Conclusions: The Transformed Security Architect · The Transformed Security Architect: the course

All courses / The Transformed Security Architect / Module 6 / Chapter 27

Learning objectives

After the lesson the participant can:

State the thesis and the three places where the concluding chapter qualifies it.
Explain the seven cross-cutting conclusions and classify each as observable or expected, with what would change it.
Sequence the actions the chapter recommends first, next and later, and justify the order.
Draft a first-90-days plan for taking up a transformed security architect role.

Key concepts

Three qualifications of the thesis: The scarce resource is also the capacity to exercise judgement at the volume the estate produces; the transformation is uneven across the four shifts; and it is not guaranteed, because the role could disappear through a sequence of reasonable delegations.
Seven cross-cutting conclusions: The boundary is the product, not the review; decision rights are written before the pressure; time is a design property and the drill its evidence; verification, not drafting, is the constraint; the craft is kept deliberately; accountability ends in a person; evidence replaces attestation.
Tensions held by written rules: Speed pulls against verification, delegation against the craft, and evidence against co-determination. Each tension is held by a written rule that a person reviews, such as the highest tier for irreversible changes or team-level reporting of review metrics.
First, next, later: The sequence follows the order the year found to matter: written authority before delegation, boundaries before speed, measurement before autonomy. It runs over the first six months, six to eighteen months and eighteen to thirty-six months.
Calibration before approval: A new architect joins the approver pool on evidence of a seeded-error calibration, by default 20 proposals with a catch rate at or above 0.85, not on a date, and until day 90 does not approve at the highest tier.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Put in order

The first 90 days in the role

Put the milestones of the chapter's guide for taking up a transformed security architect role in order.

Interactive exercise 2 · Match

What would change each conclusion

Match each cross-cutting conclusion to what Table 27.1 says would change it.

Teaching plan

15 min	Lecture on the thesis restated and qualified, and on the reflections on each part of the book.
15 min	Groups take the seven conclusions, state the firmness of each from Table 27.1 and argue what evidence would change it.
10 min	The teacher presents what to do first, next and later and reads the author's judgement as a labelled projection; participants say which advice they would act on first.
30 min	Exercise: participants write a first-90-days plan for themselves or for a new colleague, including what may not be done before day 90.
5 min	Closing round: each participant states one decision right they will get in writing and one stop path they will time.

Discussion

The author projects that Shift 4 is the hardest because it fails quietly. Do you agree, and what in your own practice would reveal such a failure?
The firmest conclusions concern boundaries, time and law; the least firm concern what AI will do to the architect's judgement. How should that difference shape where you commit and where you keep decisions reversible?
The chapter says what remains of the role is smaller in volume and larger in consequence. What does that imply for how the role should be graded, staffed and deputised?

Written exercise

Exercise · 30 minutes

Write a first-90-days plan

Write a plan for the first 90 days of a security architect taking up a transformed role, for yourself or for a new colleague, following the chapter's practical guide. For the first week, list the decision rights in the charter with time limits and overrides, or note that a charter must be drafted. For days 1 to 30, plan a boundary map of the post's boundaries from the architecture model with peer review and findings for untested boundaries. For days 31 to 60, plan one unaided threat model compared with an AI draft and a seeded-error calibration. For days 61 to 90, plan first approvals and one timed stop drill. State the ceiling on own AI use, the protected unassisted practice and what may not be done before day 90.

Deliverable: A plan in the form of PLAN-HM-SA-PL-90 with three phases, deliverables and verifications, an own-AI ceiling, protected practice and a not-before-day-90 list.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which of the seven cross-cutting conclusions does Table 27.1 label as expected and not yet observable?
Show the answer
A. Verification, not drafting, is the constraint
That verification becomes the constraint is labelled expected, on the trend in AI task length and automation bias; reliable verification of AI by AI, which would change it, is speculation. Boundaries, time and law are observable.
What does the chapter recommend doing in the first six months?
Show the answer
B. Write the role charter, put own AI use under a mandate manifest, start the control catalogue and time one stop path
First come the charter, a mandate manifest for the architect's own AI use with a ceiling of Level 1 Assisted, a control catalogue starting with agent egress, machine identities and the stop path, and one timed stop drill: written authority before delegation.
How does the concluding chapter leave question Q12, whether there will be a security architect in 2036?
Show the answer
D. Open by nature, with the author's judgement given only as a labelled projection
Table 27.2 leaves Q12 open by nature. The book answers eight of the twelve questions and three in part; the author's view that the role will exist in 2036 is a projection, labelled as such, and not one of the book's findings.