The operating control plane connects alerts to severity, authority, containment, communication, recovery, and the exact version in use. Model, prompt, policy, dependency, and device changes follow the same staged evidence path, with required evaluation, approval, observation, and rollback defined before a maintenance window begins.
Handover confirms coverage conditions, escalation routes, supplier responsibilities, retained evidence, and the forum that reviews recurring incidents and improvement proposals. Changes are accepted against a stated hypothesis and retest plan, while components without agreed ownership, access, or observability remain visibly outside the managed boundary.