# OUT-12 Model version pinning

Domain: OUT Output Integrity & Supply Chain · HI-AAF v1.3 · Public review · https://humanintel.net/standard/out/out-12

Foundation models in use are pinned to specific versions where the provider supports pinning. Provider-pushed model updates are tested before release to production traffic.

The agent operates against pinned model versions; upstream model changes go through change management. Provider-pushed model updates are tested against the standing evaluation set (SPC-07) and the behavior baseline (SPC-06) before release to production traffic. Material deltas are treated as material change under GOV-05. This control prevents silent model updates from changing agent behavior without oversight.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for OUT-12: Model versions are pinned for all production agents where the provider supports pinning; the most recent provider-pushed update was tested before production release; material deltas triggered change management.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Model versions are pinned for all production agents where the provider supports pinning.
- The most recent provider-pushed update was tested before production release.
- Material deltas triggered change management.

## Framework mappings

- NIST AI RMF: MANAGE 3.1
- SOC 2 (TSC): CC8.1
- EU AI Act: Art. 15(1)
- Singapore: MAIGF Trusted Development and Deployment

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites GOV-05 Change management authority: https://humanintel.net/standard/gov/gov-05
- Cites SPC-06 Behavior baseline capture: https://humanintel.net/standard/spc/spc-06
- Cites SPC-07 Versioned evaluation set: https://humanintel.net/standard/spc/spc-07
- Cited by OUT-05 Model provider inventory: https://humanintel.net/standard/out/out-05

## Cite this control

Human Intelligence. HI-AAF v1.3, OUT-12 Model version pinning. Public review edition, July 2026. https://humanintel.net/standard/out/out-12