{
  "documentType": "model-release-policy-template",
  "templateVersion": "1.0.0",
  "publishedDate": "2026-09-09",
  "purpose": "Requirements for a separately scoped engagement; not a scan report, signed attestation, certification, executable validator, or evidence of a passing release.",
  "requiresCustomerAgreement": true,
  "scope": {
    "unit": "One selected model package and one exact serving runtime",
    "commercialBasis": "Separately quoted security add-on; not included in implementation fees by default",
    "requiredDecisions": ["model and source revision", "runtime and platform", "intended use and distribution rights", "format and custom-code policy", "vulnerability thresholds", "exception authority", "evidence maximum age", "withdrawal-status update mechanism", "registry and trust policy", "named operator"],
    "separatelyScoped": ["application behavior and backdoor evaluations", "host kernel and GPU drivers", "cluster and cloud configuration", "ongoing reassessment", "incident response"]
  },
  "requiredEvidence": {
    "identity": ["upstream source and immutable revision", "retrieval timestamp", "all shipped file paths and cryptographic digests", "model package digest", "runtime image digest", "transformation inputs and outputs", "provenance evidence and unknowns"],
    "license": ["source terms and notices", "permitted intended use and redistribution", "customer approval and unresolved questions"],
    "artifactChecks": ["actual formats", "scanner names and versions", "ruleset identifiers", "coverage per shipped file", "custom code review", "scan timestamps", "report digests"],
    "runtimeChecks": ["SBOM and digest", "scanner name and version", "vulnerability database version and timestamp", "component inventory scope", "CVE findings and triage", "report digest"],
    "exceptions": ["finding identifier", "reason", "compensating controls", "accepting owner", "expiry"],
    "releaseRecord": ["policy identifier and version and digest", "evaluation results or explicit not-performed state", "signed subject digests", "attester identity", "customer promotion approval", "evidence timestamps", "supersession and withdrawal references", "verification instructions"]
  },
  "scanOutcomeRules": {
    "allowedOutcomes": ["passed", "findings", "failed", "unsupported", "skipped", "incomplete"],
    "nonPassingOutcomes": ["findings", "failed", "unsupported", "skipped", "incomplete"],
    "defaultDecision": "Block promotion until required checks complete and findings or coverage gaps are resolved under the agreed policy.",
    "exceptionRule": "Any permitted exception requires an explicit accepting owner, rationale, scope and expiry; an exception never changes a scan outcome to passed."
  },
  "attestationValidationRequirements": [
    "Validate the signature using an explicitly trusted key or certificate identity and issuer.",
    "Match signed subject digests to the exact model package and runtime to deploy.",
    "Validate statement and predicate structure, policy identity and version, report digests, and required evidence contents.",
    "Enforce agreed freshness limits, exception expiry, and current withdrawal status independently of cryptographic validity.",
    "Require the customer-authorized promotion decision; signature validity alone is insufficient.",
    "Block on missing, unverifiable or stale required evidence unless the agreed policy explicitly authorizes and records an exception."
  ],
  "promotionRequirements": [
    "Prefer customer-owned staging and destination registries; Tenantplane staging requires explicit approval.",
    "Confirm packaging and registry compatibility, including associated signatures and evidence.",
    "Copy artifacts and evidence, verify destination digests and attestations, then authorize deployment by immutable digest.",
    "A changed or repackaged artifact requires new digest-bound evidence.",
    "Test rejected verification, withdrawal notification and the authorized rollback path."
  ],
  "dataAndAccessRequirements": ["isolated inspection without production credentials or client data", "approved custom-code and loader execution", "least privilege and access expiry", "reviewed egress and runtime downloads", "approved scanner telemetry and third-party data handling", "agreed evidence retention and access removal"],
  "ownership": {
    "customer": ["cloud and registry accounts", "production release approval", "trust-policy authority", "named operating owner"],
    "consultancy": "Only the packaging, evidence, handover and maintenance responsibilities assigned in the statement of work",
    "modelRights": "Original model license governs use and redistribution; delivery does not transfer upstream intellectual property.",
    "controlPlaneRequired": false
  },
  "maintenanceRequiresSeparateAgreement": {
    "requiredTerms": ["covered artifact and runtime inventory", "scan cadence and triggers", "scan-failure detection", "notification recipients", "business hours", "acknowledgement time", "investigation and remediation scope", "change authority", "withdrawal and disconnected-update procedure", "included effort and maintenance term"],
    "distinction": "Scan frequency is not a human response or remediation SLA. No continuous monitoring or 24/7 incident response is implied."
  },
  "limitations": ["No universal safety certification", "No guarantee of absent malware or weight-level backdoors", "No guarantee of vulnerability-free runtime", "No implied application leakage evaluation", "No implied SLSA assurance level", "No legal opinion or transfer of model ownership", "No operational service is activated by this template"]
}