How do you check that implemented systems match agreed architectural decisions, without a review board?

The problem with document-based governance

Decisions are agreed, recorded, and then drift. Nobody notices, because nothing compares the running system to the decision — and the discovery happens years later during a migration, when the divergence is expensive and the reasoning is lost.

What automated checks can verify

• Dependency direction, so a layering or module boundary is enforced rather than described.
• Approved technology use, flagging a datastore or framework outside the agreed set at build time.
• Configuration policy: encryption enabled, no public exposure, required tags for ownership and cost attribution.
• Interface contract compatibility, checked in the producer's build rather than at consumption.
• Deployment topology, so a service is where the design said it would be.
• Coupling and complexity trends, which catch gradual drift that no single change triggers.

How to make them stick

• Run in the pipeline, blocking, so the conversation happens at the change rather than in a quarterly review.
• A clear message naming the decision violated and the exception path, since a check that says "policy violation" without saying which one teaches people to disable it.
• New rules warn before they block, giving teams time to converge rather than breaking everyone's build.
• An exception mechanism with an owner and an expiry, because a rule with no exception path is either wrong occasionally or bypassed permanently.
• The rules themselves owned and reviewed, since a rule that no longer reflects the intended architecture is worse than none.

What cannot be automated

Whether the architecture is appropriate. Automated checks verify conformance to a decision; they say nothing about whether the decision was right. They replace the enforcement half of governance, not the thinking half — and organisations that automate enforcement while abandoning the design conversation get systems that conform precisely to obsolete decisions.