Deliverables

The curriculum covers what an architect should know. This covers what an architect actually hands over: 55 artifacts, each with a worked example, a note on when it is worth producing, who reads it, and the ways it usually goes wrong. Filter by the artifact's type, the kind of engagement that calls for it, the stack or industry it is drawn against, or the audience it is written for.

Identify the deliverable → 42 diagrams, shown one at a time with the answer withheld. Nothing to submit.

12 of 55 deliverables shown.

flowchart LR
  commit(["commit to main"]) --> build

  subgraph ci["Continuous Integration"]
    direction TB
    build["build<br/><i>pinned deps, hermetic</i>"]
    unit["unit tests<br/><i>&lt; 4 min</i>"]
    scan["SAST + dependency<br/>+ secret scan"]
    sign["sign artifact<br/>+ emit SBOM"]
    build --> unit --> scan --> sign
  end

  sign --> reg[("artifact registry<br/><i>immutable, digest-addressed</i>")]

  subgraph cd["Continuous Delivery"]
    direction TB
    dev["deploy dev<br/><i>auto</i>"]
    ctest["contract tests"]
    stage["deploy staging<br/><i>auto</i>"]
    nft["performance +<br/>resilience suite"]
    dev --> ctest --> stage --> nft
  end

  reg --> dev
  nft --> gate{"release gate<br/><i>automated checks +<br/>change record</i>"}
  gate -->|"pass"| canary["canary 5%<br/><i>15 min bake</i>"]
  gate -->|"fail"| stop(["blocked"])
  canary --> analyse{"error rate and<br/>latency within SLO?"}
  analyse -->|"yes"| full["progressive rollout<br/><i>25% → 50% → 100%</i>"]
  analyse -->|"no"| rollback(["automatic rollback"])

Behavioural View

CI/CD Pipeline Diagram

The path from commit to production as ordered stages, showing what each one proves, what it produces, and where a human is still in the loop.

Pipeline Architecture Build

flowchart TB
  root["Organisation Root<br/><i>policy: deny unapproved regions</i>"]

  subgraph plat["Platform"]
    direction TB
    ident["Identity<br/><i>directory, privileged access</i>"]
    conn["Connectivity<br/><i>hub VNet/VPC, firewall, DNS, VPN</i>"]
    mgmt["Management<br/><i>logs, backup, monitoring</i>"]
  end

  subgraph land["Landing Zones"]
    direction TB
    subgraph corp["Corporate"]
      p1["Prod A<br/><i>spoke</i>"]
      n1["Non-Prod A<br/><i>spoke</i>"]
    end
    subgraph online["Internet-Facing"]
      p2["Prod B<br/><i>spoke</i>"]
      n2["Non-Prod B<br/><i>spoke</i>"]
    end
  end

  sandbox["Sandbox<br/><i>spend cap, no connectivity, auto-expire</i>"]
  decom["Decommissioned<br/><i>deny all</i>"]

  root --> plat
  root --> land
  root --> sandbox
  root --> decom
  conn --- p1
  conn --- n1
  conn --- p2
  conn --- n2
  mgmt -.->|"diagnostics forwarded"| land
  ident -.->|"roles and groups"| land

Deployment & Infrastructure View

Cloud Landing Zone Diagram

The account, network, identity and policy scaffolding every future workload will be dropped into, drawn before the first workload exists.

Landing Zones Design

flowchart TB
  subgraph prod["Cluster: prod-eu (regional, 3 AZ)"]
    direction TB
    cp["Control plane<br/><i>managed · private endpoint</i>"]
    subgraph pools["Node pools"]
      direction LR
      np1["system<br/><i>taint: CriticalAddonsOnly</i>"]
      np2["general<br/><i>3–30 nodes · spot 40%</i>"]
      np3["memory<br/><i>taint: workload=memory</i>"]
      np4["gpu<br/><i>taint: workload=gpu</i>"]
    end
    subgraph ns["Namespaces"]
      direction LR
      n1["team-orders<br/><i>quota · NetworkPolicy<br/>default-deny</i>"]
      n2["team-pricing<br/><i>quota · NetworkPolicy</i>"]
      n3["platform<br/><i>mesh · ingress · logging</i>"]
    end
    cp --- pools
    pools --- ns
  end
  subgraph nonprod["Cluster: nonprod-eu"]
    direction TB
    x1["shared node pool<br/><i>spot 90%</i>"]
  end
  reg[("Image registry<br/><i>signed images only</i>")] --> prod
  reg --> nonprod
  gitops["GitOps reconciler"] -.->|"applies desired state"| prod

Deployment & Infrastructure View

Kubernetes Cluster Topology

How many clusters, split by what, which node pools exist and what isolates one tenant from another.

Cluster Architecture Design

flowchart TB
  inet(["Internet"])
  dc["Corporate Data Centre<br/><i>10.0.0.0/8</i>"]

  subgraph hub["Hub — 10.100.0.0/16"]
    direction TB
    fw["Egress Firewall<br/><i>FQDN allow-list</i>"]
    vpn["VPN / Direct Link<br/><i>BGP</i>"]
    dns["Private DNS Resolver"]
  end

  subgraph spokeA["Spoke: Prod — 10.101.0.0/16"]
    direction TB
    pub["Public Subnet<br/><i>10.101.0.0/24 — ingress LB only</i>"]
    app["App Subnet<br/><i>10.101.10.0/23 — no public IPs</i>"]
    data["Data Subnet<br/><i>10.101.20.0/24 — private endpoints</i>"]
    pub --> app --> data
  end

  subgraph spokeB["Spoke: Non-Prod — 10.102.0.0/16"]
    appn["App Subnet<br/><i>10.102.10.0/23</i>"]
  end

  inet -->|"443 only"| pub
  app -->|"all egress"| fw --> inet
  appn --> fw
  dc <-->|"BGP"| vpn
  vpn --- spokeA
  vpn --- spokeB
  spokeA x--x spokeB

Deployment & Infrastructure View

Network Topology Diagram

Segments, address ranges, routes and the control points between them — the view that says what can reach what at layer three.

Networking Design

sequenceDiagram
  autonumber
  participant B as Browser
  participant A as App / BFF
  participant I as Identity Provider
  participant R as Resource API

  B->>A: GET /protected
  A-->>B: 302 to IdP (PKCE challenge, state, nonce)
  B->>I: authorise request
  I->>B: authenticate + MFA
  I-->>B: 302 back with authorisation code
  B->>A: code + state
  Note over A,I: back channel — browser never sees these
  A->>I: exchange code + PKCE verifier + client secret
  I-->>A: access token (10 min), refresh token, id token
  A->>A: store tokens server-side<br/>set HttpOnly SameSite cookie
  A-->>B: session cookie only
  B->>A: subsequent request + cookie
  A->>R: call with access token (Bearer)
  R->>I: fetch/refresh signing keys (JWKS, cached)
  R->>R: verify signature, issuer, audience,<br/>expiry, scope
  R-->>A: 200
  A-->>B: rendered response
  Note over A,I: on expiry the BFF refreshes<br/>with rotating refresh token

Security View

Authentication Flow Diagram

The exact token exchange between browser, application, authorisation server and API — including what is short-lived, what is bound and what never touches the browser.

Secure API Design Design

flowchart LR
  subgraph t4["Restricted"]
    direction TB
    a1["Card PAN · health records<br/>government ID images"]
    a2["<i>controls:</i> tokenise at edge<br/>field encryption · CMK<br/>no non-prod copies<br/>access JIT + approved<br/>full audit"]
  end
  subgraph t3["Confidential"]
    direction TB
    b1["Personal data · salary<br/>contracts · pricing"]
    b2["<i>controls:</i> encrypt at rest + transit<br/>masked in non-prod<br/>RBAC + quarterly review<br/>DLP on egress"]
  end
  subgraph t2["Internal"]
    direction TB
    c1["Operational metrics<br/>internal docs"]
    c2["<i>controls:</i> authenticated access<br/>standard retention"]
  end
  subgraph t1["Public"]
    direction TB
    d1["Published pricing<br/>marketing content"]
    d2["<i>controls:</i> integrity only"]
  end

  t4 --> s1[("Core DB · EU · Restricted")]
  t3 --> s1
  t3 --> s2[("Warehouse · EU · Confidential")]
  t2 --> s2
  t2 --> s3[("Object store · Internal")]
  t1 --> s3

Security View

Data Classification Map

Which data sits in which sensitivity tier, where it lives, and the specific controls each tier obliges — so protection follows the label automatically.

Data Classification Design

flowchart LR
  subgraph who["Identities"]
    direction TB
    dev(["Developers<br/><i>group</i>"])
    sre(["SRE<br/><i>group</i>"])
    aud(["Auditors<br/><i>group</i>"])
    wl["Workload Identity<br/><i>order-api</i>"]
    ci["Pipeline Identity<br/><i>deploy-prod</i>"]
  end

  subgraph roles["Roles"]
    direction TB
    r1["Reader<br/><i>standing</i>"]
    r2["Operator<br/><i>standing</i>"]
    r3["Break-Glass Admin<br/><i>JIT — 60 min, approved, logged</i>"]
    r4["Deployer<br/><i>pipeline only</i>"]
    r5["Data Reader — Masked<br/><i>no raw PII</i>"]
  end

  subgraph what["Resources"]
    direction TB
    a1["Prod Compute"]
    a2["Prod Data Store"]
    a3["Key Vault"]
    a4["Audit Logs<br/><i>append-only</i>"]
  end

  dev --> r1 --> a1
  dev --> r5 --> a2
  sre --> r2 --> a1
  sre --> r3
  r3 --> a1
  r3 --> a2
  aud --> r1 --> a4
  wl --> r5
  wl --> a3
  ci --> r4 --> a1

Security View

IAM Role Model

Which identities may do what to which resource, expressed through roles rather than by naming people, so that access can be reviewed.

Identity & Access Management Design

flowchart TB
  hsm[("HSM / Key Service<br/><i>root of trust · FIPS 140-2 L3</i>")]
  cmk["Customer Master Key<br/><i>per environment · rotate 1y</i>"]
  dek["Data Encryption Keys<br/><i>per dataset · rotate 90d</i>"]

  hsm --> cmk -->|"wraps"| dek

  subgraph vault["Secret Store"]
    direction TB
    v1["Static secrets<br/><i>rotate 90d</i>"]
    v2["Dynamic credentials<br/><i>DB · TTL 1h</i>"]
    v3["PKI issuer<br/><i>mTLS certs · TTL 24h</i>"]
  end
  cmk -->|"encrypts vault at rest"| vault

  subgraph wl["Workloads"]
    direction TB
    w1["Service A<br/><i>workload identity</i>"]
    w2["Pipeline<br/><i>OIDC federation</i>"]
  end

  w1 -->|"attests identity — no stored secret"| vault
  w2 -->|"short-lived token — no stored secret"| vault
  vault -->|"lease · auto-renew · revocable"| w1
  dek -->|"envelope decrypt"| w1
  audit[("Audit log<br/><i>every issue and revoke</i>")]
  vault --> audit

Security View

Key & Secret Management Diagram

Where keys and secrets live, what wraps what, how workloads get them without a stored credential, and how rotation actually happens.

Secrets Management Design

Security View

Security Control Matrix

Each required control mapped to the specific mechanism that implements it, the evidence it produces and the person accountable for it.

Compliance Frameworks Design

flowchart LR
  user(["Customer<br/><i>untrusted</i>"])
  admin(["Admin<br/><i>privileged</i>"])

  subgraph edge["Boundary 1 — public edge"]
    cdn["CDN / WAF"]
  end

  subgraph app["Boundary 2 — application tier"]
    direction TB
    api["Order API"]
    auth["Auth Service"]
  end

  subgraph datab["Boundary 3 — data tier"]
    direction TB
    db[("Order Store<br/><i>PII + card token</i>")]
    kms[("Key Vault")]
  end

  ext["Payment Provider<br/><i>third party</i>"]

  user -->|"F1 HTTPS"| cdn
  cdn -->|"F2 HTTPS + mTLS"| api
  admin -->|"F3 admin console"| api
  api -->|"F4 token introspection"| auth
  api -->|"F5 TLS + parameterised"| db
  api -->|"F6 fetch DEK"| kms
  api -->|"F7 HTTPS outbound"| ext
  ext -->|"F8 webhook — signed"| cdn

Security View

Threat Model Data Flow Diagram

Processes, stores and flows with trust boundaries drawn across them, so that every boundary crossing can be enumerated for threats.

Threat Modelling Design

flowchart LR
  u1(["Employee<br/><i>managed laptop</i>"])
  u2(["Contractor<br/><i>unmanaged device</i>"])
  u3["Workload<br/><i>service identity</i>"]

  subgraph pep["Policy Enforcement"]
    direction TB
    px["Proxy / Gateway<br/><i>terminates every session</i>"]
  end

  subgraph pdp["Policy Decision"]
    direction TB
    eng{"Policy engine"}
    sig1["Identity + MFA"]
    sig2["Device posture"]
    sig3["Risk + location"]
    sig4["Resource sensitivity"]
    sig1 --> eng
    sig2 --> eng
    sig3 --> eng
    sig4 --> eng
  end

  subgraph res["Resources"]
    direction TB
    r1["Internal app"]
    r2[("Database")]
    r3["SaaS"]
  end

  u1 --> px
  u2 --> px
  u3 --> px
  px <-->|"authorise this request"| eng
  px -->|"allow · scoped · time-bound"| r1
  px -->|"allow · read-only"| r2
  px -->|"deny · posture fail"| r3
  log[("Decision log<br/><i>every allow and deny</i>")]
  eng --> log

Security View

Zero Trust Architecture Diagram

Access decided per request from identity, device and context rather than from network position, with the policy decision point drawn explicitly.

Network Security Design

gantt
  title Target state — 18 months
  dateFormat YYYY-MM-DD
  axisFormat %b %y

  section Foundation
  Landing zone and connectivity      :done,   f1, 2026-01-01, 60d
  Identity federation                :done,   f2, after f1, 45d
  Observability baseline             :active, f3, after f1, 75d

  section Decouple
  Strangler facade at edge           :active, d1, 2026-03-15, 90d
  Extract order domain               :        d2, after d1, 120d
  Extract pricing domain             :        d3, after d2, 90d
  Retire shared order database       :crit,   d4, after d3, 60d

  section Data
  Ingest to raw zone                 :        a1, 2026-04-01, 75d
  Conformed customer entity          :        a2, after a1, 90d
  Retire nightly extract jobs        :        a3, after a2, 45d

  section Resilience
  Multi-zone for tier 0              :        r1, 2026-06-01, 60d
  Automated failover rehearsal       :        r2, after r1, 45d
  Second region for tier 0           :crit,   r3, after r2, 90d

Planning Artifact

Architecture Roadmap

The sequence of architectural change over time, grouped by theme, with dependencies visible and each bar tied to an outcome rather than a technology.

Architecture Roadmaps Discovery