A transit fare model skips validation environment and trains/tests only in production. What should the auditor recommend?

Segregating development, validation, and production environments across the transit fare AI lifecycle works because environment isolation is a foundational MLOps and change-control pattern. Training and experimenting in production couples unstable model work to live fare calculations, customer charges, and operational APIs. Distinct validation environments enable representative testing, performance comparison, and approval without contaminating production data or behavior. The correct recommendation restores lifecycle segregation so build, validate, and operate remain intentional stages rather than a single risky sandbox.

Using live production data to train the model while keeping only validation in a development copy fails because training still runs directly against live fare calculations and customer charges; isolating validation alone does not remove the risk that unstable training work poses to production. Performing validation testing inside the production environment with live fare transactions fails because it exposes real customers and live fare calculations to unproven model behavior; validation belongs in an isolated environment, not in the live system. Consolidating training and validation in development to streamline deployment fails because it removes the independent validation gate, letting untested fare-model changes flow straight into production and risking a costly fare incident.

Exam caveat: shared underlying platforms are acceptable if logical segregation, access control, and promotion paths remain enforceable; “separate environments” is about control boundaries, not necessarily three unrelated clouds. Operational check: inventory where training jobs run, block production credentials from development notebooks, require validation-environment sign-off before any fare-model promotion, and test rollback in non-production first.