A security architecture that only its author understands protects nobody for long. Its boundaries, controls and evidence are used by people who never read the model: boards, supervisors, auditors, engineers and suppliers. The traditional answer is a different document for each, and the documents drift apart within a quarter. This chapter describes the answer of the transformed security architect: one architecture, held as a model, a control catalogue and an evidence manifest, from which every audience's view is generated, so that no audience is told something the others cannot check.
The chapter concerns Shift 1, from documents to code, because a view is a query over versioned artefacts, not a document someone maintains, and Shift 3, from periodic to continuous, at machine speed, because the properties it reports are measured continuously. It also touches Shift 2, from gatekeeper to boundary designer, in the messages gates send to engineers, and Shift 4, from sole author to conductor of an AI team, in how the architect says honestly what AI contributed (Chapter 13).
The standard for architecture description says that an architecture is described through views addressing the concerns of identified stakeholders, with the relations between views recorded so that they can be checked for consistency (28, ISO/IEC, 2022). Rozanski and Woods build their method on viewpoints chosen for stakeholders, with perspectives such as security cutting across them (73, Rozanski & Woods, 2011). The C4 model draws structural views from one model (58, Brown, n.d.), which Structurizr expresses as text (59, Structurizr, n.d.), as Architecture as Code (Chapter 6) showed (161, Nordqvist, 2025); FINOS CALM adds machine-checkable controls (60, FINOS, n.d.). What is new is the consequence of Shift 1: when the model, the control catalogue (Chapter 9) and the evidence manifest are all code, a pipeline can enforce the consistency the standard demands.
Primary topics explored
- One architecture, several audiences
- Boards and management bodies
- Supervisors
- Auditors
- Engineers and product teams
- Suppliers
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 19: Communicating Security Architecture: Boards, Supervisors, Auditors and Engineers in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Role in the Organisation” and is one of 31 drawn from the manuscript.