Every later chapter asks the security architect to design boundaries, govern agents or brief a management body, which fails for a role whose authority exists only in a job description and colleagues' goodwill. This chapter defines the transformed role as a role charter, kept as code in roles/security-architect.yaml, that states the mandate, the accountabilities, the decision rights with their time limits, the escalation paths, the artefacts the role owns and what the role does not do. As the book's reference, the charter concerns all four shifts: it is an instance of Shift 1, from documents to code; the written instrument of Shift 2, from gatekeeper to boundary designer, replacing the right to say yes or no at a gate with rights over boundaries and their delegation; the source of the decision time limits that Shift 3, from periodic to continuous, at machine speed demands; and the fixed point of accountability when, under Shift 4, from sole author to conductor of an AI team, the architect verifies work that agents draft. It also connects the role to management bodies' duties under NIS 2, DORA and the AI Act.
A job description describes a person and is rarely read after hiring. A charter describes what the role may decide, must be asked, may stop and answers to, and it must be precise enough to settle a contested decision.
The European frameworks describe the person rather than the rights: ENISA's Cybersecurity Architect profile (40, ENISA, 2022) and SFIA 9's skills and levels of responsibility (42, SFIA Foundation, 2024) serve competence and hiring (Chapters 21 and 22), but neither says who may block a tender annex that lacks a stop path, or who decides between two agents' conflicting egress proposals. Weill and Ross defined IT governance as specifying the decision rights and accountability framework that encourages desirable behaviour (167, Weill & Ross, 2004), and ISO/IEC 27001 clause 5.3 asks top management to assign and communicate responsibilities and authorities for security roles, with ISO/IEC 27002 controls 5.2 and 5.3 on roles and segregation of duties (23, ISO/IEC, 2022) (24, ISO/IEC, 2022).
Primary topics explored
- Why a charter, and why as code
- Mandate
- Accountabilities
- Decision rights
- What the role does not do
- The charter and the management body
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 4: The Transformed Role Defined: Mandate, Accountabilities and Decision Rights in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Role in Question” and is one of 31 drawn from the manuscript.