This chapter serves one activity: deciding what to believe, and what to do about it, when the evidence is contested or lies in the future. It collects the tools that the series uses for claims about AI threat and for claims about how a function will look in ten years. They fall into three of the four kinds that Chapter 1 defines. The artefacts are the graded evidence record, the capability snapshot, the AI threat register with its schema and entries, the trope catalogue, the horizon registers of five volumes and a set of control artefacts that hang from register entries. The methods are the evidence ladder, the labels observable, expected and speculation, the constructive debate in four steps and the practical guides that turn each of them into a routine. The third-party tools are documents that developers publish and that a deployer reads as evidence: system cards and a preparedness framework. There is no own tool in this chapter; every tool here is a text, a record or a procedure.
The tools come from AI Governance, which introduced the labels and the horizon register (2, Nordqvist, 2026); from AI Threat, which built the evidence ladder, the register and most of the artefacts (5, Nordqvist, 2026); from The Transformed Security Architect (6, Nordqvist, 2026); and from AI Blue, AI Purple and AI Operations, which each applied the same register to a function of their own (8, Nordqvist, 2026) (9, Nordqvist, 2026) (10, Nordqvist, 2026). AI Red Team contributes one method, the use of decoys as detections (4, Nordqvist, 2026).
The chapter follows the order in which the tools are used. A claim is framed and graded (the first family). Its conclusion is held in a register with an owner, controls and triggers (the second). Controls attached to the entries have their own artefacts (the third). A disagreement about the claim is staged as a debate that ends in a decision (the fourth). And a view of the future is kept as a horizon register that can be wrong in a reviewable way (the fifth). Figure 23.1 shows how the pieces connect.
Primary topics explored
- Framing and grading a claim
- Holding conclusions: the AI threat register
- Controls and evidence that hang from register entries
- Debating a claim: the constructive debate in four steps
- Looking ahead: labels and horizon registers
- Across the degrees of delegation
About Tools
Tools is a companion to The Transformed Architecture. It collects the tools that Books 1 to 10 describe in one reference, organised by what the practitioner is doing: artefacts (templates, manifests, records), own tools, third-party tools and standards, and methods. Each entry says what a tool is for, when to use it, what it needs and produces, and where the book that defines it explains the reasoning. The book covers choosing, adopting and retiring tools, architecture and delivery, governing AI, securing and testing, operating, agents and autonomy, and people, organisation and society, for European enterprises and public authorities. It comes with a template library, an inventory, three web tools and the Toolbox Maturity Method.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss, AI Blue, AI Purple and AI Operations.
Architects and security architects, CIOs and CISOs, platform and operations leads, heads of governance, risk, compliance and third-party risk, AI governance and AI platform teams, red, blue and purple team leads, boards and management bodies, procurement and vendor managers, supervisors and auditors, works councils and unions, data protection officers, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 23: Tools for Weighing Evidence: Threat Registers, Debate and Foresight in Tools gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “People, Organisation and Society” and is one of 29 drawn from the manuscript.