Reviewing and implementing changes to the AI agent requires two additional roles: maintainers and a generative AI (gen AI) committee. All proposed updates are classified to ensure the review rigor matches risk:

• Type A—Minor edits/clarifications: typos, wording clarifications, formatting adjustments. Approved by relevant maintainer(s) and the communications department (if necessary).
• Type B—Adding/adjusting tests and examples: New evaluation scenarios, rubric examples, or minor scoring guidance changes with minimal impact on AI tool outputs. Approved by relevant maintainer(s) and the communications department (if necessary); spot-checked by another lead when feasible.
• Type C—Control or gate change: Changes to required checks, required approvals, or required artifacts. Approved by maintainer and the communications department, reviewed by the gen AI committee, and signed off on by accountable owner.
• Type D—Major framework change: Structural changes to the framework (new principles, new evidence tiering approach, major re-scoping, etc.). Approved by maintainer and the communications department, reviewed by the gen AI committee and an independent reviewer, signed off on by accountable owner. Consider a wider stakeholder comment period if necessary.

Standard Contribution Workflow

1. Submit: Contributor or other member of the committee submits a change proposal using the template.
2. Triage: Maintainers acknowledge and classify changes (type A–D), assign an owner, and set a target release.
3. Review: Relevant leads review for correctness, scope, and alignment with evaluation/security/transparency/responsible agentic AI expectations.
4. Make necessary updates: For type B–D changes, required tests and documentation updates are run or updated (e.g., evaluation rubrics, security test categories, release artifact template).
5. Decide: For type A and B changes, the maintainer decides. For type C and D changes, the gen AI committee decides and documents the rationale; the accountable owner signs off on accepted risks/exceptions.
6. Merge and version: Changes are merged into the authoritative repository or location, and the toolkit version is incremented.
7. Release artifact: A release note or audit trail summary is produced for the change set and shared with toolkit users in some form.
8. Monitor and learn: Maintainers and relevant lead(s) collect feedback from pilots and projects, log issues, and incorporate this information into future releases.

Download the template. 

Cadence and Operating Rhythm

The recommended cadence balances speed and quality:

• Monthly to quarterly: Maintainer triage + minor releases (type A/B).
• Quarterly: Planned release with bundled improvements and any type C items requiring committee review.
• Annually (or at major release): Review of security test categories and governance effectiveness; refresh of templates and training as needed.