A Year in the Role: The Transformed Architect at Nordvik Region and Hansa Mutual

All courses / The Transformed Security Architect / Module 6 / Chapter 25

Learning objectives

After the lesson the participant can:

• Trace the order in which the four shifts appeared in each organisation's year and explain why the order of artefacts mattered.
• Identify, for at least four failures in the year, the mechanism that caught it and the decision record that answered it.
• Compare how the architects' working week changed at Nordvik Region and Hansa Mutual between October 2026 and October 2027.
• Review a year in the role as a timeline with decisions, failures, shifts and year-end claims classified as verified, declared or failed.

Key concepts

The shifts as a sequence

Shift 1 came first because the charter, catalogue and tier policy in the repository were what every later step read; Shift 2 followed through contracts and gates; Shift 3 became real when stop paths were timed and failed; Shift 4 took the form of a deferral or of review tiers and caps.

went_wrong field

The entry in the year's timeline for every failed drill, expired exception, missed seed and gate decision reversed by sampling, linked to the decision that answered it or marked open. It is what makes the timeline evidence that the practice learns.

Wrong at scale

Hansa's July failure: a tier 1 gate restored a UK logging setting to the group baseline although it had been changed under an approved exception, because the gate did not read the exception register. No agent was involved; the post-merge sample found it.

The later instrument governs

How Nordvik settled the conflict between its manifest, which allowed edits at Level 2 Supervised, and its charter, which capped the architect's own AI at Level 1 Assisted: the stricter, later charter governed until the manifest was aligned as version 3.0.0.

Human binding constraint

The year-end finding in both organisations: the limit was one person's availability at Nordvik and six people's review capacity at Hansa, where reviewing AI-drafted proposals became the largest use of the team's time.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Both first stop drills failed, and the chapter calls this what a drill exists to produce. How would such a result be received by your management body, and how would you present it?
2. During the architect's leave at Nordvik a model update was held for three weeks because only the architect's charter named one check. What does the fix in AIDR-0542 keep, and what does it change?
3. At Hansa consultation, not engineering, set the agent team's pace. Is that a cost or a control, and why?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Why did Nordvik's first out-of-hours stop drill of the benefits-triage integration route take 26 minutes against a budget of 15?

   1. The canary alert reached a duty analyst who did not hold the decision, and tokens outlived the revocation
   2. The managed security service provider held the runbook but not the credentials
   3. Only two caseworkers remembered how to triage without the ranking
   4. TriageSoft had not accepted the stop-path requirement in the annex
   Show the answer

   B. The managed security service provider held the runbook but not the credentials
   The provider held the runbook but not the credentials. Annex MS-1 then gave it authority to revoke credentials out of hours, AIDR-0541 added a scoped break-glass credential, and the October re-drill took 11 minutes.

2. What did Hansa do when agent review volume rose by about 40 per cent after consultation and the Tier 2 queue lengthened?

   1. It moved Tier 2 proposals to Tier 1 so that one reviewer sufficed
   2. It let the critique agent approve proposals on low-risk paths
   3. It lowered the proposal cap and recorded the decision to slow the agents as AIDR-0593
   4. It raised the review agents to Level 3 Bounded for reversible policy changes so that fewer proposals needed a person
   Show the answer

   C. It lowered the proposal cap and recorded the decision to slow the agents as AIDR-0593
   Because the proposal cap held, the queue grew and the depth of review did not fall. The head of security architecture lowered the cap and recorded the decision to slow the agents as AIDR-0593.

3. What caught the tier 1 gate that wrongly restored a UK logging setting to the group baseline at Hansa?

   1. The post-merge sample, six days later
   2. The policy-author agent's own report of the change
   3. The UK supervisor's request for the evidence pack
   4. The quarterly seeded-error drill
   Show the answer

   A. The post-merge sample, six days later
   The post-merge sample found the change six days later. No agent was involved: a deterministic rule did exactly what it said, which is why the sampling exists. AIDR-0591 made every tier 1 gate read the exception register.