AI Platform and Security: the course

All courses / AI Platform and Security

About the course

The course follows AI Platform and Security, Book 3 of The Transformed Architecture, through its six parts. It starts with the foundations: usage modes, regulation as engineering requirements, the reference architecture and AI Decision Records. It then builds the core of the platform, from data products and the model lifecycle to the DevSecMLOps loop, retrieval, agents and integration, decides where the platform runs, and secures it both as a target and against AI as a source of threat. It ends with evaluation, observability, cost, the path from pilot to production and a capability roadmap. It matters because incidents and audit findings trace back less to the model than to what it was allowed to see and do.

After the course the participant can

Classify every AI use by usage mode and name the platform control point and minimum baseline it needs
Translate obligations of the AI Act, the GDPR, NIS 2, DORA and the Cyber Resilience Act into platform capabilities, codified artefacts and evidence
Design a variant of the reference architecture with a gateway, a registry, an evaluation service and a control plane, written as an overlay
Set up revision management in which a release is the signed set of versions evaluated together, with skills and connectors in a governed catalogue
Bound an agent's autonomy with a permission manifest, approval rules and a containment profile enforced outside the agent
Place workloads across cloud and self-hosted tiers with a recorded rule, and route agentic work by information class
Build a linked threat model, a patch-velocity policy and incident playbooks that meet the European reporting deadlines
Operate AI systems with an evaluation suite, drift detection, a cost policy and a codified readiness gate, and sequence the work in a capability roadmap

Who it is for

Platform engineers and platform owners responsible for shared AI capabilities
Security architects and CISOs who must secure AI systems and contain agents
MLOps, LLMOps and data engineering leads
Solution, enterprise and AI architects
Technology leaders in public authorities that procure or operate AI systems

Before the course

Working knowledge of version control, continuous delivery and policy as code, as taught in Architecture as Code
Familiarity with the usage modes and risk classification of AI Governance, or willingness to read the summaries the lessons give
Basic understanding of how large language models, retrieval and tool use work
Access to an inventory, or a rough list, of AI uses in the participant's own organisation

Material

Three ways to run it

The same material in three lengths. Each row of an agenda names the lessons it draws on.

Executive briefing90 minutes

For executives, CIOs, CISOs and heads of platform who decide on investment in an AI platform and its security

A briefing on why the platform, not the model, decides risk and value. It covers the usage modes as demand forecast, the few artefacts that carry most of the control, the two forms of threat from AI, and a roadmap of three stages with a test for each. Participants leave with the questions to ask of their own organisation.

0:00	Why an AI platform is an architectural and security problem, and what each usage mode demands of it Ch. 1, Ch. 2
0:20	The gateway, the registry, the release manifest and the permission manifest: a few artefacts that carry most of the control Ch. 4, Ch. 8, Ch. 11
0:40	AI as source of threat: the collapsing exploitation window, approvals that resist synthetic media, and agents that exceed their mandate Ch. 18, Ch. 19
0:55	Cloud, self-hosted or hybrid: placement as a recorded decision with a drilled second source Ch. 13, Ch. 14
1:10	The eight conclusions and the capability roadmap: one control point and a working stop within six months Ch. 25
1:20	Discussion: the stage tests applied to the participants' own organisation, and first decisions Ch. 24, Ch. 25

One-day seminar1 day

For architects, platform and security practitioners and their managers who need a working overview of the whole book

A day that follows the book from foundations to roadmap with one hands-on block per part. Participants map their AI uses to control points, review a release manifest and a permission manifest, place a workload, run a tabletop on an incident and assess their organisation against the roadmap. The examples are Nordvik Region and Hansa Mutual throughout.

09:00	Lecture: from model choice to platform; the usage modes and their control points Ch. 1, Ch. 2
09:45	Workshop: map five AI uses to control points and mark the minimum baseline as met, partly met or missing Ch. 2
10:30	Regulation as a four-link chain, the reference architecture and AI Decision Records Ch. 3, Ch. 4, Ch. 5
11:15	Lecture: everything that shapes behaviour is versioned; the delivery loop and its risks Ch. 7, Ch. 8, Ch. 9
12:00	Lunch break
13:00	Workshop: design review of a proposed agent with manifest, approval rule and stop block Ch. 11, Ch. 12
13:50	Placement: sovereignty as verifiable properties, cloud against self-hosted, classification-routed agentic work Ch. 13, Ch. 14, Ch. 15
14:35	Lecture: controls that hold whatever anyone intends; AI as target and as source of threat Ch. 16, Ch. 17, Ch. 18, Ch. 19
15:20	Tabletop: an exploit follows an advisory within 48 hours, and an agent overreach alert fires Ch. 18, Ch. 19
16:00	Evaluation, drift, cost and the readiness gate as one loop of versioned artefacts Ch. 20, Ch. 21, Ch. 22, Ch. 23
16:35	Closing: the two cases compared, the eight conclusions and each participant's Stage 1 assessment Ch. 24, Ch. 25

Full course8 weeks, 25 lessons in six modules

For platform, security, MLOps and architecture practitioners who will build or review an AI platform in their own organisation

The full course covers all 25 chapters, one lesson per chapter, with a lecture per module and an exercise in every lesson that produces an artefact of the kind the chapter describes. The larger modules on the core of the platform and on security take two weeks each. The capstone assembles the artefacts into a platform and security dossier for one AI system.

Week 1	Module 1, Foundations: usage modes, regulatory requirements, the reference architecture and AI Decision Records Ch. 1, Ch. 2, Ch. 3, Ch. 4, Ch. 5
Week 2	Module 2, first half: data architecture, the model lifecycle, the DevSecMLOps loop and its risks Ch. 6, Ch. 7, Ch. 8, Ch. 9
Week 3	Module 2, second half: foundation models and retrieval, agentic architectures, integration Ch. 10, Ch. 11, Ch. 12
Week 4	Module 3, Infrastructure: sovereignty, cloud against on-premises AI, hybrid agentic work Ch. 13, Ch. 14, Ch. 15
Week 5	Module 4, first half: security for AI systems and AI security engineering in practice Ch. 16, Ch. 17
Week 6	Module 4, second half: AI-enabled attackers and agents that exceed their mandate Ch. 18, Ch. 19
Week 7	Module 5, Delivery and Operations: evaluation, observability and drift, cost and sustainability, pilot to production Ch. 20, Ch. 21, Ch. 22, Ch. 23
Week 8	Module 6, Conclusions: the two organisations, the eight conclusions and the roadmap; capstone presentations Ch. 24, Ch. 25

Modules and lessons

One module for each part of the book and one lesson for each chapter. A lesson has learning objectives, key concepts, a teaching plan, discussion questions, an exercise and a self-test.

Module 1 · Part I · Foundations

Part I lays the ground for everything the course builds later. It shows why an AI platform is an architectural and security problem, sorts the work by the six usage modes, turns European law into platform requirements with evidence, presents the layered reference architecture and its four patterns, and introduces the AI Decision Record. Participants leave able to place any AI use at its control point, derive its requirements and record the decision in a repository a pipeline can check. Lecture: From model choice to platform: the foundations of AI Platform and Security

Module 2 · Part II · Data, Models and DevSecMLOps

Part II builds the core of the platform from the bottom up: data products with contracts and lineage, the model lifecycle as a pipeline with gates, the DevSecMLOps loop with revision management as its backbone, the risks at every stage of that loop, foundation models with retrieval and grounding, agents with bounded autonomy, and the integration seam to systems of record. Participants leave with a set of codified artefacts, from a data contract and a release manifest to a permission manifest and a gateway route, that a pipeline can check. Lecture: Everything that shapes behaviour is versioned: the core of the platform

Module 3 · Part III · Infrastructure

Part III decides where the platform runs and who controls it. It treats placement as an architectural decision driven by scarce accelerators, sensitive data and European transfer law, compares cloud AI services with self-hosted models challenge by challenge, and carries the resulting hybrid pattern to agentic work tools, where routing is fixed per workspace before a session starts. Participants leave able to place a workload with a recorded rule, check readiness for self-hosting, verify a cloud service's terms and design classification-routed agent workspaces. Lecture: Where it runs and who controls it: placement as a recorded decision

Module 4 · Part IV · Security

Part IV secures what runs on the platform. Two chapters treat AI as the target: the attack surface of models, prompts, retrieval and agents, and the engineering practice of threat models as code, layered controls, security tests in the pipeline and incident playbooks. Two treat AI as the source of threat: adversaries who use AI to shrink the exploitation window and impersonate people, and the organisation's own agents that exceed their mandate. All content is defensive. Participants leave with a linked threat model, a patch-velocity policy and a containment profile. Lecture: Controls that hold whatever anyone intends: securing AI and securing against AI

Module 5 · Part V · Delivery and Operations

Part V takes AI systems through release and into daily operation. It defines an evaluation strategy for components that behave probabilistically, an observability stack that separates the regulatory record from operational traces and detects drift, a cost and carbon discipline with levers in the gateway, and a codified path from pilot to production. Participants leave with an evaluation suite with thresholds, a drift job and incident runbook, a cost policy with unit economics, and a readiness checklist tied to a go or no-go decision record. Lecture: Fit on the day it ships, and on the days after: delivering and operating AI

Module 6 · Part VI · Conclusions

Part VI draws the conclusions. The first lesson collects the decisions of the whole book into one platform and security conclusion each for Nordvik Region and Hansa Mutual, with what worked, what was hard and a prioritised plan for 24 months. The second reduces the book's argument to eight conclusions, the artefacts that carry them, the trade-offs the platform must engineer and a capability roadmap in three stages, each with a test. Participants leave with a roadmap for their own organisation. Lecture: Same conclusions, different platforms: from two cases to a capability roadmap

Final assignment

Capstone

A platform and security dossier for one AI system

Choose one AI system in your own organisation that is in production or about to be, preferably a built application or an agent; participants without a suitable system use Hansa Mutual's claims-triage agent or Nordvik Region's citizen-service assistant. Assemble a dossier that would let a platform owner onboard the system, a security architect approve it and an auditor reconstruct it. The dossier draws on the artefacts produced in the lesson exercises and must be internally consistent: thresholds in the decision record match the evaluation suite, controls in the threat model resolve to configuration, and the placement follows a stated rule. Finish with an assessment of the system against the Stage 1 test of the capability roadmap and a plan for the gaps. Security content is design, review and detection only.

Steps

Record the system's usage mode, control point, baseline status and requirements profile, and write or update its AI Decision Record with evaluation and retirement criteria.
Write the release manifest with every behaviour-shaping artefact, and, if the system acts, its permission manifest, approval rule and containment profile.
Decide and record the placement with the rule that produced it, the data terms or readiness evidence, and the second source.
Write the threat model with linked controls and guardrail settings, and a playbook for one incident with the reporting duties assessed.
Define the evaluation suite, the drift job, the cost policy with a unit-economics target, and the readiness checklist with its result.
Assess the system against the Stage 1 test and write a first-90-days plan for the gaps, with owners and outcomes that can be verified.

Deliverables

A dossier of ten to fifteen pages containing the artefacts of the six steps, in structured form where the book uses structured form
A one-page consistency map showing which artefact supplies each threshold, control and identifier used elsewhere in the dossier
A ten-minute presentation of the system's main risk, the control that contains it and the first three actions

Assessment criteria

Faithfulness: the artefacts use the book's terms and structures correctly, including usage modes, roles under the AI Act and the four-link chain.
Linkage: thresholds, control identifiers and versions agree across the decision record, the manifests, the threat model and the evaluation suite.
Enforceability: every boundary is enforced by something outside the model or the agent, and every claim names the evidence that would show it.
Honesty about gaps: unmet baseline cells, exceptions and limitations are recorded with an owner and a date instead of being left blank.
Feasibility: the first-90-days plan is ordered by dependency and each outcome can be verified.