Case Studies and Anti-Patterns · The Transformed Security Architect: the course

All courses / The Transformed Security Architect / Module 6 / Chapter 24

Learning objectives

After the lesson the participant can:

Describe the five anti-patterns by the shift each violates, its symptom and the test that shows the remedy works.
Apply the three questions on boundary dependence, leakage and the stop decision to an agent incident.
Diagnose a security architecture practice with the twelve questions, answering from records and marking each red or green.
Draft an anti-pattern record with symptom, cause, remedy, verification test and owner.

Key concepts

Anti-pattern: Not a mistake but a solution that looks reasonable, is adopted repeatedly and produces the same bad outcome each time. The chapter describes each by five fields kept as code: the shift violated, the symptom, the cause, the remedy and the test.
The five anti-patterns: The architect as bottleneck, the diagram nobody runs, the AI that approved itself, the control catalogue nobody maps, and the sign-off in seconds. The first fails Shift 2 and with it Shift 3, the second and fourth Shift 1, the third and fifth Shift 4.
Three questions for an agent incident: Does the boundary depend on the agent doing what it was asked? Does it leak through a service the agent can reach? Does the alert reach the person who holds the stop decision, with the authority and means to use it?
Sampling as the control on delegation: The lesson of the review-board case: the gate rule is the architect's product and a wrong rule is wrong at scale, so a regular sample of gate decisions is what finds a rule that drifted from its intent.
Structural and behavioural forms: Two ways an AI team approves itself. In the structural form the permissions allow an agent to approve or to write to what it is checked against. In the behavioural form the rules hold, but the architect has become a signature on unchecked work.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Each anti-pattern and its remedy

Match each of the five anti-patterns to the remedy the chapter designs for it.

Interactive exercise 2 · Scenario

A freeze that is only an instruction

Apply the chapter's three questions for an agent incident.

Teaching plan

15 min	Lecture on how to read the cases, illustrative composites against the observable case, and on Table 24.1 linking each anti-pattern to a shift and a remedy.
15 min	Groups apply the three questions to the three public incidents using the chapter's table, and report which boundary depended on the agent's compliance in each.
15 min	The teacher walks the five anti-patterns field by field; participants vote privately on which their own practice shows and compare with Nordvik's and Hansa's findings.
35 min	Exercise: participants answer the twelve diagnostic questions for their practice from records and write one anti-pattern record for a red answer.
10 min	Debrief on the five properties the successful cases share and on how a bottleneck under pressure produces the sign-off in seconds.

Discussion

The chapter says asking people to be more careful is not a remedy for the sign-off in seconds. Why not, and what does it offer instead?
Both composite cases kept a single point of failure in the architect. How would you treat the architect's own capacity as a constraint in your organisation?
Both Nordvik and Hansa found that most remedies existed before the diagnosis. What did the diagnosis add, and why does that matter?

Written exercise

Exercise · 35 minutes

Diagnose your practice for anti-patterns

Run the chapter's diagnostic on your own security architecture practice for the last two quarters. Answer the twelve questions from records, never from memory, and mark each red when it meets the chapter's condition or cannot be answered: for example a median wait for routine classes above five working days, no pipeline check that reads the architecture model, any agent with write access to what it reviews, any catalogue entry without an owner, a mapping and a test, or no seeding of errors. Name an independent reader who would re-derive three answers. Then write an anti-pattern record for one red answer with the shift violated, the observed symptom, the cause, the remedy with its decision records, the verification test with a pass condition, an owner other than the person assessed and a review date.

Deliverable: A completed twelve-row diagnostic table with red and green marks and sources, and one anti-pattern record in the form of AP-HM-SIS-01.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

In the composite case of the review board that became a design authority, how was the faulty gate for new network paths discovered?
Show the answer
D. A monthly sample of 10 per cent of gate decisions found it
The gate read a local copy of the zone labels and not the architecture model, and approved three paths into a reclassified zone. A monthly sample of 10 per cent of gate decisions found it, which is why sampling is the control on delegation.
What test does the chapter give for the remedy of the anti-pattern 'the AI that approved itself'?
Show the answer
A. A drill in which an agent identity tries to approve its own proposal on a protected path is refused and alerts a stop holder
The test is an authorised drill in the organisation's own repository: an agent identity attempts to approve its own proposal on a protected path, which must be refused and must alert a person who holds the stop decision.
Which diagnostic answer marks the sign-off in seconds as red for agent proposals at tier 2 and above?
Show the answer
C. A median approval time under 60 seconds, or a rejection rate under 2 per cent over 100 proposals
Question 11 is red when the median approval time for agent proposals at tier 2 and above is under 60 seconds, or the rejection rate is under 2 per cent over 100 proposals. Question 12 adds seeded-error detection under 80 per cent, or no seeding.