A 32-stage LLM security lifecycle model shows regulatory evidence concentrates where systems are visible, not where decisions are made.

arXiv 2608.03626 restructures the lifecycle around security boundaries rather than workflow efficiency: 32 stages across Data, Model, Distribution and Application layers plus a 12-stage LLMOps pillar and 9-category governance pillar, with 13 stages newly separated because they expose distinct concerns. Mapped against NIST AI RMF, the EU AI Act, and ISO/IEC 42001, it surfaces a structural gap: governance evidence clusters at deployment-facing stages visible to regulators, while data selection, alignment strategy, and capability boundaries get decided at development-facing stages with the lowest regulatory visibility. That's a compliance-theater diagnosis with a map attached.