Definition
Policy-version binding is the practice of recording which version of a policy was used to evaluate a release decision. When policy changes, it does not retroactively alter the basis for past decisions. Each decision is judged against the policy version active at the time.
This matters because software policies evolve. A release that was compliant under last quarter's policy may not be compliant under this quarter's policy, and vice versa. Without version binding, an organization cannot defend or reconstruct why a decision was made.
Why it matters
Auditors, regulators, and incident reviewers routinely ask what standard applied at the time of a decision. Policy-version binding answers that question precisely. It also prevents the common failure mode where a team updates policy and then discovers that historical decisions no longer look defensible under the new standard.
Example
A company's release policy requires two independent scanner passes for critical vulnerabilities. In version 1.2, one pass plus reviewer attestation was sufficient. A release approved under version 1.2 remains defensible on that basis, even after the policy is tightened to version 1.3. The decision record preserves the policy version and the evidence evaluated.
Related terms
- Release-evidence verification — The practice of determining whether the evidence behind a software release decision satisfies versioned policy.
- Defensible release decision — A release decision whose basis can be reviewed and explained long after the decision was made.
- Proof artifact — A record that can be independently examined to support or refute a claim about a software release.
- Evidence-backed release — A software release whose approval is supported by qualified evidence evaluated against versioned policy.