The number, on the record, once a quarter. Breach the threshold on an active model and suspension is automatic — continuation is what needs a signature.
Insert-only: a new lock supersedes the old on the record, never edits it. The threshold you choose is the automatic suspension floor.
You sign as who you are signed in as — email from the session, your stated role, your rationale, and a hash anchored in the audit chain. Deployment, suspension, reactivation and retirement require an organisation administrator.
No sign-offs yet.
The Institute's published RUAIH / CHAI / NIST crosswalk, as a working checklist for this model. Change a status and it saves — every change lands in the audit chain. 'Not started' is the honest default; the binder shows the gaps.
The full governance record as one download — assembled live, with the audit chain's verification verdict inside. This is the document you hand the surveyor.
Export survey binder