Chapter 7 described the life of a model. This chapter widens the frame to the delivery loop through which an organisation changes every part of an AI system, from code and data to prompts, indexes, policies, and agent skills. It shows why revision management is the loop's backbone, how security is built into each stage, how skills and agents become governed shared assets, and how the loop evidences the ISO/IEC 27001:2022 management system. Architecture as Code supplies most of the machinery (72, Nordqvist, 2025).
A model lifecycle asks whether a model version is fit to serve; a delivery loop asks whether the organisation can change any part of an AI system safely, many times a week, and prove afterwards what it changed. Most changes to a production AI system are not new weights but a revised prompt, an index refresh, a guardrail threshold, a new connector, or a vendor model update that arrives without a commit.
The term DevSecMLOps is clumsy, and I use it deliberately: it insists that development, security, machine learning, and operations share one loop instead of four handovers. Google's DevOps Research and Assessment programme, known as DORA and not to be confused with the EU's Digital Operational Resilience Act, surveyed nearly 5,000 practitioners for its September 2025 report: 90 per cent used AI at work, more than 80 per cent believed it had increased their productivity, and 30 per cent reported little or no trust in AI-generated code (136, Harvey & DeBellis, 2025). It framed AI as an amplifier of existing strengths and weaknesses, and DORA's AI Capabilities Model names strong version control as one of seven capabilities that make the amplification positive, because "your version control system becomes a critical safety net" (137, Storer & DeBellis, 2025).
Primary topics explored
- From a model lifecycle to a delivery loop
- The stages of the loop
- Revision management as the backbone
- Security throughout the loop
- Operations and feedback
- People in the loop
About AI Platform and Security
AI Platform and Security is Book 3 of The Transformed Architecture. It shows how large European enterprises and public authorities build, secure and operate the platform on which artificial intelligence runs: data, models and DevSecMLOps, retrieval and agents, infrastructure and sovereignty, AI security engineering, evaluation, observability and cost.
The companion volume AI Governance covers risk management, governance, assurance, organisation and leadership; Architecture as Code supplies the underlying discipline.
Platform engineers, security architects, MLOps teams, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 8: Setting Up an Effective DevSecMLOps Loop in AI Platform and Security gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Data, Models and DevSecMLOps” and is one of 29 drawn from the manuscript.