All courses / The Transformed Security Architect / Module 2 / Chapter 5
Learning objectives
After the lesson the participant can:
- Explain four ways a reference document fails the architect and what a model kept as code offers instead.
- Assign the security properties trustZone, dataClass, identity, usageMode, policyPoint and owner to the elements and relationships of a small estate.
- Distinguish completeness rules, boundary rules and content rules and state what each checks.
- Design the review path for an architectural pull request using policy checks, review triggers and decision rights.
Key concepts
- Security properties on model elements
- Named properties such as trustZone, dataClass, identity, usageMode, policyPoint and owner that turn a diagram into a security model. Each must be testable by a rule, and a closed vocabulary matters more than a rich one.
- Completeness, boundary and content rules
- Completeness rules require every element to carry the properties other rules need; boundary rules require a relationship between two zones to name an existing policy point; content rules restrict what may sit where, for example that a Mode 5 agent has an identity of its own.
- Pull request as unit of change
- An architectural change arrives as a pull request carrying the model diff, policy-check results, the linked decision record and a named author. Policy checks decide routine cases, review triggers route boundary changes to the architect, and decision rights set how long review may take.
- Drift
- The difference between model and estate, in two directions. An estate element the model lacks gives false assurance; a model element the estate lacks is mostly hygiene but hides the first kind. Each finding becomes a pull request and the drift rate is reported.
- What remains a document
- Generated narratives, rationale in decision records, policy statements for people and contracts. The test is whether a person will read it to decide or to act; if a rule could answer the question, the rule is the artefact.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Match
Security properties on model elements
Match each property the architect puts on elements and relationships of the architecture model to what it records.
Interactive exercise 2 · Put in order
Moving a reference document into a model
Put these steps from the chapter's practical guide for replacing a security reference architecture document in the order the guide gives them.
Teaching plan
| 15 min | Lecture on the four failures of the reference document and the model that generates views, using Figure 5.1 and the question about what crosses into the core claims system. |
| 15 min | Walk through Hansa's workspace fragment and boundary rule in plain language; participants predict what happens when a team adds a direct relationship from the agent to the core claims system. |
| 10 min | Discussion of Nordvik's ownership file as a risk register: why a path with a single owner is a finding in its own right. |
| 30 min | Exercise: participants model the zone crossings of one system, mark principles as testable or not, and write the boundary rule and review triggers in plain language. |
| 5 min | Wrap-up on what stays with the architect: choosing which principles deserve a rule and judging the exceptions. |
Discussion
- The chapter expects about half the sentences in a reference document to be testable. What does that suggest about the other half, and where should that reasoning live?
- Hansa's review board still reviews documents generated beside the model, so its decisions and the model can disagree. How would you resolve such a disagreement, and who should own the outcome?
- Nordvik models its supplier's system as a single black-box element with contractual properties. What can such an element assert, and what can it not?
Written exercise
Exercise · 30 minutes
From reference document to model and rule
Take one section of your security reference architecture, or use Nordvik Region's zones and its supplier TriageSoft. List every sentence that states a principle and mark it as testable now, testable with a new property, or not testable. Define a closed vocabulary of three to six trust zones and three to four data classes. Model only the flows that cross a zone boundary, giving each element a stable name, a trust zone, an owner and, for AI elements, a usage mode, and each crossing a policy point. Write in plain language one completeness rule and one boundary rule, and list the protected paths with two owners each.
Deliverable: A one-page model sketch with properties on elements and crossings, a marked list of principles, two rules in plain language and an ownership table with a second owner on every protected path.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
In Hansa's worked example, a product team adds a relationship from the claims-triage agent directly to the core claims system. What happens?
Show the answer
A. The boundary rule reports a zone crossing without a policy point, and the pull request cannot merge
The second rule reports a crossing from agent-runtime to core-systems without a policy point and blocks the merge. The architect never read the diagram; the principle was written once and the pipeline applied it.Why does the chapter say a closed vocabulary matters more than a rich one for model properties?
Show the answer
C. Because a rule cannot test a property that two teams spell differently
Each property must be testable by a rule, and a rule cannot test a property that two teams spell differently. The list of zones and classes is therefore itself a versioned file changed by pull request.How does Hansa Mutual treat an agent identity found in the estate that the model does not contain?
Show the answer
D. As a finding for the identity domain architect on the day it is found
An unmodelled agent identity is a finding for the identity domain architect on the day it is found, because a Mode 5 agent the model does not know is a boundary no rule tests.