{
  "notice": "Illustrative mapping from the AI Governance Engineer Body of Knowledge v0.5.0 (not a claim of conformity)",
  "version": "0.5.0",
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "schemaVersion": 1,
  "schema": "https://aigovernanceengineer.com/api/v1/schemas/control.json",
  "self": "https://aigovernanceengineer.com/api/v1/controls/aige-ctl-deploy-017.json",
  "source": "https://aigovernanceengineer.com/controls/deployment-and-monitoring#aige-ctl-deploy-017",
  "citation": {
    "title": "AI Governance Engineering: The Thesis & Body of Knowledge",
    "authors": [
      "Jorge García Aibar"
    ],
    "parentDoi": "https://doi.org/10.5281/zenodo.22956197",
    "conceptDoi": "https://doi.org/10.5281/zenodo.22857084"
  },
  "control": {
    "id": "AIGE-CTL-DEPLOY-017",
    "profile": "deployment-and-monitoring",
    "url": "https://aigovernanceengineer.com/controls/deployment-and-monitoring#aige-ctl-deploy-017",
    "json": "https://aigovernanceengineer.com/api/v1/controls/aige-ctl-deploy-017.json",
    "title": "Monitoring findings and user overrides fed back into evaluation",
    "version": "0.2",
    "status": "draft",
    "reviewerStatus": "open",
    "depth": "derived",
    "objective": "Confirmed monitoring alerts, incidents and the overrides and wrong actions users report reach the agent's owners through channels named in the monitoring plan, and each becomes a test case in the agent's regression suite, so the next change is tested against what went wrong in use.",
    "failureModes": [
      "An incident or a confirmed alert is closed and the regression suite never gains a case for it, so the same failure can ship again.",
      "Users override the agent or spot wrong actions and have no channel to report them, or their reports never reach the evaluation owners."
    ],
    "scope": "AI agents in use, from the first rollout stage to retirement.",
    "enforcementPoints": [
      "runtime",
      "pre_merge"
    ],
    "verification": [],
    "evidence": [
      {
        "artefact": "Monitoring plan naming the feedback channels; the test cases each finding produced, linked to the alert, incident or report that raised it",
        "schemaId": "post-market-monitoring-plan",
        "schema": "https://aigovernanceengineer.com/schemas/post-market-monitoring-plan.v1.json",
        "layer": 5
      }
    ],
    "failureResponse": {
      "effect": "alert",
      "text": "A confirmed finding with no linked test case after its review is raised to the evaluation owner."
    },
    "layer": 5,
    "secondaryLayers": [],
    "patterns": [],
    "seeds": [],
    "derivedFrom": [
      {
        "kind": "schema",
        "ref": "post-market-monitoring-plan",
        "url": "https://aigovernanceengineer.com/resources/templates#schema-post-market-monitoring-plan"
      },
      {
        "kind": "chapter",
        "ref": "governing-agents",
        "url": "https://aigovernanceengineer.com/bok/governing-agents"
      }
    ],
    "mappings": {
      "obligations": [],
      "iso42001": [],
      "nistAiRmf": [
        {
          "id": "MEASURE 3.3",
          "title": "Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics."
        }
      ],
      "owasp": [],
      "atlas": [],
      "aiuc1": [],
      "csaAicm": [],
      "other": [
        {
          "framework": "IMDA MGF for Agentic AI v1.5",
          "ref": "2.3.3 Continuous testing and monitoring, p.44",
          "note": "Direct fit: Feedback loops that feed monitoring insights into evaluation frameworks; user reports of overrides and wrong actions (p.47)"
        }
      ]
    },
    "references": [
      {
        "n": 57,
        "title": "Governing AI agents",
        "text": "Governing AI agents (AI Governance Engineering Body of Knowledge v0.5.0, chapter 23, section \"Learning from use\"). AI Governance Engineer (Jorge García Aibar). 2026-09.",
        "url": "https://aigovernanceengineer.com/bok/governing-agents#learning-from-use",
        "verified": "primary"
      },
      {
        "n": 6,
        "title": "Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1",
        "text": "Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (subcategories cited by id: GOVERN 1.6, 1.7, 2.1, 2.2, 6.1; MAP 1.1, 3.5; MEASURE 2.3, 2.4, 2.11, 3.1, 3.3; MANAGE 1.1, 2.4, 3.1, 4.1, 4.3). NIST. 2023-01-26.",
        "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf",
        "verified": "primary"
      },
      {
        "n": 7,
        "title": "Model AI Governance Framework for Agentic AI, v1.5",
        "text": "Model AI Governance Framework for Agentic AI, v1.5 (published 2026-05-20, updated 2026-06-05; four dimensions: assess and bound the risks upfront, make humans meaningfully accountable, implement technical controls and processes, enable end-user responsibility). IMDA. 2026-06-05.",
        "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf",
        "verified": "primary"
      }
    ],
    "implementationNotes": [
      "Link each new test case to the finding that raised it, so a later failure traces back to what was already seen in use."
    ],
    "openQuestions": [
      "Verification procedure to be specified: the source material states what the control produces, not how a third party checks it; requires technical review.",
      "Whether findings also feed training data, which the source material mentions alongside evaluation, is outside this control: most deployers do not train the model their agent runs on."
    ],
    "observation": null,
    "observationSchema": "https://aigovernanceengineer.com/schemas/control-observation.v1.json",
    "examples": []
  }
}