Release as a governance event
A material release changes who can access a system, what harms become possible and which controls remain reversible.
Evidence pack
A release package should combine evaluations, residual-risk assessment, security review, control verification, incident readiness and named owner acceptance.
Decision record
The final decision should preserve what was known, what assumptions were made, who approved the release and what conditions trigger reconsideration.