# Deployment and change-management responsibility matrix

**Policy version:** 1.0.0.

This matrix allocates responsibilities; it does not name assignees or authorize
a deployment. `R` = performs, `A` = accountable approval, `C` = consulted,
`I` = informed. One person must not be assumed to occupy conflicting roles.

| Activity | Engineering | Security reviewer | Privacy contact | Change approver | Incident commander | Partner technical owner | Authorized signatory |
|---|---|---|---|---|---|---|---|
| Define candidate/scope | R | C | C | A | I | C | I |
| Build and test | R | C | I | A | I | I | I |
| Security review | C | R/A | C | I | I | I | I |
| Data-map/consent review | C | C | R/A | I | I | C | I |
| Deployment authorization | R | C | C | A | I | C | I |
| Execute deployment | R | I | I | A | I | I | I |
| Verify receipt/post-state | R | A | I | C | I | C | I |
| Activate partner scope | R | C | C | A | I | R/C | I |
| Emergency containment | R | C | C | C | A | I | I |
| Commercial scope amendment | C | C | C | C | I | C | A |
| Rollback/wind-down | R | C | C | A | R | C | I |

## Mandatory change record

Every proposed change must record: request ID; candidate ID; rationale; affected
components/partners/data; risk and maximum-loss impact; V2 impact; requirement
#9 commitment check; tests; independent review; maintenance notice; rollback
trigger/owner; approvals; execution evidence; and post-change verification.

Code, deployment-manifest, role, cap, route, data-purpose, SLA, and commercial
scope changes require reassessment. Code or released-scope changes require a
new candidate ID and newly bound evidence. Emergency containment is temporary:
it must be reviewed within one business day and cannot create surveillance,
consume collateral, slash principal for flourishing, or remove bounded exits.
