The Role Map: CISO, Enterprise Architect, AI Architect, Platform and Product Teams · The Transformed Security Architect: the course

All courses / The Transformed Security Architect / Module 4 / Chapter 16

Learning objectives

After the lesson the participant can:

Explain the division of labour between the CISO and the security architect as the difference between appetite and design.
Assign a proposer, a ceiling-holder and an operator to each of the four seams between the security architect and the AI architect.
Compare the enabling, embedded and platform placements by what each makes easy and hard.
Draft a role map with exactly one accountable role per cross-role decision.

Key concepts

Seam: A point where the work of two roles meets and a decision can fall between them. For each seam, one role proposes, one holds the ceiling and one operates, and a file in version control says which.
Rights over ceilings: Whoever knows the AI system best proposes; whoever knows the attacker's reach best holds the ceiling, because the ceiling must not depend on the model behaving. The security architect's rights at the seams are over ceilings, not over content.
Enabling hub: The book's default placement: an enabling team reporting to the CISO, with an architect embedded only where risk justifies it, keeping the hub reporting line and rotating after a fixed term, and a standing seat in the platform team's design reviews.
New neighbours: Roles the usage modes created: the AI system owner, the agent operator who may revoke a Mode 5 agent's credentials, the skills curator and the evaluation engineer. The architect's own agents appear on the map as tools, never as roles.
RACI rules: One accountable role per decision; a veto is not an accountability and is recorded separately; independent functions are never responsible for building; agents are never accountable. Stopping needs no approval, whereas restarting needs the system owner.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Proposes or holds the ceiling

At the four seams between the AI architect and the security architect, sort each item under the role that owns it.

Interactive exercise 2 · Match

Neighbours on the role map

Match each neighbouring role to what the chapter says it does.

Teaching plan

15 min	Lecture on the role among roles, using Figure 16.1: the CISO, the risk function and internal audit, the enterprise architect and the AI architect.
15 min	Participants fill in Table 16.1 from memory for the four seams, then compare with the chapter and discuss the rule for disagreement and its 30-day lapse.
10 min	Read Hansa's decision-rights file: find who is accountable for the permission ceiling, who owns guardrail content, and why stop activation requires no approval.
30 min	Exercise: participants draw a role map from six real decisions, marking who was surprised, and assign one accountable role per seam.
5 min	Wrap-up: each group names one seam where two roles each believed the other was the owner.

Discussion

The architect recommends an exception but does not grant one. What goes wrong in organisations where the same person designs the boundary and accepts the residual risk?
The test of placement is whether the architect hears of a boundary problem from the team before an incident reveals it. How would your current placement fare on that test?
Nordvik holds boundaries through contracts, Hansa through the platform. Which seams in your organisation are held by neither, and who was surprised the last time one failed?

Written exercise

Exercise · 30 minutes

Draw the role map from real decisions

Collect six boundary-changing decisions from the last twelve months in your organisation, preferring slow or contested ones. For each, record who proposed, who decided, who did the work and who was surprised; the surprised column marks the seams. Cluster the decisions by seam. For each seam name the role that proposes, the role that holds the ceiling, the role that operates and exactly one accountable role, recording any veto separately with its scope. Add the stop decision: who may stop without asking, and who must approve a restart. Then test the map against two further decisions and note any it cannot route as a gap.

Deliverable: A role map in the form of Hansa's decision-rights file, with one accountable role per decision, separate vetoes, stop activation and release, and a list of gaps.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

At the seam on guardrail content and boundaries, what does the security architect hold?
Show the answer
B. The ceiling: egress, workspace isolation, and the rule that no guardrail is the only control
The AI architect proposes what the guardrails check and how they are evaluated; the security architect holds the ceiling of egress, workspace isolation and the rule that no guardrail is the only control; the platform team operates.
What happens when the security architect and the AI architect disagree at a seam, according to the book's own conclusion?
Show the answer
D. The more restrictive position stands until the named tier decides, and the default lapses after 30 days
The more restrictive position stands until the named tier decides, and the default lapses after 30 days so that restriction does not become a veto by delay.
Why does the chapter prefer a standing seat in the platform team's design reviews to making the architect a member of the platform team?
Show the answer
A. It keeps designer and builder apart, avoiding self-review
Platform membership makes boundaries defaults for every team but makes self-review and the conflict between delivering and constraining features hard. A standing seat keeps designer and builder apart.