In the scenario of Chapter 18, the group chief information security officer of Hansa Mutual reports to the executive board on 31 March 2027. The episode is illustrative, like everything about Hansa Mutual in this book. The first stop drill of the IT-operations agent, the agent that executes pre-approved operations with write access to the group's production systems, took 17 minutes against a budget of 5. The alert reached a duty analyst who did not hold the decision, and the 15-minute access tokens outlived the revocation (4, Nordqvist, 2026).
The board does not ask how the agent works. It asks one question, for every agent with write access to production: how long does it take to stop it. Then it does something the landscape model records on the same date. The decision right over write access to production, which until that morning sat with the head of the group AI platform, moves to the executive board itself. Nothing about the agent changes: its permissions, its playbook and the policy that checks each of its actions stay as they were. What changes is who holds the seat, and the board wants a number, in minutes, every quarter.
That meeting contains the chapter. A decision right is the authority to say what an AI use may do, to change that, and to stop it. Evidence is how anyone, inside the organisation or outside it, knows that what was decided is what happens. A decision right without evidence is a hope; evidence without a decision right is a report nobody has to act on. Contour draws them as two of its six standard views. V4, the decision-rights view, shows for every unit who decides, up to which autonomy level, for which class of action, and whether anything outside the model enforces the limit. V5, the evidence view, shows where the proof comes from and whether the system produced it or a person declared it. This chapter teaches both, shows how a board member, an auditor and an engineer read them, and ends with a one-page review and a record you can copy.
Primary topics explored
- The seat
- The ceiling
- The diamond and the stop path
- Evidence against attestation
- Reading the two views
- What to do
About Landscape
Landscape is a companion to The Transformed Architecture. It examines what happens when artificial intelligence takes the manager's chair: algorithmic management of direction, evaluation, consequence, development and care, the effects on people, the management of AI agents, Europe's legal answer, and how to design an accountable AI boss, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat and The Transformed Security Architect.
Executives, line managers, HR and people leaders, works councils and trade unions, public employers, architects and AI governance leads, data protection and legal officers, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 17: Decision Rights and Evidence: Who Decides, and How We Know in Landscape gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Drawing Your Landscape” and is one of 26 drawn from the manuscript.