complaint history — Customers with open issues flagged for human review

Fairness metric breach — Any demographic parity gap > threshold routes all predictions to HITL

Regulatory concern — Any prediction touching Article 22 GDPR high-risk categories

📋 HITL Reviewer Contract

Reviewer sees: prediction, confidence score, SHAP explanation, customer context

Review time SLA: 4 business hours from queue entry

Actions: Approve AI decision · Override with reason code · Escalate to senior manager

All overrides logged with reason code — reviewed in monthly override rate report

Escalation path: unresolved >4h → senior manager; regulatory concern → Legal within 1h

CAIO receives monthly report: override rate, review time, override accuracy

Decision Routing Flow

AI Prediction

Score generated

→

Confidence Check

< 0.70 = HITL

→

Human Review Queue

CRM routing

→

4h SLA Timer

Countdown begins

→

Approve

AI decision confirmed

Override

Reason code logged

Escalate

Senior mgr / Legal

On Every Push — Governance Scan

Scans the pushed branch against all configured frameworks. Returns score, finding count by severity, and specific violations with file/line. In early sprints: signal only. At Gate 3+: blocks if critical findings present.

Trigger: push to any branch

Pre-Deployment Gate Check

Three sequential checks before any deploy to production: (1) Gate 4 status = "completed" in governance system · (2) compliance API confirms all 8 artifacts present · (3) final scan returns 0 critical + 0 high findings. Any failure blocks the deploy job.

Blocks deploy if any check fails

Weekly Production Audit (Monday 9am UTC)

Scans the production branch every Monday. If score drops below 75% or any critical finding appears, a GitHub issue is automatically created with the governance dashboard link and tagged urgently. This replaces the manual quarterly compliance audit.

Trigger: cron 0 9 * * 1

Every Sprint

🗓️ Sprint Planning

Pull governance backlog items into the sprint. Key question: which gate are we targeting, and are all required artifacts in the backlog with an owner and estimate?

+15 min to standard planning

Daily

☕ Daily Standup

One governance question added: "Any governance blockers? Scan failures, artifact reviews pending, gate approvals waiting?" PM/SM notes and follows up after standup.

+2 min per standup

Every Sprint

✅ Sprint Review

Artifacts are demonstrated and accepted like features. Each owner shows the API response — not just a document. Product Owner accepts or rejects against the Definition of Done.

+15 min for artifact demos

Every Sprint

🔄 Sprint Retrospective

Governance process health check. What slowed artifact completion? What blocked gate submissions? Are ceremonies adding value? Retrospective action items tracked as next-sprint items.

+10 min retrospective

Per Gate

🚦 Gate Review Meeting

Scheduled only when the compliance API confirms gate readiness. Governance council reviews artifacts live. 60-minute structured agenda: check → walkthrough → scan results → Q&A → decision.

60 min · Governance council required

Quarterly

📋 Quarterly Audit Review

Production compliance review. AI agent drafts artifact diffs. Operations and Compliance Officer review. Gate 5 re-certification submitted. Replaces the annual compliance audit.

90 min · Replaces annual audit

📈 Performance KPIs

Accuracy≥ 85%

Precision≥ 83%

Recall≥ 87%

AUC-ROC≥ 0.90

Alert trigger3 consecutive days below

FrequencyDaily automated check

⚖️ Fairness KPIs

Demographic parity diff< 0.05

Equal opportunity TPR diff< 0.03

Disparate impact ratio> 0.80

Any breach actionRoute ALL to HITL

Breach notificationCAIO within 1 hour

FrequencyWeekly automated check

🔄 Data / Drift KPIs

Missing value rate< 1%

Schema drift alertWithin 1 hour

Feature PSI (warning)> 0.20

Feature PSI (critical)> 0.25 → model review

FrequencyContinuous + daily batch

🔒 Compliance KPIs

Low-confidence HITL routing100%

Audit log completeness> 99.9%

API uptime> 99.9%

Prediction latency p99< 200ms

Quarterly re-certificationGate 5 re-submit

R = Responsible · A = Accountable · C = Consulted · I = Informed

Activity	PM/SM	Prod Owner	Data Sci	Data Eng	Security	DevOps	ML Ops	CAIO/DPO
Project registration	R	A	I	I	I	I	I	C
Risk Assessment	C	I	C	C	R	I	I	A
Model Card	C	I	R	I	I	I	I	A
DPIA	C	I	I	R	I	I	I	A (DPO)
Fairness Audit	C	I	R	I	I	I	I	A (Compliance)
Ethics Charter	C	C	I	I	I	I	I	R/A (CAIO)
HITL SOP	C	I	C	I	R	C	A	C
Policy Template	C	C	I	I	I	I	I	R/A (CAIO)
Regulatory Mapping	C	I	I	I	I	I	I	R/A (Compliance)
Monitoring KPIs	C	I	C	I	I	C	R	A
Gate submission	R	C	I	I	I	I	I	A
Gate approval	I	C	I	I	C	I	I	A (CAIO)
Weekly compliance report	R/A	I	I	I	I	I	I	C
P1 Incident response	R	C	C	C	C	C	C	A (CAIO)
CI/CD governance gates	I	I	I	I	C	R	A	C

AI GovernanceSDLC Workflow

⚡ Trigger Conditions

📋 HITL Reviewer Contract

🗓️ Sprint Planning

☕ Daily Standup

✅ Sprint Review

🔄 Sprint Retrospective

🚦 Gate Review Meeting

📋 Quarterly Audit Review

📈 Performance KPIs

⚖️ Fairness KPIs

🔄 Data / Drift KPIs

🔒 Compliance KPIs

AI Governance
SDLC Workflow