Most AI deployments that fail in production don't fail at the model layer. They fail at the change-control layer. Someone updated a prompt and didn't tell anyone. The model version drifted between staging and production. The eval suite hasn't been run since release minus three. None of those are AI problems; they are configuration-management problems applied to artifacts that were not previously under configuration management.
CMMI Level 3 process maturity answers all three by default. We already run configuration management, peer review, and process appraisal on code. Applying the same to model versions, prompts, tools, and evals is a straightforward extension. The agent doesn't ship until its prompt is checked into the same repository as the code that invokes it. Eval results are part of the release artifact. Drift detection on prompts and tools runs in CI.
What changes for AI specifically is the artifact set, not the process. We add four new artifact types to the baseline: model card, prompt revision history, tool catalog with versioned schemas, and eval report with pass rates. Every release commits a new instance of each. Every reviewer can see the diff between releases and challenge it.
The advantage shows up at acceptance review. A program that can produce a versioned eval report, a documented loop posture, and a configuration management trail for every artifact has answered most of the questions a security control assessor will ask. A program that can't will spend the next quarter producing those artifacts after the fact, under deadline pressure, against an angry SCA.
This isn't glamorous. It's not the part of the AI conversation that gets written up in TechCrunch. It's the part that decides whether an agentic system makes it through acceptance review on a real DoW program. For our customers, it's the moat.