This appendix collects the artefacts that the chapters introduce, each identified as NN_CODE_XXX, where NN is the chapter that introduces it. They are design and governance records kept under version control, never attack tooling. Fifteen artefacts are shown, one for each kind of record the transformed security architect keeps: roles and decision rights, decisions and exceptions, controls and their mapping to law, boundaries, identities and stop paths, recovery, procurement, AI mandates, review and competence.
All identifiers refer to the fictional organisations Nordvik Region and Hansa Mutual and are illustrative; every YAML listing parses as written, which the appendix checks in the last section. The artefacts agree with docs/EXAMPLE_ORGANISATIONS.md, and several appear in shorter form in their chapters. Appendix B lists every template and tool by chapter.
Most artefacts share four features. They have an owner, a named role and never an agent; a version or review date, so that the record expires unless someone renews it; a link to a decision record, so that its origin can be found; and a test or evidence field, so that a statement in the record can be checked against the estate. Where an artefact grants an agent a permission, it states the usage mode and the autonomy level, and Level 4 Autonomous is never granted for an irreversible action. Values such as lifetimes, limits and dates are examples chosen to make the record readable; an organisation sets its own from its risk appetite and records the choice.
Primary topics explored
- How to read the artefacts
- Index of examples
- Artefacts
- Checking the artefacts
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Appendix A: Appendix A: Code Examples: Role, Control and Mandate Artefacts in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Appendices” and is one of 31 drawn from the manuscript.