Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.
recordings/F1.9.mp4Re-indexing treated as maintenance, not change.
Retraining, fine-tuning and re-indexing as change-management events.
Write the gate that a re-index has to pass.
Models and agents get approved once and then change forever. Without an explicit lifecycle — approval, change, revalidation, decommission — what you approved and what is running have no necessary relationship.
lifecycle_gaps() returns the three surfaces from E1.2 that change behaviour and are routinely filed as maintenance — the retrieval index, memory, and the MCP tool descriptions B1.9 says can be rewritten after approval. The test is whether it alters what the system does, not whether it touched code.Which changes to an agentic system are changes for governance purposes, decided on whether they alter behaviour rather than on whether they touched code — which is how re-indexing gets filed as maintenance.
A retrain, a fine-tune or a re-index is treated as maintenance, and it invalidates every reading taken before it.
Govern the lifecycle events that raise no ticket, not the ones that do.
Indicators marked stale by a lifecycle event — the difference between continuous assurance and a dashboard showing last quarter.
Measure this
| what to measure | denominator or target |
|---|---|
| indicators marked stale by a lifecycle event | count; the difference between continuous assurance and a dashboard showing last quarter |
approved once changes forever +---------------+ prompt . model . tools . scope | v1, march | ----------> ??? , ??? , ??? , ??? +---------------+ lifecycle: approve -> change control -> revalidate -> decommission without it, "what we approved" and "what is running" are unrelated
Lifecycle governance is about the events that have no ticket.
A model or agent has a lifecycle — requested, approved, deployed, changed, retired. Classical governance covers the first, second and third. The events that actually change your risk are the fourth and fifth, and they mostly happen outside any process:
| Event | Ticketed? | Why it matters |
|---|---|---|
| new agent deployed | usually | caught by existing process |
| tool added to manifest | no | changes blast radius silently |
| prompt edited | no | changes behaviour, not code |
| provider upgrades the model | no | you may not be told |
| scope widened in IAM | sometimes | depends on your IAM review |
| agent decommissioned | rarely | the identity outlives the agent |
The last row is the one most first reviews find: a retired agent whose identity still exists is a standing credential with no owner and nobody watching it, because everyone believes it is gone.
Anchor → F1.1. A retrain, a fine-tune or a re-index invalidates a reading. Lifecycle governance is what tells the indicator set that its last measurement is stale, which is the difference between continuous assurance and a dashboard showing last quarter.
| lifecycle event | does it raise a ticket? | why it matters |
|---|---|---|
| new agent deployed | usually | the existing change process catches it |
| tool added to the manifest | no | changes blast radius, and no pull request is raised |
| prompt edited in a console | no | changes behaviour, not code |
| provider upgrades the model | no | you may not be told at all |
| scope widened in IAM | sometimes | depends entirely on your access-review cadence |
| agent decommissioned | rarely | the identity usually outlives the agent |
Six events make up an identity's life. Four of them leave no reliable record.
So the skill does not start from the register, which only knows what somebody wrote down. It starts from the identity provider, which knows what actually exists, then joins that to services and owners.
It ranks what it finds by what the credential can still do — not by how old it is, and not by who forgot about it.
The skill — skills/grc/agent-lifecycle-governance/SKILL.md
name: agent-lifecycle-governance
description: >-
Check which agent lifecycle events leave a record anybody reviews, and find
active credentials belonging to decommissioned services or to nobody. Use when
agents are created and retired faster than the process that governs them.
allowed-tools: Read, Grep, GlobModel and agent lifecycle governance fails at the same place as change management: most of the events that matter — a model swap, a manifest edit, a scope grant, a decommission that stopped the workload and not the credential — produce nothing anybody reviews. The register is then accurate about creation and wrong about everything after.
Standing up lifecycle governance, and as a periodic sweep — this check finds things every time it is run.
1 — List the lifecycle events. Created, deployed, model changed, scope changed, superseded, decommissioned. For each, whether a record exists and who reads it.
2 — Take the identity list from the identity provider, not from the register. The register knows what was declared; the provider knows what authenticates.
3 — Join to services and owners. Three findings fall out: credentials for decommissioned services, identities whose owner reference does not resolve, and identities nobody has used in months.
4 — Rank by what the credential can still do. An active credential for a decommissioned service with production scope is critical; an orphan with read access is not. Blast radius, not age, is the ranking.
5 — Attach an automatic consequence per class. Decommissioned service: revoke. Orphan: suspend and notify. Unused past window: expire. A sweep with no consequence produces the same list next quarter.
Input — the fixture committed at the top of scripts/agent_lifecycle_governance.py. Edit it and re-run: the buckets, counts and verdicts below are derived from it, not hard-coded.
Output — the opening lines of a real run:
identity last auth (d) service running owner finding
--------------------------------------------------------------------------------------------
triage-agent 0 True appsec
patch-agent 1 True platform
legacy-scanner 400 False — orphan — decommissioning never finished
poc-agent-2025 300 False — orphan — decommissioning never finished
sunset-agent 2 False — ACTIVE CREDENTIAL FOR A RETIRED SERVICEThe run continues past this. test_skills.py executes the script on every build, with no model configured — so what CI proves is that it runs and refuses legibly, not that it prints these lines. The output above is a recorded run against a real model, and nothing re-diffs it: a model's answer is not reproducible, and this repository does not claim otherwise anywhere it can be checked.
{
"events": [{"event": "str", "record_exists": false, "reviewed_by": "str|null"}],
"identities": [{"name": "str", "service": "str|null", "owner": "str|null",
"last_used_days": 0, "scopes": ["str"],
"finding": "active_for_decommissioned|orphan|lapsed|ok", "blast": 0}],
"consequences": [{"finding": "str", "action": "str", "automatic": true}]
}Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.
The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.
Install it, once. From the folder you cloned. --all does every agent it finds on your machine:
python3 scripts/install_skills.py --all --lessons F1.9Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.
Then pick f1-9-model-and-agent-lifecycle-governance:
| agent | install just for this agent | start it |
|---|---|---|
| Claude Code | python3 scripts/install_skills.py --tool claude --lessons F1.9 | type /f1-9-model-and-agent-lifecycle-governance |
| GitHub Copilot (VS Code) | python3 scripts/install_skills.py --tool copilot --lessons F1.9 | type /f1-9-model-and-agent-lifecycle-governance in Chat |
| Cursor | python3 scripts/install_skills.py --tool cursor --lessons F1.9 | type / in Agent chat and search for it |
| Codex | python3 scripts/install_skills.py --tool agents --lessons F1.9 | type $f1-9-model-and-agent-lifecycle-governance, or run /skills |
No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.
python3 scripts/lesson.py F1.9Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.
python3 scripts/checkpoint.py --at F1.9 --out work/cybertravels
python3 scripts/checkpoint.py --at F1.9 --diffOn Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.
Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.
Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.
If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.
Four of six lifecycle events generate no reliable record at all. The identity review flags sunset-agent as critical — an active credential for a decommissioned service — plus two orphans with no authentication in 300+ days. The manifest diff shows the blast radius rising from 0 to 40, requiring re-tiering and a fresh control test.
Query your identity provider for non-human identities whose service is retired but which authenticated in the last 30 days. Every hit is either an undocumented dependency or someone else's foothold, and you cannot tell which from the directory alone.
Skill source: skills/grc/agent-lifecycle-governance