The gate record template, G1 to G5.

Name each holder in advance, with a deputy, so that the gate cannot be bypassed on the day the person is away (Chapter 5).

Separations. Two hold at any size; the rest are the discipline's placements (Chapter 5). Everything else may combine: the data owner at G1 may be the platform owner at G4; where there is no governance office, the executive who signs at G3 may hold the G5 decision.

A gate requires six elements, and a checkpoint lacking any one is a review, not a gate: entry criteria, an accountable role, a decision, exit criteria, an evidence record and a rejection path (Five-Gate). Every gate writes one record with fixed minimum fields (Five-Gate).

Two rules for entry criteria (Five-Gate, Chapter 5). Entry criteria name artifacts that either exist or do not; policy, training, intent and scheduled work do not satisfy one. Where a criterion cannot be met and the institution intends to proceed anyway, the gate is recorded as passed with conditions, each condition dated and owned by a named person. An unrecorded exception is a skipped gate.

R12 to R14 by gate. Chapter 6 reads the five records in the declaration's shape as follows.

For each entry criterion record whether the artifact exists, and its identifier so that it can be retrieved.

G1 Data and Design

Purpose (Five-Gate): "To establish that the AI system may be built at all on the data and components proposed: that the data is classified and permitted, that its lineage is provable, and that any third-party component has been assessed."

Exit, on passage. The system may be built, trained or configured against the classified data, and may not be exposed to any consumer.

Rejection. The system returns to design, with the record naming which criterion failed. A system rejected for an unclassified data set does not re-enter G1 until the classification exists rather than until it is scheduled.

Evidence. The record cites each entry artifact.

The G1 entry for a corpus (Chapter 8, for a retrieval-backed system). Chapter 8 adds no download of its own; its fields are carried here. Write one row for every data set the system retrieves from, by name.

Where a line cannot be filled, the system has not entered G1, and that is the first finding of the readiness plan (Chapter 8). E-23's data principle asks that development data be accurate and fit-for-use, relevant and representative, traceable and timely; on the book's reading it reaches a corpus, because a corpus is data the system processes to generate results.

G2 Validation

Purpose (Five-Gate): "To establish that the system performs as claimed, under review by someone with no stake in it passing."

E-23's reviewer recommends to the approver. Converting that recommendation into a gate decision, so that a system the validator will not accept never reaches G3, is a step the discipline takes and the guideline does not.

The four-part statement (Chapter 3): what the validation actually proved.

The G2 evidence file for a system with no stable output (Chapter 3). The list belongs to the discipline's method; what E-23 asks for is the review, its extent set by the rating. Cite each by identifier.

Exit, on passage. The system may be presented for approval, and its permitted use is the use the validation examined, and no wider.

Evidence. The record cites the validation report by identifier.

G3 Approval

Purpose (Five-Gate): "To establish that a person with institutional authority has accepted the system into production use, on the evidence, and is answerable for that acceptance."

OSFI's letter adds that approvals are obtained before a model change is implemented and after periodic reviews, with the institution choosing the stages (E-23).

Where a committee reviews. Nothing in the discipline forbids the committee E-23 permits; it cannot be recorded as the accountable role, because the question asked after a failure is which person is answerable, a narrower rule than the guideline's. The committee reviews, challenges and recommends; the executive named in the decision rights decides and signs (Chapter 5).

Who may loosen a boundary (Chapter 5). For each boundary the approval sets, write the two dates and the two names. A metric dated later than its boundary marks a review never held; a second name junior to the first marks a ceiling that can rise without the authority that fixed it.

Exit, on passage. The system is approved for the stated use, for a stated period, subject to any recorded conditions, and the approval carries an expiry or a revalidation trigger.

Rejection. The system returns to G2 with the reason recorded.

Evidence. The record names the person. A record naming a committee is not a gate passage record (the discipline's rule).

G4 Deployment

Purpose (Five-Gate): "To establish that the approved system is being placed into production in the configuration that was approved, with its guardrails in force and its exposure bounded."

E-23 expects deployment to follow "clearly documented procedures that outline deployment steps, stakeholder responsibilities, approval hierarchies, change control, monitoring frameworks and exception handling including overlays", with production tests, consistent data and risk assessments before deployment.

Staged exposure. Each stage carries its own entry condition, and the record states what triggers the next stage and what triggers a return (Chapter 5).

The evidence layer's controls, confirmed for this system (Chapter 13). Every gate record is generated from the evidence layer, so its controls are platform work, in force before any system's first gate record is written; G4 confirms them for this system.

Exit, on passage. The system may serve production traffic within the exposure the record states.

Evidence. The record cites the approved configuration, the rollback test and, for the evidence layer, the record of each control confirmed for this system.

G5 Operation

Purpose (Five-Gate): "To establish that the system in production remains within the conditions under which it was approved, and that the institution will know promptly when it does not." "G5 is the only gate that is not passed once."

The decision at every trigger. At G5 the decision is taken on entry and then again at every revalidation trigger. Its exits are retirement, rollback or loop-back to G2. The record is written on entry and dated again at each trigger.

Rejection. A system that cannot arm its triggers or cannot be monitored against its approval conditions returns to G4, rather than being left running while monitoring is arranged.

Rollback: G5 to G4

The system is withdrawn from production traffic by a decision of the person accountable at G5 or at G3. Rollback does not invalidate the G3 approval: the system remains approved, is not in production, and returns by passing G4 again (Five-Gate, Chapter 5).

A withdrawal recorded only in a deployment log is not a rollback.

Loop-back: G5 to G2

An incident that calls the system's fitness into question reopens G2, and does not merely produce a fix. Which incidents trigger loop-back is defined in advance in the trigger register, not decided after the incident by the people whose work would be reopened. E-23's list of events that should prompt a review is where that register starts.

Retirement

A recorded decision by the person accountable at G3 or a successor in the role, with the evidence records of every gate retained for as long as the institution's obligations require (Five-Gate). Decommissioned models stay on the inventory for a period the institution considers reasonable (E-23).

Read the approval record for four things (Chapter 5). A record that fails the first test failed the gate, whatever the answers to the other three; one person is the discipline's narrower choice inside what E-23 permits.

E-23's inventory schema asks for a "model approver" field and a "next review date" field; a failed approval shows first in those two.

The claim. G3, approval, is the gate to check first: the one everyone believes was passed, because a minute says so.

The test. Read the approval record for one named person, the discipline's narrower choice inside what E-23 permits, then for the validation by identifier, the use and period, and the policy version.

The artifact. Your system on the five gates, with five gate records begun.

nabeelkhan.com/e-23/gate-record. Questions: nabeelkhan.com/contact.