The question "which of our systems cross from the agent runtime into the core claims system, and what stands in the path?" takes an afternoon to answer from a reference document, and the answer is out of date when it is finished; put to a model kept as code, it takes seconds and is checked on every change. This chapter shows how security architecture becomes executable design: the architecture model kept as code, security properties on its elements, policy as code that enforces them, and the pull request as the unit of architectural change. It concerns two of the four shifts. Shift 1, from documents to code, is the subject of the whole chapter. Shift 2, from gatekeeper to boundary designer, enters through the review triggers and policy checks that delegate routine decisions to the pipeline and keep human review for changes that alter a boundary.
It builds on Architecture as Code (Chapters 6, 9, 10 and 11) (161, Nordqvist, 2025) and AI Platform and Security, Chapters 4, 5 and 17 (163, Nordqvist, 2026), and describes what the security architect does to own those artefacts, leaving the control catalogue to Chapter 9 and threat models to Chapter 6.
A reference document fails the architect in four ways: it cannot be queried for exceptions to its own sentences, it cannot be checked against the estate, it cannot change in step with systems that have other owners and release cycles, and a box in a diagram is not an element with an owner, a classification and a trust zone that a program can read.
Primary topics explored
- From the reference document to the model
- Modelling the estate as code
- Policy as code for architecture
- Assure once, comply many, at design time
- The pull request as the unit of change
- Decision records beside the code
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 5: Security Architecture as Code: From Documents to Executable Design in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 31 drawn from the manuscript.