Question: On 'Potential Change Management Controls'

[eskultety]

If I understand correctly

slsa/docs/spec/v1.2-rc1/source-requirements.md

Line 588 in 6ff3cd7

## Potential Change Management Controls

is only meant as a set of additional considerations on top of the highest SLSA level compliance, correct? Is there motivation and intention to make any of the parts mandatory in the future? Or is my current understanding of the section incorrect?

[TomHennen]

It's really just meant as a set of additional things folks can do, and it has generated confusion elsewhere.

We're not currently thinking of making them mandatory. I do wonder if we should either:

1. Cut them (it's not strictly needed)
2. Move them elsewhere as examples of the sorts of controls folks could implement as part of the Enforced Change Management Process.
3. ??

Maybe @zachariahcox has thoughts?

[arewm]

When we discussed these in the past, it was a way for organizations to further indicate their intention in a verifiable way. Approach 2 makes sense in that vein.