Deliverables

flowchart TB
  root["Organisation Root<br/><i>policy: deny unapproved regions</i>"]

  subgraph plat["Platform"]
    direction TB
    ident["Identity<br/><i>directory, privileged access</i>"]
    conn["Connectivity<br/><i>hub VNet/VPC, firewall, DNS, VPN</i>"]
    mgmt["Management<br/><i>logs, backup, monitoring</i>"]
  end

  subgraph land["Landing Zones"]
    direction TB
    subgraph corp["Corporate"]
      p1["Prod A<br/><i>spoke</i>"]
      n1["Non-Prod A<br/><i>spoke</i>"]
    end
    subgraph online["Internet-Facing"]
      p2["Prod B<br/><i>spoke</i>"]
      n2["Non-Prod B<br/><i>spoke</i>"]
    end
  end

  sandbox["Sandbox<br/><i>spend cap, no connectivity, auto-expire</i>"]
  decom["Decommissioned<br/><i>deny all</i>"]

  root --> plat
  root --> land
  root --> sandbox
  root --> decom
  conn --- p1
  conn --- n1
  conn --- p2
  conn --- n2
  mgmt -.->|"diagnostics forwarded"| land
  ident -.->|"roles and groups"| land

sequenceDiagram
  autonumber
  participant B as Browser
  participant A as App / BFF
  participant I as Identity Provider
  participant R as Resource API

  B->>A: GET /protected
  A-->>B: 302 to IdP (PKCE challenge, state, nonce)
  B->>I: authorise request
  I->>B: authenticate + MFA
  I-->>B: 302 back with authorisation code
  B->>A: code + state
  Note over A,I: back channel — browser never sees these
  A->>I: exchange code + PKCE verifier + client secret
  I-->>A: access token (10 min), refresh token, id token
  A->>A: store tokens server-side<br/>set HttpOnly SameSite cookie
  A-->>B: session cookie only
  B->>A: subsequent request + cookie
  A->>R: call with access token (Bearer)
  R->>I: fetch/refresh signing keys (JWKS, cached)
  R->>R: verify signature, issuer, audience,<br/>expiry, scope
  R-->>A: 200
  A-->>B: rendered response
  Note over A,I: on expiry the BFF refreshes<br/>with rotating refresh token

flowchart LR
  user(["Customer<br/><i>untrusted</i>"])
  admin(["Admin<br/><i>privileged</i>"])

  subgraph edge["Boundary 1 — public edge"]
    cdn["CDN / WAF"]
  end

  subgraph app["Boundary 2 — application tier"]
    direction TB
    api["Order API"]
    auth["Auth Service"]
  end

  subgraph datab["Boundary 3 — data tier"]
    direction TB
    db[("Order Store<br/><i>PII + card token</i>")]
    kms[("Key Vault")]
  end

  ext["Payment Provider<br/><i>third party</i>"]

  user -->|"F1 HTTPS"| cdn
  cdn -->|"F2 HTTPS + mTLS"| api
  admin -->|"F3 admin console"| api
  api -->|"F4 token introspection"| auth
  api -->|"F5 TLS + parameterised"| db
  api -->|"F6 fetch DEK"| kms
  api -->|"F7 HTTPS outbound"| ext
  ext -->|"F8 webhook — signed"| cdn

flowchart LR
  u1(["Employee<br/><i>managed laptop</i>"])
  u2(["Contractor<br/><i>unmanaged device</i>"])
  u3["Workload<br/><i>service identity</i>"]

  subgraph pep["Policy Enforcement"]
    direction TB
    px["Proxy / Gateway<br/><i>terminates every session</i>"]
  end

  subgraph pdp["Policy Decision"]
    direction TB
    eng{"Policy engine"}
    sig1["Identity + MFA"]
    sig2["Device posture"]
    sig3["Risk + location"]
    sig4["Resource sensitivity"]
    sig1 --> eng
    sig2 --> eng
    sig3 --> eng
    sig4 --> eng
  end

  subgraph res["Resources"]
    direction TB
    r1["Internal app"]
    r2[("Database")]
    r3["SaaS"]
  end

  u1 --> px
  u2 --> px
  u3 --> px
  px <-->|"authorise this request"| eng
  px -->|"allow · scoped · time-bound"| r1
  px -->|"allow · read-only"| r2
  px -->|"deny · posture fail"| r3
  log[("Decision log<br/><i>every allow and deny</i>")]
  eng --> log

gantt
  title Target state — 18 months
  dateFormat YYYY-MM-DD
  axisFormat %b %y

  section Foundation
  Landing zone and connectivity      :done,   f1, 2026-01-01, 60d
  Identity federation                :done,   f2, after f1, 45d
  Observability baseline             :active, f3, after f1, 75d

  section Decouple
  Strangler facade at edge           :active, d1, 2026-03-15, 90d
  Extract order domain               :        d2, after d1, 120d
  Extract pricing domain             :        d3, after d2, 90d
  Retire shared order database       :crit,   d4, after d3, 60d

  section Data
  Ingest to raw zone                 :        a1, 2026-04-01, 75d
  Conformed customer entity          :        a2, after a1, 90d
  Retire nightly extract jobs        :        a3, after a2, 45d

  section Resilience
  Multi-zone for tier 0              :        r1, 2026-06-01, 60d
  Automated failover rehearsal       :        r2, after r1, 45d
  Second region for tier 0           :crit,   r3, after r2, 90d