Model documentation and approval packs

How to study this topic

Model documentation and approval packs are the evidence that let a bank decide whether a model is suitable for its intended banking use, what limits apply, who approved it, how it was validated and how it will be monitored after release. Study this as a banking governance chapter. The important question is not whether AI can produce a score, explanation or document pack. The important question is whether the bank can prove the model is suitable, lawful, monitored, limited and accountable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The topic belongs to banking model documentation, approval and audit evidence. Keep the focus on credit, compliance, model-risk governance, fair lending, customer outcome, validation evidence and approval control. Do not drift into generic AI productivity language. In banking, the model output matters only when the control context around it is strong enough.

A strong learner should be able to explain this topic to a credit-risk manager, fair lending specialist, compliance analyst, model validator, product owner, developer, tester, auditor and governance committee member. Each person should understand what evidence is needed, what the model can do, what it cannot prove and where human accountability remains.

Plain language meaning

In plain language, model documentation and approval packs is about preventing AI from being treated as trusted banking evidence before the bank has tested the model, checked the law, reviewed the customer impact and agreed the approval boundary. A model can be technically impressive and still be unsuitable for a regulated credit or compliance use.

The practical discipline is to separate prediction, explanation, compliance evidence and final action. Prediction estimates an outcome. Explanation describes model drivers. Compliance evidence proves the bank followed the right control process. Final action affects a customer, report, control, case or policy position. Mixing those four layers is where many model-governance failures begin.

A good bank does not approve AI because it sounds modern. It approves a controlled use of a specific model for a specific population, purpose, product, jurisdiction and decision boundary. That approval should be visible in the model inventory, validation pack, committee record and monitoring process.

Where it sits in the bank

This topic normally sits across credit risk, compliance, fair lending, legal, model risk management, product, data, technology, operations and internal audit. The exact operating model differs by bank, but ownership must not be vague. Someone must own the model, someone must validate it, someone must approve use and someone must monitor the outcome.

The population in scope is model developers, model owners, validators, compliance teams, credit-risk policy owners, technology owners, product owners, governance committees, internal audit and supervisory reviewers. Testing must reflect the population actually affected by the model. Clean demonstration examples are not enough. Banking populations include missing data, thin files, local policy exceptions, manual overrides, legacy records, vulnerable customers, new products, rejected applicants and changing economic conditions.

The output may support application scoring, limit setting, pricing, referral, adverse action notices, compliance review, model approval, documentation review, audit evidence or regulatory response. The risk level changes when the same model moves from research to decision support, then from decision support to automated action.

Evidence and source material

Relevant evidence includes model purpose, business use case, model owner, methodology, training data, feature list, assumptions, limitations, performance tests, fairness tests, validation report, implementation evidence, approval minutes, monitoring plan, and retirement criteria. Evidence must be current, traceable and fit for the question being asked. A policy document, model metric, explanation output, validation report or approval note is useful only when the bank can show source, version, owner, date, limitation and approved use.

For credit and fair lending topics, evidence also needs customer-outcome context. A model that performs well at portfolio level can still create unacceptable outcomes for a subgroup, a product segment, a pricing path or a manual referral population. Aggregate accuracy does not remove the need for segment-level challenge.

For model approval topics, evidence must connect the business purpose to the technical method. A validator should be able to see why the model was built, what data it uses, how it was tested, what limitations remain, what risks were accepted and how those risks will be monitored after release.

Control expectations

Controls should include documentation standard, model inventory linkage, developer sign-off, independent validation, limitation register, approval committee, implementation control, change-control evidence, monitoring thresholds, issue management, periodic review, and audit pack retention. These controls make the difference between a useful model and an uncontrolled model. The bank should know what must be documented before use, what must be validated independently, what must be approved by governance and what must be monitored in production.

Control design should be proportionate to materiality. A low-risk internal research tool does not need the same approval pack as a model that affects credit access, pricing, limits, regulatory reporting or customer communication. But once the model can influence a material banking outcome, casual governance is not enough.

Controls should also define the response when something is wrong. That may mean restricting use, forcing manual review, changing thresholds, updating reason codes, remediating documentation, retraining users, opening an issue, notifying a committee or stopping the model until the gap is closed.

How AI and ML can be adopted

Useful AI adoption includes summarising model packs, detecting missing documentation, mapping controls to evidence, tracking validation findings, preparing committee notes, and monitoring approval conditions. These are support uses first. AI can help find weak documentation, monitor patterns, summarise validation packs, detect proxy risk, compare outcomes and prepare governance material. It should not quietly replace the bank's legal, compliance, validation or approval judgement.

A sensible adoption path starts with controlled analysis and documentation support, then moves into validated decision support, then into restricted automation only when governance, monitoring, fallback and accountability are mature. The higher the customer or regulatory impact, the stronger the approval boundary must be.

The bank should write the model's role in operational language: score, explain, classify, recommend, refer, approve, decline, price, notify, document, monitor or escalate. Each verb carries a different control burden. If the bank cannot name the verb precisely, it cannot govern the use precisely.

Validation and challenge

Validation should review concept, data, methodology, assumptions, implementation, outcome quality, limitations, fairness, explainability, operational use and monitoring design. For banking AI, validation is not a final signature at the end. It is a structured challenge to whether the model is fit for the stated purpose.

Effective challenge means the validator can question the developer, the business owner, the data source, the training sample, the feature logic, the testing design, the reason-code mapping, the customer impact and the proposed monitoring thresholds. Challenge should be documented, answered and closed with evidence.

A model may pass technical accuracy tests and still need restrictions. It may be acceptable for analyst prioritisation but not for automatic decline. It may be acceptable for one product but not another. It may be acceptable in one jurisdiction but not another. Validation should make those boundaries visible.

Customer, compliance and conduct impact

The direct wrong outcome is the bank uses a model without a defensible record of purpose, data, assumptions, limitations, validation, approval conditions, monitoring thresholds or accountable ownership. That is why this topic should be studied as customer-impact control, not only model governance theory. Credit AI can affect access, price, limit, explanation, complaint handling and trust. Compliance AI can affect evidence, escalation and regulatory position.

A bank must ask who is affected when the model is wrong. Is a sustainable applicant declined? Is an unaffordable customer approved? Is a protected group disadvantaged? Is a reason code inaccurate? Is a reviewer over-trusting the explanation? Is a governance committee approving a model without seeing a key limitation?

Conduct risk appears when the model creates pressure, exclusion, opacity, delay, poor explanation or weak remediation. The bank should treat those outcomes as control issues, not as cosmetic issues in the user interface or documentation wording.

Diagram walkthrough

The diagram follows five control steps: Model purpose, Documentation pack, Validation evidence, Approval decision, and Monitoring plan. Read it left to right. It starts with the model or regulatory use case, moves through testing and governance, and ends with accountable use and retained evidence.

Each box is a bank control point. The implementation should name the owner, input, rule, evidence, review point and limitation at every step. If one box cannot be explained clearly, the model is not ready for high-trust banking use.

Bank-ready checklist

Before using this topic in production, ask whether the model purpose is clear, the legal classification is understood, the population is defined, the data is governed, the validation is independent, the customer impact is tested and the approval boundary is documented.

Then ask whether the monitoring thresholds, override process, adverse action reason logic, issue management, change control, audit pack and retirement criteria are in place. Banking AI governance is only strong when the bank knows what happens after approval, not just before approval.

If the answers are strong, the model can support banking work with discipline. If the answers are weak, the model may still produce a result, but the bank should not treat that result as controlled evidence for customer, regulatory or financial impact.

Source anchors for accurate study

Federal Reserve SR 26-2, dated 17 April 2026, supersedes SR 11-7 and SR 21-8 and attaches revised model-risk guidance for banking organisations.

The 2026 interagency model-risk guidance focuses on model development and use, validation and monitoring, governance and controls, and vendor or third-party model products.

The revised model-risk guidance says model risk depends on inherent risk, exposure, purpose and use, and that practices should be tailored to the bank's risk profile and model usage.

The EU AI Act treats AI systems used to evaluate the creditworthiness of natural persons or establish a credit score as high-risk, except where the system is used for financial fraud detection.

The EU AI Act high-risk framework includes controls around risk management, data governance, technical documentation, record keeping, transparency to deployers, human oversight, accuracy, robustness and cybersecurity.

ECOA and Regulation B require creditors to provide specific and accurate reasons for adverse action; using a complex algorithm does not remove that obligation.

U.S. Regulation B, 12 CFR 1002.9, requires specific principal reasons for adverse action in covered credit decisions, including when a creditor uses an AI model. CFPB Circular 2022-03 was withdrawn on 12 May 2025; do not cite it as current guidance. Primary sources: https://www.consumerfinance.gov/rules-policy/regulations/1002/9 and https://www.consumerfinance.gov/compliance/guidance/withdrawn-guidance/.

Federal Reserve public remarks on AI in the financial system emphasise that AI is not exempt from existing laws and risk-management expectations, including fair lending, privacy, cybersecurity, third-party risk and model risk.

NIST AI RMF describes trustworthy AI through characteristics including valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.

Banking practice note: legal classification

For model documentation and approval packs, legal classification is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from model purpose through documentation standard and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

AI adoption should strengthen governance here. It should make weak evidence easier to see, proxy risk easier to challenge, documentation gaps easier to find and unstable outcomes easier to monitor. It should not become a way to hide uncertainty behind dashboards, explanations or committee slides.

A good implementation records model owner, model version, source data, feature list, intended use, population, limitation, validation result, approval condition, user action, override decision, monitoring result and issue history. That record is what makes the topic useful to risk, compliance, technology, audit and business owners.

Banking practice note: model purpose

For model documentation and approval packs, model purpose is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from business use case through model inventory linkage and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: customer population

For model documentation and approval packs, customer population is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from model owner through developer sign-off and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: source authority

For model documentation and approval packs, source authority is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from methodology through independent validation and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: training data

For model documentation and approval packs, training data is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from training data through limitation register and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: feature governance

For model documentation and approval packs, feature governance is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from feature list through approval committee and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: protected-class testing

For model documentation and approval packs, protected-class testing is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from assumptions through implementation control and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: proxy-variable review

For model documentation and approval packs, proxy-variable review is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from limitations through change-control evidence and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: adverse action reasons

For model documentation and approval packs, adverse action reasons is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from performance tests through monitoring thresholds and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: reason-code mapping

For model documentation and approval packs, reason-code mapping is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from fairness tests through issue management and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: explainability limits

For model documentation and approval packs, explainability limits is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from validation report through periodic review and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: independent validation

For model documentation and approval packs, independent validation is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from implementation evidence through audit pack retention and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: effective challenge

For model documentation and approval packs, effective challenge is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from approval minutes through documentation standard and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: approval committee

For model documentation and approval packs, approval committee is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from monitoring plan through model inventory linkage and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: documentation quality

For model documentation and approval packs, documentation quality is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from retirement criteria through developer sign-off and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: implementation evidence

For model documentation and approval packs, implementation evidence is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from model purpose through independent validation and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: monitoring threshold

For model documentation and approval packs, monitoring threshold is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from business use case through limitation register and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: override review

For model documentation and approval packs, override review is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from model owner through approval committee and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: complaint feedback

For model documentation and approval packs, complaint feedback is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from methodology through implementation control and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: customer harm

For model documentation and approval packs, customer harm is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from training data through change-control evidence and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: regulatory evidence

For model documentation and approval packs, regulatory evidence is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from feature list through monitoring thresholds and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: third-party dependency

For model documentation and approval packs, third-party dependency is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from assumptions through issue management and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: change control

For model documentation and approval packs, change control is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from limitations through periodic review and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: incident response

For model documentation and approval packs, incident response is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from performance tests through audit pack retention and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: retirement criteria

For model documentation and approval packs, retirement criteria is not optional detail. It decides whether the bank can explain the model, defend the use and protect the customer. A model may be fast and accurate in a narrow test, but banking approval depends on whether the result is suitable for model approval, validation evidence, governance committee review, audit readiness, regulatory response, change control and business accountability.

The practical test is to trace one item from fairness tests through documentation standard and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: legal classification

The practical test is to trace one item from validation report through model inventory linkage and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: model purpose

The practical test is to trace one item from implementation evidence through developer sign-off and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: customer population

The practical test is to trace one item from approval minutes through independent validation and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: source authority

The practical test is to trace one item from monitoring plan through limitation register and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: training data

The practical test is to trace one item from retirement criteria through approval committee and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: feature governance

The practical test is to trace one item from model purpose through implementation control and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: protected-class testing

The practical test is to trace one item from business use case through change-control evidence and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: proxy-variable review

The practical test is to trace one item from model owner through monitoring thresholds and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: adverse action reasons

The practical test is to trace one item from methodology through issue management and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: reason-code mapping

The practical test is to trace one item from training data through periodic review and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: explainability limits

The practical test is to trace one item from feature list through audit pack retention and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: independent validation

The practical test is to trace one item from assumptions through documentation standard and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: effective challenge

The practical test is to trace one item from limitations through model inventory linkage and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: approval committee

The practical test is to trace one item from performance tests through developer sign-off and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: documentation quality

The practical test is to trace one item from fairness tests through independent validation and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: implementation evidence

The practical test is to trace one item from validation report through limitation register and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Banking practice note: monitoring threshold

The practical test is to trace one item from implementation evidence through approval committee and into the business use. If the team cannot show that path without guesswork, the model pack is not mature enough for serious banking reliance.

Rebuild the decision from the pack

An approval pack should identify intended use, eligible population, source and label definitions, feature and model versions, validation cohorts, limitations, policy integration, monitoring thresholds and fallback owner. Attach evidence rather than only conclusions: manifests, test results, sampled decision traces and independent challenges. A model validated for one payment channel should not silently expand to another with different device availability.

For a proposed credit release, ask an independent reviewer to reproduce a scored application, a missing-data referral and a rollback path. Record unresolved findings, accepted limits, approver and expiry or review date. A later source-code change that preserves the API but changes income meaning needs an impact assessment. Keep the approved artifact and its inputs linked to production decision IDs so the pack explains what was actually deployed.