Which architecture requirements can be checked automatically, and which cannot?

What can be checked automatically

Almost anything stated precisely:

• Dependency direction — this layer may not import that one.
• Absence of a forbidden library or call.
• Every endpoint has an authorisation check.
• Every table has a tenant identifier.
• No unencrypted storage; no public exposure without an approval record.
• Observability present: structured logging, metrics, a correlation identifier propagated.
• A latency budget on a named path, asserted as a benchmark that fails the build.
• Provenance attestation, so the artefact's source is verifiable.
• Idempotency on mutating endpoints where the convention permits detection.

These are cheap, consistent, run in seconds, and produce evidence as a by-product — which is what removes most of the volume from any human process.

What cannot

• Whether the design is appropriate for the problem.
• Whether a risk acceptance is reasonable.
• Whether a boundary is in the right place, which requires knowing the invariants.
• Whether a novel change is safe.
• Semantic correctness — a field whose meaning changed while its shape did not passes every check.

The model that follows

Automated checks for everything mechanical, human review for the significant minority, with a stated trigger — a change to a security boundary, a data migration touching customer records, a regulated calculation, a first deployment of a new component.

The trigger must be a rule rather than a judgement under time pressure, or the reservation collapses in both directions: everything reviewed after an incident, nothing reviewed under delivery pressure.

The property that makes the checks credible

Fail-closed, with the control itself monitored. A check that failed open — a credential expired, the error swallowed, the build proceeding — has not operated for months while every build passed, and the evidence shows execution while the control provided nothing.

Execution count, coverage percentage and failure rate, alerted on absence, because a control that stopped running produces silence and silence looks like success.