Audit Log Service

Architecture Views

40 views, in reading order. Every view ships three ways: an HTML page, an SVG that re-opens in diagrams.net fully editable, and draw.io source.

A shared audit log for the whole estate: it accepts security- and compliance-relevant events from every application and administrative surface, holds them so that nobody — including its own operators and the subscription's administrators — can alter or remove one inside its retention period, and answers investigative and regulatory questions against thirteen months of that history. Read the set in order. Act 1 fixes the boundary and the plane separation everything else follows from; act 2 says who the record is actually for and where each of them is currently let down; acts 3 and 4 give the structure and say which store is the truth and which is merely convenient; act 5 is what happens when the thing is used; act 6 is running and paying for it; act 7 is why it is safe, with the operators inside the threat model rather than outside it. One decision governs the whole set: the write path holds no authority over a record's lifetime, and no principal exists anywhere that can both write a record and remove it.

1 · Context and scope

What sits inside the boundary, who feeds it, who checks it, and the four-plane separation that the rest of the architecture is a consequence of.
01 Producers — write only Business Applications 410 services Admin Consoles privileged actions Platform Services IAM, payments, HR Azure Activity Log cloud control plane People it serves Platform Operator runs it, reads nothing Investigator read within scope Compliance Officer read, export, hold Legal Hold Officer segregated role External assurance External Auditor trusts nothing Regulator evidence on demand Independent Witnesses RFC 3161 TSA · Rekor Audit Log Service capture · custody · disposal Custody held elsewhere — deliberately Confidential Ledger separate subscription Managed HSM non-exportable keys Microsoft Entra ID workload identity operates queries exports places holds POST events POST events stream diagnostics verifies offline signed bundles anchors heads chain heads signs heads authenticates Audit Log Service — System Context External / third party Person or role Data store Security / platform synchronous event / async Out of scope: application and operational logging, SIEM detection and correlation, and the business records themselves. Regulators receive evidence through the auditor's bundle, not through an interface of their own. v 1.0 · owner Data & AI Global Practice · date 2026-09 System Context Who writes to the audit log, who reads it, who checks it — and which custody is deliberately held by somebody else. HTML page SVG draw.io
02 Produce Producer SDK spool ≥ 1 h Workload Identity Entra · SPIFFE Accept Ingest API Rust · p99 150 ms Validate + Detect schema · secrets Dedup Window Valkey · 24 h Buffer Apache Kafka 72 h · RF 3 Seal Sealer Parquet · ≤ 60 s Chain Service Merkle per tenant Checkpoint Signer HSM · 15 min Custody Immutable Segments Blob WORM · locked Checkpoint Ledger separate custody Find Indexer commit → 60 s ClickHouse Index derived · rebuildable Query API every read audited Prove Verifier intact · broken here Export Service signed bundles Offline Verifier published binary read is a record rebuild source Audit Log Service — High-Level Architecture External / third party Security / platform Application we own Data store Queue / topic event / async batch The acknowledgement is given at the buffer, not at the segment. What that promise means, and what it does not, is the subject of view 20. v 1.0 · owner Data & AI Global Practice · date 2026-09 High-Level Architecture Seven stages from a producer's call to a proof an outsider can check — and the one feedback edge that surprises people. HTML page SVG draw.io
03 Capture plane — may create a record, may never remove one Boundary Ingest API write only Validator schema + secrets Hand-off Durable Buffer no delete verb Quarantine rejections, audited Custody plane — may retain and expire, may never create a record Seal and chain Sealer append only Chain Service hash forward Segment Store locked retention Expire Retention Engine extend, never shorten Legal Hold Registry legal role only Disposal Service certificate or nothing Query plane — derived, authoritative for nothing Projection Indexer rebuildable Search Index disposable Access Query API tenant scoped Archive Query async jobs Evidence plane — may read and prove, may never write a record Proof Verifier recompute chain Proof Service inclusion, absence Delivery Export Service watermark, cap Offline Verifier no service needed Managed HSM key custody team Confidential Ledger checkpoint custody Microsoft Entra ID identity team sealed hand-off projection signed head sign, never export Four Planes — No Principal Can Both Write and Remove Application we own Queue / topic Data store External / third party Security / platform event / async synchronous Four planes, four managed identities, four Entra groups, no membership overlap. The capture plane holds no delete verb in its data-access layer; the custody plane holds no insert verb for records. v 1.0 · owner Data & AI Global Practice · date 2026-09 Four Planes and the Rule Between Them The critical design decision drawn as a boundary: which plane may create a record, which may retain and expire one, and which may only prove things about them. HTML page SVG draw.io

2 · People and journeys

Who the record is for, what each of them is trying to get done, and the three journeys that decide whether this service is worth having.
04 The people the record is for Investigator 38 named, scoped Goal — Show me every privileged action this account took last March, and tell me honestly whether I am seeing all of them. Core journeys Trace an account view 05 Scope a breach window Compliance Officer 12 named Goal — Give me something I can hand to a regulator that they can check without ever asking us a question. Core journeys Produce an evidence bundle Certify a disposal External Auditor annual and ad hoc Goal — Prove to me that the record could not have been altered, without me having to trust you or your operators. Core journeys Verify a bundle offline view 06 Challenge a gap in a range The people who run it Platform Operator SRE, on call 24×7 Goal — Hold ingest above 99.99% without ever being able to read a single customer's audit record. Core journeys Absorb a 4× burst Rebuild the index Security Engineer detection and response Goal — Be told within fifteen minutes if anyone has touched a segment, and that includes me. Core journeys Answer a divergence alert Review export anomalies Legal Hold Officer segregated, 4 named Goal — Freeze everything touching this matter today, and be certain nothing expired overnight while I slept. Core journeys Place and lift a hold Prove nothing was lost The systems that write to it Business Application 410 services, one SDK Goal — Emit my audit events without your outage becoming my outage. Core journeys Onboard an event class view 07 Survive an audit outage Admin Console privileged surfaces Goal — Record the privileged action I just performed, including the one that was refused. Core journeys Record a denied action Azure Control Plane Activity Log export Goal — Land every subscription-level change in the same record as the applications, not in a portal of its own. Core journeys Export control-plane events The Service Itself reads, exports, holds Goal — Audit my own use into myself, so nobody reads this log without leaving a record of having read it. Core journeys Write a read record Write a key-use record The machines that act without being asked Rolling Verifier full corpus / 7 days Goal — Walk the whole chain every week and name the first divergence before anyone else finds it. Core journeys Complete a sweep Retention Scheduler nightly window Goal — Dispose of exactly what expired, nothing that is held, and leave a signed certificate behind. Core journeys Run a disposal window Index Reconciler continuous Goal — Find the record that exists but cannot be found, before an auditor does. Core journeys Repair a divergence Cross-Region Replicator continuous, one way Goal — Keep the second region inside RPO 0 while holding no right to delete anything in the first. Core journeys Replicate segments Who the Record Is For, and What Each of Them Gets to Do Person or role Journey / task External / third party Security / platform Four groups, and the fourth is the one usually left off. A weekly verifier and a nightly disposer have SLAs, failure paths and blast radius of their own; leaving them off the cast list is how they end up with no owner. v 1.0 · owner Data & AI Global Practice · date 2026-09 Actors and Their Core Journeys Fourteen actors in four groups, each with the goal they actually arrive with — including the four that are machines. HTML page SVG draw.io
05 Investigator Security incident response Goal — Establish who granted this role, under whose authority, and whether the record is complete Trigger — An alert: a service principal acquired Owner on a production subscription overnight Done when — A defensible timeline handed to the incident lead, with a stated completeness bound 1 · Suspect the alert lands 2 · Scope actor and window 3 · Search ◆ moment of truth 4 · Corroborate ◆ moment of truth 5 · Hand over to incident lead What they do Reads the alert Fixes actor + window Cites justification Queries by actor Widens to resource Checks denied too Pulls before/after Exports the range Where they do it Alert console Query console Query API Query API Export console Behind the glass Alertmanager RBAC scope check ClickHouse index Segment fetch Export service How it feels Confident Working Doubting Where it hurts Scope check is slow Is the index complete? Payload not in index What answers it Precomputed scope Completeness bound Fetched on demand Signed bundle Investigator — Trace an Account Through Thirteen Months The trough is at Search, and it is not about speed. The investigator cannot tell whether an empty result means nothing happened or the index has not caught up — which is why every result carries the sealed segment it is complete to. View 22. v 1.0 · owner Data & AI Global Practice · date 2026-09 Journey — Trace an Account Through Thirteen Months The investigator's path from an alert to a defensible timeline, and the moment where the tool stops being trustworthy to them. HTML page SVG draw.io
06 External Auditor Appointed by the regulator Goal — Satisfy myself that the record could not have been altered, on evidence I can check myself Trigger — The annual controls audit, plus one range subpoenaed under litigation Done when — A signed opinion that the range is intact — or a named, dated divergence 1 · Request names a range 2 · Receive the bundle 3 · Verify offline ◆ moment of truth 4 · Challenge ◆ moment of truth 5 · Conclude opinion issued What they do Names tenant + range Takes the bundle Runs the verifier Checks the anchor Asks about a gap Signs the opinion Where they do it Evidence request Signed bundle audit-verify CLI Disposal certificate Opinion letter Behind the glass Export service Proof service Published key Tombstone record How it feels Satisfied Working Sceptical Where it hurts Trusts nothing said Whose key is this? A gap reads as tamper What answers it Bundle self-contained Third-party anchor Lawfully disposed No service call made External Auditor — Verify Without Trusting the Operator The only phase that rises is the one performed offline. Everything the service says about itself is discounted; what carries the audit is a bundle that verifies with a published algorithm and a public key. Views 24 and 30. v 1.0 · owner Data & AI Global Practice · date 2026-09 Journey — Verify Without Trusting the Operator The only journey in the set whose best moment happens offline, on a machine this organisation does not run. HTML page SVG draw.io
07 Producer Engineer One of 410 owning teams Goal — Emit audit events for a new privileged action without taking on a new availability dependency Trigger — A role-grant screen ships next sprint and legal has classed it as auditable Done when — Events land, and I can prove afterwards which ones were sealed 1 · Model the event class 2 · Onboard identity 3 · Emit ◆ moment of truth 4 · Outage ◆ moment of truth 5 · Reconcile prove it landed What they do Picks an action verb Declares the class Federates identity POST /v1/events Spools locally Checks receipts Where they do it Schema registry Entra federation Ingest SDK Local spool Receipt API Behind the glass Apicurio + review No shared secret Dedup + quota 72 h buffer Seal receipt How it feels Confident Working Blocked Where it hurts Verb must be agreed Open or closed? Was it really sealed? What answers it Vocabulary PR, 1 day Short-lived tokens p99 150 ms Declared per class Seal receipt API Producer Engineer — Emit Without Inheriting Our Outage The trough is the outage, and it is a design question rather than a UX one: the producer must know before it ships whether this class fails open with a gap marker or fails closed and stops the business action. View 27 makes that a declaration, not a default. v 1.0 · owner Data & AI Global Practice · date 2026-09 Journey — Emit Without Inheriting Our Outage The producer's path, and the phase where an architecture question is wearing a UX costume. HTML page SVG draw.io

3 · Structure

The layering rule, the deployable units inside each plane, every interface in and out, and the shape of the hash chain that makes tampering provable.
08 Access and evidence Query Console scoped, justified Export Service watermarked Proof Service inclusion, absence Offline Verifier published binary Receipt API commit, seal Service Ingest API write only Query API read only Verification Service range and rolling Retention Engine extend only Disposal Service certificate signed Processing Validator JSON Schema Secret Detector pre-commit Sealer Parquet · zstd Chain Service Merkle Indexer at-least-once Reconciler segment vs index Data Kafka Buffer 72 h Segment Store Blob WORM Checkpoint Ledger append only ClickHouse Index derived Segment Registry PostgreSQL Dedup Cache Valkey · 24 h Platform AKS 3 zones Microsoft Entra ID workload identity Managed HSM FIPS 140-3 L3 OPA authorization Prometheus + Loki no record content Argo CD GitOps read is a record certificate is a record Layered Architecture — Dependencies Point One Way Application we own External / third party Queue / topic Data store Security / platform event / async The two lateral arrows are the log auditing its own use; key use in the HSM re-enters the same way. Nothing points up: a layer calls only downwards, and the data layer calls nothing at all. v 1.0 · owner Data & AI Global Practice · date 2026-09 Layered Architecture What depends on what, and the two sideways arrows that are the log auditing its own use. HTML page SVG draw.io
09 Capture plane — namespace audit-ingest · managed identity ingest-mi envoy-gateway Envoy · mTLS · 12 pods ingest-api Rust axum · 24 pods admission schema · secrets · size quota-governor OPA · per tenant quarantine-writer rejections, audited Durable buffer — Strimzi on dedicated node pool kafka-broker 12 × D16s v5 · RF 3 kraft-controller 3 pods, 3 zones tiered-storage 6 h local, 72 h Blob Custody plane — namespace audit-custody · managed identity custody-mi sealer Go · 32 pods chain-service Go · 6, leader per shard checkpoint-signer Go · 3 pods compactor chain-preserving retention-engine Go · 3 pods disposal-service Go · 2 pods Query plane — namespace audit-query · managed identity query-mi indexer Go · 24 pods clickhouse 16 × E16ds v5 query-api Go · 12 pods reconciler Go · 4 pods trino archive, autoscaled Evidence plane — namespace audit-evidence · managed identity evidence-mi verifier Go · 16 pods proof-service Go · 6 pods export-service Go · 6 pods Azure Blob Storage immutable containers Confidential Ledger separate subscription Managed HSM per-tenant keys PostgreSQL Flexible registry, holds Valkey Cluster dedup, quota acks=all, isr 2 consume PUT once append head consume Container Architecture — Deployable Units (C4 L2) Interface / broker Application we own Queue / topic Security / platform Data store synchronous event / async Five namespaces, five managed identities, five Entra groups with no shared membership. Blob data-plane roles are granted per plane: the sealer may create a blob and no more; nothing anywhere holds Storage Blob Data Owner. v 1.0 · owner Data & AI Global Practice · date 2026-09 Container Architecture (C4 L2) Every deployable unit, its technology and its scale, grouped by the plane whose identity it runs under. HTML page SVG draw.io
10 Arrival Network Private Endpoint in-estate producers Front Door + WAF off-estate only Identity mTLS Termination Envoy Token Validation Entra · SPIFFE Tenant Assignment from identity only Admission — every check before the record can be accepted Shape Schema Validation versioned, Apicurio Vocabulary Check controlled verbs Size Cap 256 KB, reject Content Secret Detector Presidio + rules PAN / Credential reject, never redact Governance Idempotency Check 24 h window Tenant Quota token bucket Class Declaration open or closed Commit — the acknowledgement is issued here and nowhere earlier Durable write Kafka Producer acks=all, isr ≥ 2 Partition Router tenant · resource Promise Commit Receipt event_id + offset received_at Stamp service clock Rejection — a refusal is itself an auditable event Structured Error field and reason Quarantine Topic never blocks a partition Quarantine Segments same retention lock oversized secret found durable Ingest Plane — Everything That Happens Before the Acknowledgement Interface / broker Security / platform Application we own Decision point Data store Queue / topic failure / alternate event / async Nothing here transforms the record. Validation and detection can only accept or reject; there is no redaction path, because a record that had to be edited to be storable was never a faithful account of the action. v 1.0 · owner Data & AI Global Practice · date 2026-09 Ingest Plane Every check that happens before an event can be accepted — and the absence of any path that changes one. HTML page SVG draw.io
11 Assemble — a segment is closed at most 60 seconds after it opens Read Partition Reader ordered, committed Segment Grouping tenant · date · class Write Parquet Writer zstd · per-column Seal Trigger 60 s or 256 MB Chain — hashing forward so that removing anything invalidates everything after Hash Leaf Hashing SHA-256, canonical Segment Merkle Root RFC 6962 style Predecessor Link prev_root in header Sign Checkpoint Builder 15 min, all tenants HSM Signature non-exportable TSA Countersign RFC 3161 Lock — immutability is a storage property, not an application rule Object Immutable Container locked time-based Encryption Scope per-tenant CMK Version-Level Lock no overwrite Record of it Segment Registry PostgreSQL, derived Lifecycle Tiering hot → cool → archive Expire — acting only on records this plane did not create Retention Class 13 mo · 7 yr · 10 yr Hold Check tenant, actor, resource Crypto-Shred destroy segment DEK Disposal Certificate signed, re-ingested Tombstone Node chain stays verifiable Confidential Ledger chain heads only signed head Custody Plane — Seal, Chain, Lock, Expire Application we own Decision point Security / platform External / third party Data store synchronous The lock is set by a locked time-based retention policy on the container. Once locked, the policy can be extended and cannot be shortened, deleted or bypassed — not by the subscription owner, not by a support ticket, and not by the plane that wrote the object. v 1.0 · owner Data & AI Global Practice · date 2026-09 Custody Plane Assemble, chain, lock, expire — the four things that happen to a record after nobody can change it any more. HTML page SVG draw.io
12 Inbound Business Applications REST, sync Platform Services Kafka protocol Azure Activity Log diagnostic settings Legal Hold Console segregated role Audit Log Service Audit Log Service one versioned schema Outbound and dependencies Azure Blob Storage immutable, ZRS Confidential Ledger separate custody Managed HSM FIPS 140-3 L3 Microsoft Entra ID workload identity mTLS · 25 k/s stream Event Hub hold API write once append sign validate Integration Surface — Every Way In and Every Way Out External / third party Queue / topic Application we own Data store Security / platform synchronous event / async There is no interface that both writes and reads. A producer credential cannot query; a query credential cannot write anything except the read record the service writes on its behalf. Spool replay after an outage re-enters through the same inbound REST contract, carrying the original occurred_at. v 1.0 · owner Data & AI Global Practice · date 2026-09 Integration Surface Every way in and every way out, with protocol and direction — and no interface that is both. HTML page SVG draw.io
13 Level 1 — the record Canonical Bytes stored form, never re-encoded Leaf Hash SHA-256 with domain tag Leaf Index position within segment Level 2 — the segment, sealed at most every 60 seconds Merkle Tree RFC 6962 hashing Segment Root one per sealed object Segment Header prev_root, count, range Object Digest binds bytes to root Level 3 — one chain per tenant, so a proof reveals no other tenant Tenant Head hash of prev head + root Parallel Sealing 500 chains, no contention Tenant-Blind Proof path stays inside tenant Tombstone Link survives disposal Level 4 — one global checkpoint every 15 minutes binds every tenant Checkpoint Tree over all tenant heads HSM Signature non-exportable key TSA Countersign external clock Ledger Publication separate custody Public Witness Log Rekor · phase 3 leaves extends anchors phase 3 anchor The Shape of the Chain — Per-Tenant, Anchored Globally Application we own Data store Security / platform External / third party synchronous event / async Question 1 answered: per-tenant chains anchored into a global checkpoint. One global chain would serialise sealing at 100 k events/s and leak cross-tenant volume through every Merkle path; independent per-tenant chains would leave a tenant-scoped attacker a small structure to forge. v 1.0 · owner Data & AI Global Practice · date 2026-09 The Shape of the Hash Chain Four levels from a record's bytes to a signed global checkpoint — the answer to the first core question in the requirement. HTML page SVG draw.io

4 · Data

Which tier is the system of record and which is disposable, the canonical record, the model behind a proof, and where the tenant boundary sits in storage.
14 System of record — losing any of this is unrecoverable Immutable Segments Blob · 11 nines · RPO 0 Checkpoint Ledger separate subscription Disposal Certificates records inside the log Durable hand-off — loss of an acknowledged event here is a Sev-1 defect Kafka Buffer 72 h · RF 3 · isr 2 Quarantine Topic sealed like any other Derived and rebuildable — deleting all of it loses no record ClickHouse Index 90 d default, 13 mo max Segment Registry PostgreSQL · rebuildable Absence Filters for non-existence proofs Ephemeral — bounded loss accepted, stated on the contract Dedup Window Valkey · 24 h TTL Quota Counters reset on loss Result Cursors 15 min resumable seal ≤ 60 s rebuild Data Architecture — Four Tiers, Four Durability Contracts Data store Queue / topic event / async batch Losing the dedup window costs duplicate records, which are visible and reconcilable. Losing the index costs query latency for the length of a rebuild — 2.6 TB/day re-read from segments. Losing a segment costs the audit its meaning, which is why only that tier gets a locked retention policy. v 1.0 · owner Data & AI Global Practice · date 2026-09 Data Architecture Four tiers with four different durability contracts, ordered by what losing each one actually costs. HTML page SVG draw.io
15 tenant tenant_id PK residency_region retention_policy_id FK key_uri (HSM) index_window_days retention_class class_id PK online_months archive_years disposal_grace_days = 30 extendable (never reduced) legal_hold hold_id PK scope_type tenant|actor|resource|range scope_value matter_ref opened_by (legal role only) actor actor_id PK principal_type human|service principal auth_method on_behalf_of (nullable) audit_record event_id PK (service-assigned) tenant_id FK (from identity) occurred_at (producer asserts) received_at (service clock) clock_divergence_s action (controlled verb) outcome success|denied|error idempotency_key schema_version retention_class_id FK fail_mode open|closed resource resource_id PK resource_type stable_identifier tenant_id FK source source_id PK network_origin user_agent session_id request_correlation_id payload payload_ref PK before_value after_value bytes (record cap 256 KB) secret_scan_verdict authority authority_id PK authority_kind policy|role|grant policy_ref grant_ref approval_ref 1 : N 1 : N N : M 1 : N 1 : N 1 : N 1 : 1 1 : N The Audit Record — One Canonical, Versioned Schema tenant_id and received_at are assigned by the service and are the only fields a producer cannot influence. occurred_at is kept exactly as asserted, never corrected — the divergence is recorded beside it instead. v 1.0 · owner Data & AI Global Practice · date 2026-09 The Audit Record One canonical, versioned schema — and the small number of fields the producer is not allowed to influence. HTML page SVG draw.io
16 segment segment_id PK tenant_id FK event_class · date_partition blob_uri (immutable container) object_digest SHA-256 merkle_root prev_root (predecessor) record_count dek_id (HSM-wrapped) retention_until sealed_at chain_head head_id PK tenant_id FK sequence segment_id FK prev_head_hash head_hash checkpoint checkpoint_id PK checkpoint_root (all tenant heads) tenant_head_count hsm_key_version signature tsa_token RFC 3161 ledger_txn_id signed_at tombstone tombstone_id PK segment_id FK merkle_root (retained) certificate_id FK method crypto-shred disposed_at inclusion_proof proof_id PK event_id FK segment_id FK leaf_index audit_path checkpoint_id FK evidence_bundle bundle_id PK query_hash record_count manifest_digest signature watermark (role, caller) disposal_certificate certificate_id PK retention_class_id FK range_from · range_to record_count policy_ref signature event_id FK (written back in) 1 : 1 N : 1 1 : 0..1 1 : N N : M N : 1 N : 1 N : M Segment, Chain and Certificate — What Makes a Range Provable The tombstone is the reason a disposed range verifies as lawfully disposed rather than as tampering: the segment bytes go, the Merkle root and the certificate that authorised their going both stay in the chain. v 1.0 · owner Data & AI Global Practice · date 2026-09 Segment, Chain and Certificate The entities that make a range provable, including the one that lets a disposed range still verify. HTML page SVG draw.io
17 Accepted JSON Record p50 1.2 KB · p99 8 KB Commit Receipt event_id + offset Buffered Ordered Partition 240 partitions Zone Replication 3 AZ · isr 2 Sealed and chained Parquet Segment zstd · ~4 : 1 Merkle Root ≤ 60 s window Signed Checkpoint every 15 min Locked Immutable Object locked policy · ZRS Tier Schedule hot 30 d → cool Indexed Query Projection no payload bytes ClickHouse Insert p95 60 s from commit Reconciliation count + root match Answerable Point Query 30 d · p95 2 s Aggregate Query 13 mo · p95 30 s Archive Job Trino · ≤ 12 h rebuild source beyond the index Data Flow — Accepted Record to Answerable Query Application we own Queue / topic Data store Security / platform batch Volume: 2.2 billion events/day, 2.6 TB raw, 650 GB compressed. The index carries no payload bytes — an investigator who needs before/after values pays a segment fetch for them, which keeps the dominant marginal cost proportional to the fields people actually filter on. v 1.0 · owner Data & AI Global Practice · date 2026-09 Data Flow — Commit to Answerable What happens to one record between the acknowledgement and the moment somebody can find it, with the volumes at each hop. HTML page SVG draw.io
18 0 – 30 days 30 days – 13 months 13 months – 7 years 7 – 10 years (elevated) After expiry Segment store Blob Hot ZRS locked policy Blob Cool ZRS locked policy Blob Archive locked policy Blob Archive elevated class only Crypto-Shred certificate signed Query path ClickHouse NVMe p95 2 s ClickHouse on Blob per-tenant opt-in Trino over segments async, ≤ 12 h Trino over segments async, ≤ 12 h Rows Dropped index only Checkpoint ledger Confidential Ledger append only Confidential Ledger append only Confidential Ledger append only Confidential Ledger append only Outlives Records proofs still verify Ingest buffer Kafka · 72 h replay window Storage cost ≈ $23 / TB-month ≈ $10 / TB-month ≈ $2 / TB-month ≈ $2 / TB-month $0 and provably so Retention and Tiering — Tier Is a Cost Decision, Never an Immutability One Every cell in the top row carries the same locked retention policy. The tier changes what the storage costs and how long a read takes; it never changes what a principal is permitted to do to the object. v 1.0 · owner Data & AI Global Practice · date 2026-09 Retention and Tiering What each store does at each age — and the one property that does not change as things get cheaper. HTML page SVG draw.io
19 486 tenants — shared containers, tenant as the first partition key Shared Container one locked policy tenant / date / class prefix is the boundary Encryption Scope per tenant, per blob Per-Tenant KEK Managed HSM Query Tenant Filter from identity, not input 14 tenants — dedicated accounts where residency or contract requires it Storage Account one per tenant Own Region residency assignment Own Locked Policy own retention terms Customer-Held Key phase 3 Never shared, on either side of that line Hash Chain one per tenant Proof Path reveals no other tenant Ingest Quota largest is 35% Index Partition pruned before scan Residual risk, accepted and monitored Shared Policy Error one config, 486 tenants Small-Object Tail compaction required Ciphertext Only misroute yields nothing wraps segment DEK Where the Tenant Boundary Sits in Storage Data store Application we own Security / platform Risk / gap Opportunity synchronous Question 7 answered as a split, not a principle. Physical separation for 500 tenants would multiply locked-policy and lifecycle configuration by 500 and shatter the long tail into objects too small to be economic; a shared container with a per-tenant encryption scope makes a misrouted read return bytes the reader holds no key for. v 1.0 · owner Data & AI Global Practice · date 2026-09 Where the Tenant Boundary Sits The answer to the seventh core question, given as a split rather than a principle. HTML page SVG draw.io

5 · Runtime

Ingest and what the acknowledgement promises, sealing and signing, querying and the record a query leaves, verification, export, disposal, legal hold, an audit-plane outage and an index rebuild.
20 Producer SDK Envoy Gateway Ingest API Entra / SPIRE Valkey Dedup Kafka Buffer Sealer 1. POST /v1/events — batch of 500 2. validate workload token (mTLS bound) 3. principal + tenant_id 4. forward with observed identity 5. schema, vocabulary, 256 KB cap 6. secret scan — reject, never redact 7. SETNX idempotency_key, TTL 24 h 8. new (or duplicate: return first event_id) 9. produce · acks=all · isr ≥ 2 10. offset durable in 3 zones 11. 202 + commit receipt (event_id, offset) 12. consume within the seal window 13. seal receipt queryable ≤ 60 s later Synchronous Ingest — What the Acknowledgement Actually Promises Question 3 answered. The acknowledgement at message 11 promises the record is durable across a zone loss and will be sealed; it does not yet promise the object is under a retention lock. That gap is bounded at 60 seconds, measured, and alerted — an acknowledged record that never reaches a segment is a Sev-1 defect, not a gap. v 1.0 · owner Data & AI Global Practice · date 2026-09 Synchronous Ingest Thirteen messages from a producer's call to a durable commit — and a precise statement of what message 11 promises. HTML page SVG draw.io
21 Kafka Buffer Sealer Immutable Blob Chain Service Managed HSM Timestamp Authority Confidential Ledger 1. poll committed offsets, ordered 2. group by tenant · date · event class 3. close at 60 s or 256 MB, whichever first 4. PUT segment — create-only permission 5. object digest + immutable-until 6. merkle_root, prev_root, object digest 7. extend this tenant's head 8. sign checkpoint over all tenant heads 9. signature — key never leaves the HSM 10. timestamp request over checkpoint root 11. RFC 3161 token 12. append signed head 13. ledger transaction receipt 14. key-use event, back into the log Seal, Chain, Sign, Publish — One 15-Minute Checkpoint If the HSM is unreachable, messages 1 to 7 continue and 8 onwards pause: ingest never fails because sealing cannot proceed. The unsigned interval is visible in verification as pending, never as a break. v 1.0 · owner Data & AI Global Practice · date 2026-09 Seal, Chain, Sign, Publish One fifteen-minute checkpoint end to end, including what happens when the key service is unreachable. HTML page SVG draw.io
22 Investigator Query API OPA + Entra Ingest API ClickHouse Segment Store 1. actor + range + justification reference 2. role, tenant scope, query budget 3. permitted · 30 s budget · 50 k row cap 4. record.read written BEFORE execution 5. committed 6. scan — tenant partition pruned first 7. rows + last reconciled segment id 8. fetch payload bytes for this page only 9. decrypt under this tenant's key 10. page + cursor + completeness bound 11. result count and truncation flag An Investigative Query — and the Record It Leaves Behind The read record is written before the query runs, so a query that times out, is cancelled or returns nothing is still on the record. Writing it afterwards would make the interesting case the one that leaves no trace. v 1.0 · owner Data & AI Global Practice · date 2026-09 An Investigative Query Eleven messages, and the one that is deliberately ordered before the query runs rather than after. HTML page SVG draw.io
23 Trigger On-Demand Range 24 h in ≤ 90 s Rolling Sweep full corpus / 7 days Export Trigger before every bundle Fetch Segment List from registry Object Bytes read-only role Checkpoints from the ledger Recompute Leaf Hashes canonical bytes Merkle Roots per segment Head Chain per tenant Compare Root vs Header segment integrity Head vs Checkpoint ordering integrity Signature + Token authenticity, time Verdict Intact Through named segment, time Broken Here first divergence named Lawfully Disposed under certificate X Respond Divergence Alert ≤ 15 min Index Repair automatic, from segments Segment Incident never auto-repaired page security result is a record Verification — Intact, Broken Here, or Lawfully Disposed Application we own Security / platform Data store Decision point Opportunity Risk / gap failure / alternate event / async The verdict is never a bare boolean. Intact carries the segment and timestamp it is intact through; broken carries the first divergence and its position; disposed carries the certificate that authorised it. An auditor can act on all three and on none of a true/false. v 1.0 · owner Data & AI Global Practice · date 2026-09 Verification Six stages from a request to a verdict — and why the verdict is never a boolean. HTML page SVG draw.io
24 Compliance Officer Export Service Proof Service Confidential Ledger Ingest API External Auditor audit-verify CLI 1. export this result — matter reference 2. per-role export budget check 3. inclusion proofs for N records 4. leaf index + audit path per record 5. covering checkpoints for the range 6. signed heads + TSA tokens 7. manifest, watermark, HSM signature 8. record.export — who, what, how many 9. bundle + manifest digest 10. delivered out of band 11. audit-verify bundle --key published.pem 12. intact — no service was contacted Evidence Bundle — Verified by Someone Who Trusts Nobody Messages 11 and 12 involve nothing this organisation runs. The bundle is self-contained, the algorithm is published, the key is published and anchored, and the auditor's laptop is offline — which is the only configuration in which the verdict means anything. v 1.0 · owner Data & AI Global Practice · date 2026-09 Evidence Bundle and Offline Verification Twelve messages, the last two of which involve nothing this organisation runs. HTML page SVG draw.io
25 Class Assigned at commit, in storage Expiry Computed retention_until Hold Check 4 granularities Key Destroyed segment DEK in HSM Certificate Signed class, range, count Tombstone Linked root retained Bytes Removed lifecycle, lock expired Disposal within 30 days of expiry policy, not code nightly scan no hold applies record unreadable written back in range still verifies class reassigned on renewal Disposal — A Governed, Evidenced Act Application we own Decision point Security / platform Data store Question 5 answered as a sequence rather than a choice. Crypto-shredding makes the record unreadable the moment the key dies, while the ciphertext waits for the retention lock to expire before the lifecycle rule can remove it — so the erasure is instant and the deletion is still real. v 1.0 · owner Data & AI Global Practice · date 2026-09 Disposal Seven steps that close a loop, and the answer to the fifth core question given as a sequence rather than a choice. HTML page SVG draw.io
26 Matter Litigation Notice counsel Regulator Request supervisory Scope Scope Declared tenant · actor · resource Time Range open-ended permitted Two-Person Approval legal + compliance Apply Hold Registry legal role writes retention_until Extended extend only Disposal Suspended indefinitely Effect Segments Excluded from every sweep Tiering Continues cost still falls Index Unaffected queries unchanged Lift Matter Closed same two roles Expiry Recomputed never backdated Evidence Hold Is a Record placed and lifted Certificate Cites It why it waited audited Legal Hold — Suspending Disposal Without Touching a Record External / third party Application we own Decision point Data store Security / platform Opportunity event / async A hold changes when a record may be disposed of and nothing else. It does not hide the record, does not move it, does not alter its class and cannot be applied by anyone who can read the records it protects. v 1.0 · owner Data & AI Global Practice · date 2026-09 Legal Hold How disposal is suspended indefinitely without anybody touching, moving or hiding a record. HTML page SVG draw.io
27 Declare Emit normally Audit plane down Spool exhausted Recover Critical class — role.grant · key.use · policy.change · record.export fail_mode = closed Synchronous ack required Retry 3× with backoff Business action refused No gap to explain Standard class — record.read · session.start · config.view fail_mode = open Async, receipt later Spool locally ≥ 1 h Gap marker emitted Replay, original occurred_at What the service does Class fixed in the registry Dedup on idempotency key Buffer holds 72 h Counts dropped, per tenant Flags skew beyond 5 min What an auditor later sees Policy, per class, dated The gap marker is a record Late arrival is visible When the Audit Plane Is Unavailable — Declared per Event Class Question 2 answered. Fail-open everywhere buys availability and quietly sells the record; fail-closed everywhere makes this service a first-order dependency of 410 others at a 99.99% target its callers do not themselves meet. The class declares it, the producer cannot change it at runtime, and the gap marker means an open failure is still an event rather than a silence. v 1.0 · owner Data & AI Global Practice · date 2026-09 When the Audit Plane Is Unavailable The second core question answered per event class, with what an auditor sees afterwards in the bottom lane. HTML page SVG draw.io
28 Detect Reconciler Divergence count or root mismatch Node or Disk Loss shard unavailable Decide Partition Repair minutes Full Rebuild 90 d ≈ 14 h Tenant Priority largest and regulated first Degrade Trino Over Segments slower, still correct Query SLO Suspended stated, not hidden Ingest Untouched still 99.99% Rebuild Read Segments 650 GB/day compressed Parallel Insert 24 indexer pods Absence Filters rebuilt with it Reconcile Count per Segment index vs registry Root per Segment index vs chain Restore Completeness Bound advances to now SLO Resumed p95 2 s again mismatch, re-read Losing the Index — and Why It Loses No Record Application we own Risk / gap Decision point Opportunity Data store failure / alternate Question 4 answered by making divergence measurable rather than impossible. Two stores are kept, and every query result states the sealed segment it is complete to — so the index is never quietly treated as authoritative, and a record that exists but cannot yet be found is visible as such. v 1.0 · owner Data & AI Global Practice · date 2026-09 Losing the Index Six stages proving the claim the whole set rests on — that deleting the index loses no record. HTML page SVG draw.io

6 · Operations

Where it runs, how it survives a region, how a change to the rules is approved, what is watched, what it costs, and the operator's loop over a system they cannot read.
29 Azure · West Europe Availability zone 1 AKS Ingest Pool 3 × D16s v5 Kafka Brokers 4 of 12 ClickHouse Shards replica set A Custody Pool sealer, chain Availability zone 2 AKS Ingest Pool 3 × D16s v5 Kafka Brokers 4 of 12 ClickHouse Shards replica set B Custody Pool sealer, chain Availability zone 3 AKS Ingest Pool 3 × D16s v5 Kafka Brokers 4 of 12 ClickHouse Shards replica set C Custody Pool sealer, chain Zone-redundant by construction — no single zone holds the only copy Blob Storage ZRS immutable containers PostgreSQL Flexible zone-redundant HA Managed HSM 3-zone pool Front Door + WAF global anycast Private Endpoints in-estate producers Separate subscription, separate administrators, separate break-glass Confidential Ledger chain heads Checkpoint Signing Key own HSM pool Ledger Admin Group no segment access Microsoft Entra ID global tenant Timestamp Authority third party seal signs heads Deployment — One Region, Three Availability Zones Security / platform Queue / topic Data store Interface / broker External / third party event / async synchronous Loss of one zone removes a third of ingest capacity and no data: Kafka keeps isr ≥ 2, ClickHouse keeps two replicas, and the segment store is zone-redundant beneath the immutability policy. Producers see nothing but a brief drop in a connection pool. v 1.0 · owner Data & AI Global Practice · date 2026-09 Deployment — One Region, Three Zones What runs where, what is zone-redundant by construction, and which subscription deliberately is not ours. HTML page SVG draw.io
30 West Europe — active Ingest Plane 25 k/s steady Custody Plane sealing, chaining Query Plane full index Segment Store locked, ZRS North Europe — warm standby Ingest Plane 20% warm · RTO 15 min Custody Plane idle, resumes chain Query Plane lagging · RTO 4 h Segment Replica locked at destination Continuous replication — one way, no delete right at the destination Object Replication segments · RPO ≈ 0 MirrorMaker 2 buffer · 72 h ClickHouse Replica rebuildable anyway PostgreSQL Replica registry, holds Custody independent of both regions Confidential Ledger own subscription Timestamp Authority outside the estate Published Public Key verifier needs no API Public Witness Log Rekor · phase 3 locked on arrival signed heads Two Regions, and a Custody Chain That Belongs to Neither Application we own Data store Queue / topic External / third party Security / platform event / async synchronous A region failover changes which region seals; it changes nothing about what has already been sealed. The chain continues in the second region from the last checkpoint the ledger holds, and the ledger is in neither region's subscription — which is what stops a regional administrator from being able to rewrite both sides of the evidence. v 1.0 · owner Data & AI Global Practice · date 2026-09 Two Regions, and Custody That Belongs to Neither Active-passive failover, one-way replication, and the reason the checkpoint ledger sits outside both regions. HTML page SVG draw.io
31 Source GitHub Repository service + IaC + policy Schema Pull Request vocabulary review Build Container Build reproducible SBOM + Signature Syft · Cosign Property Tests chain invariants Gate No-Delete-Verb Check custody data layer Schema Compatibility backward only Retention Lock Scan IaC policy Approve Multi-Party Approval retention · keys · access Entra PIM time-boxed elevation Approval Is a Record each approver Deploy Argo CD one app per plane Blue / Green Ingest no dropped ack Canary Custody one shard first Verify Synthetic Probe ingest → seal → verify Automatic Rollback on chain conformance revert revision Shipping the Service, and Changing the Rules It Enforces External / third party Application we own Security / platform Decision point Opportunity failure / alternate The no-delete-verb gate is a static check over the custody plane's data-access layer: any UPDATE, DELETE or blob-delete call reaching that package fails the build. Principle 1 of this architecture is enforced by CI, not by a code-review convention. v 1.0 · owner Data & AI Global Practice · date 2026-09 Shipping the Service, Changing the Rules Six stages, one of which enforces the whole architecture's central principle in CI rather than in code review. HTML page SVG draw.io
32 Ingest Buffer Seal and chain Custody Query Evidence Metrics · Prometheus ack p50 / p99 reject rate isr, lag, disk per partition Seal age unsigned interval Objects locked tier mix p95 by range rows scanned Verify duration divergence count Logs · Loki Rejection reasons never the payload Broker events Seal gaps resume points Lifecycle actions Query hash only text is in the log Verdict lines Traces · OpenTelemetry Gateway → produce Seal → sign Query → fetch Bundle assembly Alerts · Alertmanager p99 > 150 ms 5 min window isr page immediately Seal age > 120 s Delete attempted always an incident Export anomaly volume, hour, scope Divergence within 15 min Into the log itself Quota denial Topic config change Key use Disposal certificate record.read record.export Observability — Signal Type by Pipeline Stage The monitoring stack never receives record content. Metrics carry counts and latencies, logs carry reasons and hashes, and anything that would tell an operator what a record said belongs in the log rather than in Grafana. v 1.0 · owner Data & AI Global Practice · date 2026-09 Observability Signal type by pipeline stage, and the deliberate emptiness of the monitoring stack. HTML page SVG draw.io
33 Capture AKS Ingest $5.0 k / month Kafka + Tiering $7.5 k / month Custody Segments, Primary $4.1 k · 257 TB Replication + DR $4.0 k / month Managed HSM × 2 $4.6 k · fixed Confidential Ledger $2.0 k · fixed Index — the dominant marginal cost ClickHouse · 90 days $5.5 k / month Extend to 13 months + $6.5 k / month Serve and prove Trino Archive $1.5 k · on demand Verify + Export $1.5 k / month Shared Services $3.0 k / month Per million events retained 13 months Achieved $0.65 per million Fixed Floor $0.24 per million Target $0.09 7× short — see cards Cost — Where the Money Goes, and Where the Target Does Not Reach Application we own Queue / topic Data store Security / platform Opportunity Decision point Risk / gap 66 billion events a month at $42.7 k gives $0.65 per million. The stated $0.09 target implies $5.9 k a month, which the segment store alone consumes before a single core is switched on. The number to renegotiate is the target, and the cards say what could move it. v 1.0 · owner Data & AI Global Practice · date 2026-09 Cost Where the money actually goes, and an honest statement that the stated target is not reachable. HTML page SVG draw.io
34 Watch seal age, isr, divergence Detect alert names a runbook Degrade in the declared order Repair index from segments Evidence the action is a record Review weekly sweep, exports Operate no record access signal, not content buffer first, index last never the reverse including break-glass what the sweep found tune the thresholds The Operator's Loop — Running a System You Cannot Read Security / platform Decision point Application we own Opportunity Degradation has a declared order and the operator does not get to choose it: accept and durably buffer first, seal and verify second, index for query third. Query freshness is spent before durability, never the reverse. v 1.0 · owner Data & AI Global Practice · date 2026-09 The Operator's Loop Running a system you are structurally forbidden from reading, and the order in which it is allowed to degrade. HTML page SVG draw.io

7 · Assurance

Trust zones, identity, separation of duties, key custody, what each insider attempt actually meets, and every named failure mode with its required handling.
35 Internet — assumed hostile Off-Estate Producer partner systems Auditor Workstation offline verification Published Key + Algorithm deliberately public Perimeter — holds no key Front Door + WAF rate limit, TLS 1.3 Private Endpoint in-estate default path Envoy mTLS SVID or Entra token Capture — write only Ingest API ingest-mi Validator + Detector reject or accept Kafka Buffer no delete API exposed Custody — no standing access Sealer + Chain custody-mi Segment Store create-only role Retention Engine extend only Evidence and query Query API query-mi, tenant scoped Verifier read-only on segments Export Service capped, watermarked Key and checkpoint custody Managed HSM non-exportable Confidential Ledger append only Custody Admin Group disjoint membership TLS 1.3 + workload token principal, tenant, write scope consume, in-cluster mTLS read-only SAS-free RBAC sign · Crypto User only signed bundle, out of band Trust Zones — Every Crossing Authenticated, Every Zone Narrower External / third party Security / platform Interface / broker Application we own Queue / topic Data store synchronous event / async Zones narrow left to right and every crossing is mutually authenticated, in-cluster included. The perimeter can see a record in flight and can read none at rest; the custody zone has no standing human access at all; and the last edge leaves unauthenticated on purpose, because the bundle is built to be verified by someone holding no credential of ours. v 1.0 · owner Data & AI Global Practice · date 2026-09 Trust Zones Six zones of decreasing exposure, every crossing authenticated — and the one edge that deliberately is not. HTML page SVG draw.io
36 Producer Workload SPIRE Server Microsoft Entra ID Envoy Gateway Ingest API Custody Pod Managed HSM 1. attest node and workload selectors 2. SVID · TTL 1 h · no secret on disk 3. federated credential exchange 4. token · 60 min · aud audit-ingest 5. mTLS with SVID + bearer token 6. validate signature, audience, tenant claim 7. observed principal · scope = write 8. no read scope exists for this principal 9. managed identity custody-mi 10. sign checkpoint · role Crypto User 11. signature — key cannot be exported 12. key-use event, into this log Identity — Short-Lived Everywhere, No Shared Secret Anywhere The identity the service records on an event is the one it observed at message 7, never the one the payload claims. A producer that lies about its own actor field is contradicted by the record beside it, which is the point of recording both. v 1.0 · owner Data & AI Global Practice · date 2026-09 Identity and Credentials How a workload proves who it is, and why the service records the identity it observed rather than the one it was told. HTML page SVG draw.io
37 Write a record Read records Export evidence Legal hold Retention policy Verify Operate Producer Own tenant only Investigator Scoped + justified Own result range Compliance Tenant-wide Budgeted, watermarked Propose only Any range Legal Hold Officer Place and lift Operator No record access Verifier Checkpoints only Retention Board Two approvals Break-glass PIM, time-boxed every action recorded Who May Do What — Blanks Are Denials, Not Omissions Two invariants shape the blanks. No role can both write a record and influence its retention or disposal; no role can both read records and administer the policy governing reading. The service's own operators appear here with a single capability and no read. v 1.0 · owner Data & AI Global Practice · date 2026-09 Roles and Separation of Duties Eight roles against seven capabilities, where the blanks are the design. HTML page SVG draw.io
38 Signing — one key makes a checkpoint believable Managed HSM Pool own subscription EC P-384, Non-Exportable FIPS 140-3 L3 Crypto User: Signer Only one workload identity Rotation with Overlap old key still verifies Encryption — one key per tenant, one data key per segment Tenant KEK 500 keys in HSM Segment DEK wrapped, per object Blob Encryption Scope bound to the prefix Shred = Destroy DEK instant, irreversible Publication — what an outsider needs and gets Public Verification Key published, versioned Verification Algorithm specified, open TSA Certificate Chain third-party root Witness Anchor phase 3 What no principal holds, by construction Exportable Private Key no export path Standing HSM Admin PIM, quorum, audited Sign and Delete no such principal wraps public half Key Custody — What Nobody Holds Is the Design Security / platform Application we own External / third party Risk / gap synchronous Every use of the signing key is itself an audit event in this log, which means the log records the operations that make the log believable. A rotation overlaps so old checkpoints keep verifying, and needs two approvals recorded as events before it can begin. v 1.0 · owner Data & AI Global Practice · date 2026-09 Key Custody Three kinds of key, what the outside world is given, and the combinations nobody holds. HTML page SVG draw.io
39 The attempt What stops it What it leaves Detected within Residual Service operator Delete a segment Locked retention policy Refused delete, logged Immediate alert None Subscription owner Delete the container Policy outlives the owner Activity Log + our log ≤ 15 minutes Index can be destroyed rebuildable Custody engineer Rewrite a segment Create-only permission Chain diverges Next sweep or export Detection lag ≤ 7 d Checkpoint administrator Rewrite chain heads No segment access Heads vs segments differ On verification Needs the other admin Both administrators colluding Rewrite both sides External TSA token Token time mismatch On offline verify Phase 3 anchor closes it Authorised investigator Bulk-export a tenant Per-role export cap Watermarked export record Anomaly alert Read cannot be undone The Operators Are In Scope — What Each Attempt Actually Meets Bulk export is the realistic attack on a store that is otherwise hard to touch, and it is the one row where the residual risk is genuine: prevention caps the volume and detection names the exporter, but nothing puts read data back. v 1.0 · owner Data & AI Global Practice · date 2026-09 The Operators Are In Scope Six attempts by six privileged insiders, and what each one actually meets — including the row where the residual risk is real. HTML page SVG draw.io
40 Absorbed — the producer sees nothing Ingest Timeout retry + idempotency key Duplicate Delivery one record, 24 h window Zone Loss isr ≥ 2, transparent Broker Restart producer backoff Degraded — in the declared order, never the reverse Key Service Down ingest on, sealing pauses Index Loss Trino path, SLO suspended Region Loss RTO 15 min / 4 h Sealer Backlog buffer absorbs 72 h Contained and made visible — the gap is itself a record Producer Outage spool 1 h, gap marker Poison Record quarantine, no head-of-line Clock Skew flagged beyond 5 min Seal Gap re-sealed, never discarded Incident — never handled automatically Insider Deletion Attempt prevented, alerted Segment Divergence Sev-1, no auto-repair Acknowledged, Never Sealed Sev-1 defect, RPO 0 Checkpoint Signature Fails key or ledger compromise unless roots differ Named Failure Modes and Their Required Handling Application we own Risk / gap failure / alternate Index divergence is repaired from segments and is routine; segment divergence is repaired by nobody and is an incident. The distinction is the whole architecture in one line: the derived thing may be rebuilt, and the thing it was derived from may not be touched. v 1.0 · owner Data & AI Global Practice · date 2026-09 Named Failure Modes Sixteen failures in four categories, sorted by what the service is permitted to do about each. HTML page SVG draw.io
Open svg/<view>.svg or drawio/<view>.drawio in draw.io Desktop or at app.diagrams.net to edit. The SVG carries the diagram inside it, so it is both the picture and the source. This folder is self-contained — copy it whole and every link still resolves.
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source40 views · HTML / SVG / draw.io