[ { "id": "01-system-context", "title": "Autoscaling Controller — System Context", "layout": "context", "system": { "label": "Autoscaling Controller", "sub": "declare, then converge" }, "colWidth": 250, "canvas": { "width": 1560 }, "groups": [ { "side": "left", "title": "People", "nodes": [ { "id": "svcowner", "label": "Service Owner", "kind": "actor", "rel": "declares target + bounds", "dir": "in" }, { "id": "sre", "label": "SRE On-Call", "kind": "actor", "rel": "pins, pauses, unfreezes", "dir": "in" }, { "id": "finops", "label": "FinOps Analyst", "kind": "actor", "rel": "reads cost of stability", "dir": "out" }, { "id": "platadmin", "label": "Platform Admin", "kind": "actor", "rel": "sets fleet ceilings", "dir": "in" } ] }, { "side": "top", "title": "Signal sources", "nodes": [ { "id": "prom", "label": "Managed Prometheus", "kind": "external", "sub": "utilization, custom", "rel": "remote read", "dir": "in" }, { "id": "azmon", "label": "Azure Monitor", "kind": "external", "sub": "platform metrics", "rel": "metric query", "dir": "in" }, { "id": "sbus", "label": "Service Bus", "kind": "queue", "sub": "backlog, msg age", "rel": "queue depth", "dir": "in" }, { "id": "fcast", "label": "Forecast Feed", "kind": "external", "sub": "calendar, prediction", "rel": "capacity floor", "dir": "in", "kind2": "batch" } ] }, { "side": "right", "title": "Capacity providers", "nodes": [ { "id": "vmss", "label": "VM Scale Sets", "kind": "external", "sub": "stateless fleets", "rel": "set capacity", "dir": "out" }, { "id": "aksnp", "label": "AKS Node Pools", "kind": "external", "sub": "node groups", "rel": "set node count", "dir": "out" }, { "id": "kdeploy", "label": "Workload Replicas", "kind": "external", "sub": "Deployments", "rel": "set replicas", "dir": "out", "icon": "kubernetes" }, { "id": "warm", "label": "Warm Pool Fleet", "kind": "external", "sub": "pre-warmed", "rel": "attach, recycle", "dir": "out" } ] }, { "side": "bottom", "title": "Governance and evidence", "nodes": [ { "id": "entra", "label": "Microsoft Entra ID", "kind": "security", "sub": "workload identity", "rel": "authenticates", "dir": "in" }, { "id": "adx", "label": "Azure Data Explorer", "kind": "store", "sub": "decision journal", "rel": "journals every decision", "dir": "out" }, { "id": "graf", "label": "Grafana + Alertmanager", "kind": "platform", "sub": "alerts, dashboards", "rel": "exports metrics", "dir": "out" } ] } ], "note": "Out of scope: running the workloads, scheduling them, and any customer payload. The controller decides how much capacity a target should have and drives the fleet to that number.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "Autoscaling Controller — High-Level Architecture", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1740 }, "nodeWidth": 210, "stages": [ { "title": "Observe", "nodes": [ { "id": "coll", "label": "Collectors", "kind": "app", "sub": "4 signal classes" }, { "id": "norm", "label": "Normaliser", "kind": "app", "sub": "one common shape" }, { "id": "gate", "label": "Freshness Gate", "kind": "decision", "sub": "90 s · plausible" } ] }, { "title": "Decide", "nodes": [ { "id": "polic", "label": "Policy Evaluator", "kind": "app", "sub": "target, step, sched" }, { "id": "damp", "label": "Damping + Bounds", "kind": "app", "sub": "hysteresis, limits" }, { "id": "lease", "label": "Shard Leader", "kind": "security", "sub": "one per shard" } ] }, { "title": "Declare", "nodes": [ { "id": "dsr", "label": "Desired-State Record", "kind": "store", "sub": "PostgreSQL · RPO 0", "icon": "postgresql" } ] }, { "title": "Converge", "nodes": [ { "id": "recon", "label": "Reconciler", "kind": "app", "sub": "idempotent" }, { "id": "adapt", "label": "Provider Adapters", "kind": "integration", "sub": "breaker, backoff", "icon": "azure_AzureAPIManagement__Web" }, { "id": "drain", "label": "Drain Coordinator", "kind": "app", "sub": "120 s deadline" } ] }, { "title": "Serve", "nodes": [ { "id": "cap", "label": "Managed Capacity", "kind": "external", "sub": "VMSS, pools, pods", "icon": "azure_vm-scale-sets" }, { "id": "verify", "label": "Serving Verifier", "kind": "app", "sub": "healthy + registered" } ] }, { "title": "Explain", "nodes": [ { "id": "jrnl", "label": "Decision Journal", "kind": "store", "sub": "13 months", "icon": "azure_azure-data-explorer-clusters" }, { "id": "cost", "label": "Cost Attribution", "kind": "app", "sub": "per team, per hour" } ] } ], "edges": [ { "from": "verify", "to": "coll", "label": "observed actual", "kind": "async", "route": "gutter" }, { "from": "damp", "to": "jrnl", "label": "every evaluation", "kind": "async", "route": "gutter" } ], "note": "The spine is the control loop. Actual capacity re-enters as a signal, never as an assumption.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "03-control-loop", "title": "The Control Loop — One 15 Second Interval", "layout": "cycle", "canvas": { "width": 1500 }, "rx": 430, "ry": 215, "centre": { "label": "Control Loop", "sub": "15 s · per target" }, "nodes": [ { "id": "c1", "label": "Observe", "kind": "app", "sub": "read signal store" }, { "id": "c2", "label": "Qualify", "kind": "decision", "sub": "fresh, complete, sane" }, { "id": "c3", "label": "Decide", "kind": "app", "sub": "policy + damping" }, { "id": "c4", "label": "Declare", "kind": "store", "sub": "desired capacity" }, { "id": "c5", "label": "Converge", "kind": "app", "sub": "reconcile the delta" }, { "id": "c6", "label": "Verify Serving", "kind": "app", "sub": "healthy + registered" } ], "ringLabels": [ "raw samples", "qualified inputs", "proposed capacity", "one durable number", "provider calls", "observed actual" ], "note": "Six steps, one direction. A step that cannot complete holds the last declaration rather than guessing the next one.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "04-layered-architecture", "title": "Layered Architecture", "layout": "bands", "canvas": { "width": 1680 }, "layerHeaderWidth": 168, "bands": [ { "name": "Configuration and control", "nodes": [ { "id": "l-reg", "label": "Target Registry", "kind": "store", "sub": "versioned" }, { "id": "l-pol", "label": "Policy Catalogue", "kind": "store", "sub": "immutable versions" }, { "id": "l-bnd", "label": "Bounds and Ceilings", "kind": "security", "sub": "outside the policy" }, { "id": "l-ovr", "label": "Overrides", "kind": "security", "sub": "expiry mandatory" } ] }, { "name": "Signal plane", "nodes": [ { "id": "l-col", "label": "Collectors", "kind": "app", "sub": "authenticated sources" }, { "id": "l-nrm", "label": "Normaliser", "kind": "app" }, { "id": "l-der", "label": "Derived Signals", "kind": "app", "sub": "named expressions" }, { "id": "l-gat", "label": "Freshness Gate", "kind": "decision" }, { "id": "l-sig", "label": "Signal Store", "kind": "store", "sub": "Mimir · 13 months" } ] }, { "name": "Decision plane", "nodes": [ { "id": "l-eval", "label": "Policy Evaluation", "kind": "app", "sub": "sharded" }, { "id": "l-comb", "label": "Combination Rule", "kind": "app", "sub": "max out, min in" }, { "id": "l-stab", "label": "Stability Controls", "kind": "app", "sub": "hysteresis, limits" }, { "id": "l-osc", "label": "Oscillation Guard", "kind": "security", "sub": "freeze and alert" } ] }, { "name": "Desired-state record", "nodes": [ { "id": "l-dsr", "label": "Desired Capacity per Target", "kind": "store", "sub": "strongly consistent · the truth" } ] }, { "name": "Actuation plane", "nodes": [ { "id": "l-rec", "label": "Reconciler", "kind": "app", "sub": "no policy logic" }, { "id": "l-adp", "label": "Provider Adapters", "kind": "integration", "icon": "azure_AzureAPIManagement__Web" }, { "id": "l-wpm", "label": "Warm-Pool Manager", "kind": "app" }, { "id": "l-drn", "label": "Drain Coordinator", "kind": "app" }, { "id": "l-hlt", "label": "Registration Check", "kind": "app" } ] }, { "name": "Managed capacity", "nodes": [ { "id": "l-svc", "label": "Service Groups", "kind": "external", "sub": "VMSS", "icon": "azure_vm-scale-sets" }, { "id": "l-wrk", "label": "Worker Pools", "kind": "external", "sub": "queue driven" }, { "id": "l-nod", "label": "Node Groups", "kind": "external", "sub": "AKS" }, { "id": "l-pol2", "label": "Warm Pools", "kind": "external", "sub": "attach in 10 s" } ] }, { "name": "Observability", "nodes": [ { "id": "l-jrn", "label": "Decision Journal", "kind": "store", "sub": "append only", "icon": "azure_azure-data-explorer-clusters" }, { "id": "l-met", "label": "Controller Metrics", "kind": "platform" }, { "id": "l-alr", "label": "Alerts", "kind": "platform" }, { "id": "l-cst", "label": "Cost Reporting", "kind": "app" }, { "id": "l-rep", "label": "Counterfactual Replay", "kind": "app" } ] } ], "note": "A layer may call the layer below it and read the layer above it. Bounds live above the policy that would otherwise compute them.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "05-plane-separation", "title": "Decision Plane and Actuation Plane, Joined by a Record", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1660 }, "nodeWidth": 230, "stages": [ { "title": "Decision plane — reads, never calls", "nodes": [ { "id": "p-read", "label": "Signal Reader", "kind": "app", "sub": "read-only identity" }, { "id": "p-eval", "label": "Policy Evaluation", "kind": "app", "sub": "versioned policy" }, { "id": "p-damp", "label": "Damping and Bounds", "kind": "app", "sub": "the only place" }, { "id": "p-jrn", "label": "Journal Writer", "kind": "app", "sub": "inputs and arithmetic" } ] }, { "title": "The join — a written record", "nodes": [ { "id": "p-dsr", "label": "Desired-State Record", "kind": "store", "sub": "one integer per target", "icon": "postgresql" }, { "id": "p-id", "label": "Decision Id", "kind": "store", "sub": "1 : 1 with actuation" } ] }, { "title": "Actuation plane — calls, never decides", "nodes": [ { "id": "p-rec", "label": "Reconciler", "kind": "app", "sub": "delta from observed" }, { "id": "p-adp", "label": "Provider Adapters", "kind": "integration", "sub": "actuate identity", "icon": "azure_AzureAPIManagement__Web" }, { "id": "p-obs", "label": "Serving Verifier", "kind": "app", "sub": "counts what serves" } ] } ], "edges": [ { "from": "p-eval", "to": "p-adp", "label": "never", "kind": "error", "route": "gutter", "labelAt": -0.55 }, { "from": "p-obs", "to": "p-rec", "label": "actual capacity", "kind": "async" } ], "note": "The red path is the one the architecture forbids. A decision that could call a capacity API would make crash recovery, idempotency and audit all unprovable at once.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "06-container-architecture", "title": "Container Architecture — Deployable Units (C4 L2)", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Azure Region · control plane on AKS", "kind": "cloud", "dir": "row", "children": [ { "title": "Signal services", "kind": "boundary", "nodes": [ { "id": "k-coll", "label": "Collector Set", "kind": "app", "sub": "Go · one per class" }, { "id": "k-norm", "label": "Normaliser", "kind": "app", "sub": "common shape" }, { "id": "k-gate", "label": "Qualification Gate", "kind": "decision", "sub": "fresh + plausible" } ] }, { "title": "Decision services", "kind": "boundary", "nodes": [ { "id": "k-shard", "label": "Shard Manager", "kind": "security", "sub": "lease per shard" }, { "id": "k-eng", "label": "Decision Engine", "kind": "app", "sub": "Go · 15 s tick" }, { "id": "k-jw", "label": "Journal Writer", "kind": "app", "sub": "at-least-once" } ] }, { "title": "Actuation services", "kind": "boundary", "nodes": [ { "id": "k-rec", "label": "Reconciler", "kind": "app", "sub": "idempotent" }, { "id": "k-adp", "label": "Adapter Set", "kind": "integration", "sub": "VMSS, AKS, K8s", "icon": "azure_AzureAPIManagement__Web" }, { "id": "k-wpm", "label": "Warm-Pool Manager", "kind": "app" }, { "id": "k-drn", "label": "Drain Coordinator", "kind": "app", "sub": "lease aware" } ] }, { "title": "Control surface", "kind": "boundary", "nodes": [ { "id": "k-cfg", "label": "Config API", "kind": "integration", "sub": "targets, policies" }, { "id": "k-ovr", "label": "Override API", "kind": "integration", "sub": "expiry enforced" }, { "id": "k-qry", "label": "Explain API", "kind": "integration", "sub": "why this capacity" } ] } ] }, { "title": "Regional state and evidence", "kind": "boundary", "dir": "row", "children": [ { "title": "Authoritative · strongly consistent", "kind": "boundary", "nodes": [ { "id": "k-pg", "label": "PostgreSQL Flexible Server", "kind": "store", "sub": "registry + desired" } ] }, { "title": "Derived · rebuildable or append-only", "kind": "boundary", "nodes": [ { "id": "k-mim", "label": "Grafana Mimir", "kind": "store", "sub": "signal store" }, { "id": "k-eh", "label": "Event Hubs", "kind": "queue", "sub": "journal transport" }, { "id": "k-adx", "label": "Azure Data Explorer", "kind": "store", "sub": "journal query" }, { "id": "k-blob", "label": "Blob · immutable", "kind": "store", "sub": "WORM · 13 months" } ] } ] } ], "outside": [ { "id": "k-entra", "label": "Microsoft Entra ID", "kind": "security", "sub": "workload identity" }, { "id": "k-kv", "label": "Azure Key Vault", "kind": "security", "sub": "no standing creds" }, { "id": "k-arm", "label": "Azure Resource Manager", "kind": "external", "sub": "capacity APIs" } ], "edges": [ { "from": "k-eng", "to": "k-pg", "label": "desired write" }, { "from": "k-rec", "to": "k-pg", "label": "desired read" }, { "from": "k-adp", "to": "k-arm", "label": "scoped identity" }, { "from": "k-jw", "to": "k-eh", "label": "decision record", "kind": "async", "route": "lr" } ], "note": "Every service is stateless. All regional state is in the row below it, and no service reads another region's copy.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "07-signal-plane", "title": "Signal Plane — Acquisition, Qualification, Storage", "layout": "nested", "canvas": { "width": 1800 }, "boxes": [ { "title": "Acquisition — four classes of source, each authenticated", "kind": "boundary", "dir": "row", "children": [ { "title": "Resource utilization · lags", "kind": "boundary", "nodes": [ { "id": "s-cpu", "label": "CPU and Memory", "kind": "app", "sub": "Managed Prometheus" }, { "id": "s-gpu", "label": "Accelerator Use", "kind": "app", "sub": "DCGM exporter" } ] }, { "title": "Work backlog · leads", "kind": "boundary", "nodes": [ { "id": "s-depth", "label": "Queue Depth", "kind": "queue", "sub": "Service Bus" }, { "id": "s-age", "label": "Oldest Message Age", "kind": "queue", "sub": "the better signal" }, { "id": "s-lag", "label": "Consumer Lag", "kind": "queue", "sub": "Event Hubs" } ] }, { "title": "Service level · second order", "kind": "boundary", "nodes": [ { "id": "s-lat", "label": "Latency Percentile", "kind": "app", "sub": "p95, p99" }, { "id": "s-burn", "label": "SLO Burn Rate", "kind": "app", "sub": "slow, noisy" } ] }, { "title": "External declarations", "kind": "boundary", "nodes": [ { "id": "s-sched", "label": "Schedule", "kind": "external", "sub": "floor or ceiling" }, { "id": "s-fc", "label": "Forecast Feed", "kind": "external", "sub": "signed, hourly" } ] } ] }, { "title": "Qualification and storage", "kind": "boundary", "dir": "row", "children": [ { "title": "Normalise", "kind": "boundary", "nodes": [ { "id": "s-norm", "label": "Normaliser", "kind": "app", "sub": "target, unit, window" }, { "id": "s-der", "label": "Derived Signals", "kind": "app", "sub": "versioned expression" } ] }, { "title": "Qualify", "kind": "boundary", "nodes": [ { "id": "s-fresh", "label": "Freshness Check", "kind": "decision", "sub": "reject over 90 s" }, { "id": "s-plaus", "label": "Plausibility Clamp", "kind": "decision", "sub": "declared range" }, { "id": "s-quar", "label": "Quarantine", "kind": "risk", "sub": "hold capacity" } ] }, { "title": "Store", "kind": "boundary", "nodes": [ { "id": "s-mim", "label": "Mimir", "kind": "store", "sub": "10 s · 15 days" }, { "id": "s-roll", "label": "Rollup", "kind": "store", "sub": "5 min · 13 months" }, { "id": "s-lkg", "label": "Last-Known-Good", "kind": "store", "sub": "3 intervals" } ] } ] } ], "edges": [ { "from": "s-age", "to": "s-norm", "label": "preferred" }, { "from": "s-cpu", "to": "s-norm" }, { "from": "s-fresh", "to": "s-quar", "label": "stale", "kind": "error" }, { "from": "s-norm", "to": "s-fresh" }, { "from": "s-plaus", "to": "s-mim", "label": "qualified" } ], "note": "Freshness and completeness travel with the value as first-class attributes. A policy binds to a named authenticated source, so source identity is part of the signal definition.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "08-decision-plane", "title": "Decision Plane — Sharded, Leader per Shard", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Sharding — decision throughput scales with target count", "kind": "boundary", "dir": "row", "children": [ { "title": "Shard 0 · leader", "kind": "boundary", "nodes": [ { "id": "d-s0", "label": "Decision Engine", "kind": "app", "sub": "holds valid lease" } ] }, { "title": "Shard 1 · leader", "kind": "boundary", "nodes": [ { "id": "d-s1", "label": "Decision Engine", "kind": "app", "sub": "holds valid lease" } ] }, { "title": "Shard 2 · standby", "kind": "boundary", "nodes": [ { "id": "d-s2", "label": "Decision Engine", "kind": "risk", "sub": "no lease, no write" } ] }, { "title": "Lease authority", "kind": "boundary", "nodes": [ { "id": "d-lease", "label": "Lease Store", "kind": "security", "sub": "K8s Lease · 10 s" } ] } ] }, { "title": "What one shard does in one interval", "kind": "boundary", "dir": "row", "children": [ { "title": "Inputs", "kind": "boundary", "nodes": [ { "id": "d-sig", "label": "Qualified Signals", "kind": "store", "sub": "with freshness" }, { "id": "d-pv", "label": "Policy Version", "kind": "store", "sub": "immutable" }, { "id": "d-bnd", "label": "Bounds and Overrides", "kind": "security" } ] }, { "title": "Propose", "kind": "boundary", "nodes": [ { "id": "d-tt", "label": "Target Tracking", "kind": "app", "sub": "hold a setpoint" }, { "id": "d-step", "label": "Step / Threshold", "kind": "app", "sub": "capacity per band" }, { "id": "d-sch", "label": "Scheduled Floor", "kind": "app", "sub": "time window" }, { "id": "d-fc", "label": "Forecast Floor", "kind": "app", "sub": "may not undercut" } ] }, { "title": "Constrain", "kind": "boundary", "nodes": [ { "id": "d-comb", "label": "Combination Rule", "kind": "app", "sub": "max out · min in" }, { "id": "d-hys", "label": "Hysteresis + Sustain", "kind": "app", "sub": "15% · 2 / 6" }, { "id": "d-rate", "label": "Rate Limiter", "kind": "app", "sub": "+100% / -10% / 60 s" }, { "id": "d-hard", "label": "Hard Bounds", "kind": "security", "sub": "min, max, ceiling" } ] }, { "title": "Emit", "kind": "boundary", "nodes": [ { "id": "d-out", "label": "Desired Capacity", "kind": "store", "sub": "durable write", "icon": "postgresql" }, { "id": "d-rec2", "label": "Journal Record", "kind": "store", "sub": "acted on or not" } ] } ] } ], "edges": [ { "from": "d-lease", "to": "d-s2", "label": "lease denied", "kind": "error" }, { "from": "d-comb", "to": "d-hard", "label": "clamped last" }, { "from": "d-hard", "to": "d-out" } ], "note": "Bounds are applied after every policy has spoken, by a component no policy can reach. A policy cannot breach a limit it also computes.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "09-actuation-plane", "title": "Actuation Plane — Converge Actual Towards Desired", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Reconcile loop — holds no policy and no opinion about demand", "kind": "boundary", "dir": "row", "children": [ { "title": "Read", "kind": "boundary", "nodes": [ { "id": "a-des", "label": "Desired Capacity", "kind": "store", "sub": "the declaration", "icon": "postgresql" }, { "id": "a-act", "label": "Observed Actual", "kind": "store", "sub": "what is serving" } ] }, { "title": "Derive", "kind": "boundary", "nodes": [ { "id": "a-delta", "label": "Delta", "kind": "decision", "sub": "re-derived each run" }, { "id": "a-safe", "label": "Safety Bound Check", "kind": "security", "sub": "refuse and journal" } ] }, { "title": "Apply", "kind": "boundary", "nodes": [ { "id": "a-vmss", "label": "VMSS Adapter", "kind": "integration" }, { "id": "a-aks", "label": "Node Pool Adapter", "kind": "integration" }, { "id": "a-k8s", "label": "Replica Adapter", "kind": "integration" }, { "id": "a-warm", "label": "Warm-Pool Attach", "kind": "app", "sub": "under 10 s" } ] }, { "title": "Confirm", "kind": "boundary", "nodes": [ { "id": "a-health", "label": "Health Check", "kind": "app" }, { "id": "a-reg", "label": "LB Registration", "kind": "app", "sub": "then it counts" }, { "id": "a-drain", "label": "Drain Coordinator", "kind": "app", "sub": "120 s deadline" } ] } ] }, { "title": "Provider protection — every capacity API is rate-limited and failure-prone", "kind": "boundary", "dir": "row", "children": [ { "title": "Throttling", "kind": "boundary", "nodes": [ { "id": "a-conc", "label": "Concurrency Cap", "kind": "security", "sub": "per provider" }, { "id": "a-boff", "label": "Backoff + Jitter", "kind": "app", "sub": "exponential" }, { "id": "a-brk", "label": "Circuit Breaker", "kind": "security", "sub": "5 failures" } ] }, { "title": "Scarcity", "kind": "boundary", "nodes": [ { "id": "a-zone", "label": "Zone Fallback", "kind": "app", "sub": "ordered list" }, { "id": "a-shape", "label": "Shape Fallback", "kind": "app", "sub": "declared shapes" }, { "id": "a-unmet", "label": "Unmet Demand", "kind": "risk", "sub": "a signal, not a retry" } ] } ] } ], "edges": [ { "from": "a-delta", "to": "a-safe" }, { "from": "a-reg", "to": "a-act", "label": "counted as serving" }, { "from": "a-brk", "to": "a-unmet", "label": "open", "kind": "error" } ], "note": "Actual capacity is observed, never assumed from intent. Repeating a run for unchanged desired capacity changes nothing.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "10-integration-surface", "title": "Integration Surface — Every Interface In and Out", "layout": "hub", "canvas": { "width": 1620 }, "left": { "title": "Inbound — read only", "nodes": [ { "id": "i-prom", "label": "Managed Prometheus", "kind": "external", "sub": "PromQL", "rel": "10 s pull" }, { "id": "i-mon", "label": "Azure Monitor", "kind": "external", "sub": "REST", "rel": "60 s pull" }, { "id": "i-sb", "label": "Service Bus Mgmt", "kind": "queue", "rel": "backlog, age" }, { "id": "i-git", "label": "Git · policy repo", "kind": "external", "sub": "GitOps", "rel": "versions", "kind2": "batch" }, { "id": "i-fc", "label": "Forecast Feed", "kind": "external", "rel": "signed hourly", "kind2": "batch" } ] }, "centre": { "title": "Regional control plane", "nodes": [ { "id": "i-ctl", "label": "Autoscaling Controller", "kind": "app", "sub": "one per region" } ] }, "right": { "title": "Outbound — scoped identities", "nodes": [ { "id": "i-vmss", "label": "VMSS API", "kind": "external", "rel": "set capacity", "dir": "out" }, { "id": "i-aks", "label": "AKS Node Pool API", "kind": "external", "rel": "set count", "dir": "out" }, { "id": "i-k8s", "label": "Kubernetes API", "kind": "external", "rel": "set replicas", "dir": "out" }, { "id": "i-eh", "label": "Event Hubs", "kind": "queue", "rel": "journal", "dir": "out", "kind2": "async" }, { "id": "i-am", "label": "Alertmanager", "kind": "platform", "rel": "alerts", "dir": "out", "kind2": "async" } ] }, "note": "Five inbound interfaces, five outbound. Nothing inbound can change capacity, and nothing outbound can change a policy.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "11-authority-and-arbitration", "title": "Authority — Four Things Want to Scale One Fleet", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1700 }, "nodeWidth": 220, "stages": [ { "title": "Claimants", "nodes": [ { "id": "u-work", "label": "Workload Policy", "kind": "app", "sub": "target tracking" }, { "id": "u-sched", "label": "Scheduled Policy", "kind": "app", "sub": "floor or ceiling" }, { "id": "u-fc", "label": "Forecast Floor", "kind": "app", "sub": "may not undercut" }, { "id": "u-op", "label": "Operator Override", "kind": "actor", "sub": "expires in 4 h" } ] }, { "title": "Single admission point", "nodes": [ { "id": "u-prec", "label": "Precedence Rules", "kind": "decision", "sub": "per target" }, { "id": "u-comb", "label": "Combination Rule", "kind": "app", "sub": "max out · min in" }, { "id": "u-bnd", "label": "Hard Bounds", "kind": "security", "sub": "no claimant exceeds" } ] }, { "title": "Declared", "nodes": [ { "id": "u-dsr", "label": "Desired Capacity", "kind": "store", "sub": "the workload layer", "icon": "postgresql" } ] }, { "title": "Derived", "nodes": [ { "id": "u-node", "label": "Node Layer Follows", "kind": "app", "sub": "purely derivative" }, { "id": "u-unmet", "label": "Unmet Demand", "kind": "risk", "sub": "when it cannot" } ] } ], "edges": [ { "from": "u-node", "to": "u-unmet", "label": "cannot supply", "kind": "error" }, { "from": "u-unmet", "to": "u-prec", "label": "back as a signal", "kind": "async", "route": "gutter" } ], "note": "Authority is strictly layered and arbitrated in one place. The infrastructure layer is derivative of the workload layer, and says so out loud when it cannot supply what was declared.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "12-data-architecture", "title": "Data Architecture — Four Stores, Four Durability Contracts", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Who touches the authoritative stores", "kind": "boundary", "dir": "row", "children": [ { "title": "Decision plane", "kind": "boundary", "nodes": [ { "id": "t-eng", "label": "Decision Engine", "kind": "app", "sub": "writes desired" } ] }, { "title": "Actuation plane", "kind": "boundary", "nodes": [ { "id": "t-rec", "label": "Reconciler", "kind": "app", "sub": "reads desired only" } ] } ] }, { "title": "Authoritative — losing this loses control", "kind": "boundary", "dir": "row", "children": [ { "title": "Target and policy registry", "kind": "boundary", "nodes": [ { "id": "t-reg", "label": "PostgreSQL", "kind": "store", "sub": "transactional" }, { "id": "t-ver", "label": "Version History", "kind": "store", "sub": "kept in full" } ] }, { "title": "Desired-state record", "kind": "boundary", "nodes": [ { "id": "t-dsr", "label": "Desired Capacity", "kind": "store", "sub": "RPO 0 · sync HA", "icon": "postgresql" }, { "id": "t-trn", "label": "Transitions", "kind": "store", "sub": "30 days" } ] } ] }, { "title": "Derived — losing this loses history, not control", "kind": "boundary", "dir": "row", "children": [ { "title": "Signal store", "kind": "boundary", "nodes": [ { "id": "t-raw", "label": "Raw Series", "kind": "store", "sub": "10 s · 15 days" }, { "id": "t-roll", "label": "Rollup", "kind": "store", "sub": "5 min · 13 months" }, { "id": "t-obj", "label": "Blob Backend", "kind": "store", "sub": "Mimir blocks" } ] }, { "title": "Decision journal", "kind": "boundary", "nodes": [ { "id": "t-eh", "label": "Event Hubs", "kind": "queue", "sub": "transport · RPO 60 s" }, { "id": "t-adx", "label": "Azure Data Explorer", "kind": "store", "sub": "query · 13 months" }, { "id": "t-worm", "label": "Blob WORM", "kind": "store", "sub": "immutable copy" } ] }, { "title": "Audit log", "kind": "boundary", "nodes": [ { "id": "t-aud", "label": "Config Change Log", "kind": "security", "sub": "tamper evident" } ] } ] } ], "edges": [ { "from": "t-eng", "to": "t-dsr", "label": "the only writer" }, { "from": "t-rec", "to": "t-dsr", "label": "resume after crash", "route": "auto" }, { "from": "t-eh", "to": "t-adx", "label": "ingest" }, { "from": "t-eh", "to": "t-worm", "label": "immutable copy", "kind": "async" } ], "note": "A controller restart re-derives nothing. It reads the desired-state record and resumes reconciling towards the number already there.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "13-target-and-policy-model", "title": "Target, Policy and Bound — Data Model", "layout": "er", "canvas": { "width": 1560, "cols": 3 }, "rowGap": 230, "entities": [ { "id": "e-policy", "name": "policy_version", "kind": "store", "row": 0, "col": 0, "attrs": [ "policy_version_id PK", "target_id FK", "form", "setpoint", "dead_band_pct", "sustain_out / sustain_in", "immutable_at" ] }, { "id": "e-fleet", "name": "fleet", "kind": "store", "row": 0, "col": 1, "attrs": [ "fleet_id PK", "region", "capacity_ceiling", "spend_ceiling_month", "default_degraded_mode" ] }, { "id": "e-signal", "name": "signal_definition", "kind": "store", "row": 0, "col": 2, "attrs": [ "signal_id PK", "target_id FK", "source_identity", "expression", "lead_or_lag", "plausible_min / max", "staleness_horizon" ] }, { "id": "e-bound", "name": "safety_bound", "kind": "security", "row": 1, "col": 0, "attrs": [ "bound_id PK", "target_id FK", "kind", "value", "second_approver", "effective_from" ] }, { "id": "e-target", "name": "scaling_target", "kind": "store", "row": 1, "col": 1, "attrs": [ "target_id PK", "fleet_id FK", "provider_kind", "min_capacity", "max_capacity", "control_interval_s", "drain_deadline_s", "scale_to_zero_ok" ] }, { "id": "e-pool", "name": "warm_pool", "kind": "store", "row": 1, "col": 2, "attrs": [ "pool_id PK", "target_id FK NULL", "topology", "size_cap_pct", "max_member_age", "shape" ] }, { "id": "e-override", "name": "override", "kind": "security", "row": 2, "col": 0, "attrs": [ "override_id PK", "target_id FK", "kind", "pinned_capacity", "expires_at NOT NULL", "actor", "justification" ] }, { "id": "e-desired", "name": "desired_state", "kind": "store", "row": 2, "col": 1, "attrs": [ "target_id PK", "desired_capacity", "decided_at", "decision_id FK", "dry_run" ] } ], "relations": [ { "from": "e-fleet", "to": "e-target", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "e-target", "to": "e-policy", "label": "1 : N", "from_side": "n1", "to_side": "s" }, { "from": "e-target", "to": "e-signal", "label": "1 : N", "from_side": "n3", "to_side": "s" }, { "from": "e-target", "to": "e-bound", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "e-target", "to": "e-pool", "label": "1 : N", "kind": "optional", "from_side": "e", "to_side": "w" }, { "from": "e-target", "to": "e-override", "label": "1 : N", "from_side": "s1", "to_side": "n" }, { "from": "e-target", "to": "e-desired", "label": "1 : 1", "from_side": "s", "to_side": "n" } ], "note": "A policy version is immutable once written, so a journalled decision can always be re-read against the exact policy that produced it.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "14-decision-journal-model", "title": "Decision Journal — What Makes a Decision Explainable", "layout": "er", "canvas": { "width": 1660, "cols": 3 }, "rowGap": 250, "entities": [ { "id": "j-dec", "name": "decision", "kind": "store", "row": 0, "col": 1, "attrs": [ "decision_id PK", "target_id", "interval_start", "policy_version_id", "proposed_capacity", "final_desired_capacity", "outcome" ] }, { "id": "j-input", "name": "decision_input", "kind": "store", "row": 0, "col": 0, "attrs": [ "input_id PK", "decision_id FK", "signal_id", "value", "unit", "freshness_ms", "sample_count", "was_last_known_good" ] }, { "id": "j-adj", "name": "adjustment", "kind": "store", "row": 0, "col": 2, "attrs": [ "adjustment_id PK", "decision_id FK", "kind", "before", "after", "reason" ] }, { "id": "j-act", "name": "actuation", "kind": "store", "row": 1, "col": 1, "attrs": [ "actuation_id PK", "decision_id FK UNIQUE", "provider", "requested_delta", "applied_delta", "result", "zone_or_shape_used" ] }, { "id": "j-obs", "name": "observed_capacity", "kind": "store", "row": 1, "col": 0, "attrs": [ "observation_id PK", "target_id", "observed_at", "instances_serving", "instances_provisioning", "instances_draining" ] }, { "id": "j-audit", "name": "audit_event", "kind": "security", "row": 1, "col": 2, "attrs": [ "audit_id PK", "actor", "target_id", "field", "before / after", "justification", "signed_at" ] } ], "relations": [ { "from": "j-dec", "to": "j-input", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "j-dec", "to": "j-adj", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "j-dec", "to": "j-act", "label": "1 : 1", "from_side": "s", "to_side": "n" }, { "from": "j-obs", "to": "j-act", "label": "informs", "kind": "optional", "from_side": "e", "to_side": "w" }, { "from": "j-audit", "to": "j-dec", "label": "context", "kind": "optional", "from_side": "n", "to_side": "s3" } ], "note": "Every adjustment — clamp, suppression, rate limit, dead band — is a row with a reason. \"Why did this target have this much capacity?\" is answered from these tables alone.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "15-signal-lifecycle", "title": "Signal Lifecycle — Sample to Decision Input", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1740 }, "nodeWidth": 205, "stages": [ { "title": "Emit", "nodes": [ { "id": "g-src", "label": "Authenticated Source", "kind": "external", "sub": "named in the policy" }, { "id": "g-ts", "label": "Stamped at Source", "kind": "app", "sub": "not at ingest" } ] }, { "title": "Normalise", "nodes": [ { "id": "g-shape", "label": "Common Shape", "kind": "app", "sub": "target, dim, unit" }, { "id": "g-win", "label": "Window and Count", "kind": "app", "sub": "completeness" }, { "id": "g-derv", "label": "Derived Expression", "kind": "app", "sub": "named, versioned" } ] }, { "title": "Qualify", "nodes": [ { "id": "g-age", "label": "Age Check", "kind": "decision", "sub": "over 90 s: reject" }, { "id": "g-range", "label": "Range Check", "kind": "decision", "sub": "clamp, then flag" }, { "id": "g-skew", "label": "Clock Skew Check", "kind": "decision", "sub": "alert if persistent" } ] }, { "title": "Serve", "nodes": [ { "id": "g-store", "label": "Signal Store", "kind": "store", "sub": "Mimir" }, { "id": "g-lkg", "label": "Last-Known-Good", "kind": "store", "sub": "3 intervals only" } ] }, { "title": "Consume", "nodes": [ { "id": "g-in", "label": "Decision Input", "kind": "app", "sub": "value + freshness" }, { "id": "g-stale", "label": "Marked Stale", "kind": "risk", "sub": "policy degrades" } ] } ], "edges": [ { "from": "g-age", "to": "g-stale", "label": "rejected", "kind": "error", "route": "gutter" }, { "from": "g-lkg", "to": "g-stale", "label": "horizon passed", "kind": "error" }, { "from": "g-range", "to": "g-stale", "label": "quarantined", "kind": "error", "route": "gutter", "labelAt": 0.4 } ], "note": "Rejection is recorded, never silent. A signal that has aged past three control intervals stops being an input and becomes a degradation trigger.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "16-durability-and-retention", "title": "Durability and Retention by Store", "layout": "grid", "canvas": { "width": 1760 }, "laneHeaderWidth": 180, "columns": [ "Consistency", "Replication and RPO", "Recovery", "Retention" ], "lanes": [ { "title": "Target and policy registry", "cells": [ [ { "label": "Strongly consistent", "kind": "store", "sub": "transactional" } ], [ { "label": "Zone-redundant sync", "kind": "store", "sub": "RPO 0" } ], [ { "label": "RTO under 60 s", "kind": "app" } ], [ { "label": "Current + full history", "kind": "store" } ] ] }, { "title": "Desired-state record", "cells": [ [ { "label": "Strongly consistent", "kind": "store", "sub": "the truth" } ], [ { "label": "Synchronous replica", "kind": "store", "sub": "RPO 0" } ], [ { "label": "RTO under 60 s", "kind": "app", "sub": "read SLO 99.95%" } ], [ { "label": "Current + 30 days", "kind": "store", "sub": "transitions" } ] ] }, { "title": "Signal store", "cells": [ [ { "label": "Eventually consistent", "kind": "store", "sub": "loss tolerant" } ], [ { "label": "Replicated blocks", "kind": "store", "sub": "RPO 5 min" } ], [ { "label": "Rebuildable", "kind": "app", "sub": "control unaffected" } ], [ { "label": "15 d raw · 13 mo rollup", "kind": "store" } ] ] }, { "title": "Decision journal", "cells": [ [ { "label": "Append only", "kind": "store", "sub": "immutable" } ], [ { "label": "Buffered transport", "kind": "queue", "sub": "RPO 60 s" } ], [ { "label": "RTO 15 min", "kind": "app", "sub": "not on control path" } ], [ { "label": "13 months", "kind": "store", "sub": "WORM copy" } ] ] }, { "title": "Audit log", "cells": [ [ { "label": "Append only", "kind": "security", "sub": "tamper evident" } ], [ { "label": "Signed batches", "kind": "security", "sub": "RPO 60 s" } ], [ { "label": "RTO 15 min", "kind": "app" } ], [ { "label": "13 months", "kind": "security" } ] ] } ], "note": "The two authoritative stores carry RPO 0 because losing them loses control. The two derived stores are allowed to lose minutes because losing them only loses explanation.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "17-regional-partitioning", "title": "Regional Partitioning — No Cross-Region Read on the Control Path", "layout": "nested", "canvas": { "width": 1740 }, "boxes": [ { "title": "Azure · Sweden Central", "kind": "cloud", "dir": "row", "children": [ { "title": "Control path — entirely local", "kind": "boundary", "nodes": [ { "id": "r1-eng", "label": "Decision Engine", "kind": "app" }, { "id": "r1-dsr", "label": "Desired State", "kind": "store", "sub": "local writer", "icon": "postgresql" }, { "id": "r1-rec", "label": "Reconciler", "kind": "app" } ] }, { "title": "Local evidence", "kind": "boundary", "nodes": [ { "id": "r1-sig", "label": "Signal Store", "kind": "store" }, { "id": "r1-jrn", "label": "Journal", "kind": "store", "icon": "azure_azure-data-explorer-clusters" } ] } ] }, { "title": "Azure · West Europe", "kind": "cloud", "dir": "row", "children": [ { "title": "Control path — entirely local", "kind": "boundary", "nodes": [ { "id": "r2-eng", "label": "Decision Engine", "kind": "app" }, { "id": "r2-dsr", "label": "Desired State", "kind": "store", "sub": "local writer", "icon": "postgresql" }, { "id": "r2-rec", "label": "Reconciler", "kind": "app" } ] }, { "title": "Local evidence", "kind": "boundary", "nodes": [ { "id": "r2-sig", "label": "Signal Store", "kind": "store" }, { "id": "r2-jrn", "label": "Journal", "kind": "store", "icon": "azure_azure-data-explorer-clusters" } ] } ] }, { "title": "Shared, and deliberately off the control path", "kind": "boundary", "dir": "row", "children": [ { "title": "Declared intent", "kind": "boundary", "nodes": [ { "id": "sh-git", "label": "Policy Repository", "kind": "external", "sub": "Git · source of truth" } ] }, { "title": "Reporting only", "kind": "boundary", "nodes": [ { "id": "sh-cost", "label": "Cross-Region Cost View", "kind": "app", "sub": "read of journals" }, { "id": "sh-fleet", "label": "Fleet Rollup", "kind": "app", "sub": "eventually consistent" } ] } ] } ], "edges": [ { "from": "sh-git", "to": "r1-eng", "label": "policy versions", "kind": "batch" }, { "from": "sh-git", "to": "r2-eng", "label": "policy versions", "kind": "batch" }, { "from": "r1-jrn", "to": "sh-cost", "label": "async export", "kind": "async" }, { "from": "r2-jrn", "to": "sh-cost", "label": "async export", "kind": "async", "route": "tb" } ], "note": "Adding a region means deploying an independent control plane. The only shared state is the replicated registry, and it is never read inside a control interval.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "18-control-interval-sequence", "title": "One Control Interval, End to End", "layout": "sequence", "canvas": { "width": 1700 }, "lifelines": [ { "id": "q-tick", "label": "Interval Tick", "kind": "platform" }, { "id": "q-sig", "label": "Signal Store", "kind": "store" }, { "id": "q-eng", "label": "Decision Engine", "kind": "app" }, { "id": "q-dsr", "label": "Desired State", "kind": "store", "icon": "postgresql" }, { "id": "q-jrn", "label": "Journal", "kind": "store", "icon": "azure_azure-data-explorer-clusters" }, { "id": "q-rec", "label": "Reconciler", "kind": "app" }, { "id": "q-prov", "label": "Capacity Provider", "kind": "external" } ], "messages": [ { "from": "q-tick", "to": "q-eng", "label": "t0 · shard tick", "kind": "call" }, { "from": "q-eng", "to": "q-eng", "label": "lease still valid?", "kind": "self" }, { "from": "q-eng", "to": "q-sig", "label": "read signals for target", "kind": "call" }, { "from": "q-sig", "to": "q-eng", "label": "values + freshness", "kind": "return" }, { "from": "q-eng", "to": "q-eng", "label": "evaluate every policy", "kind": "self" }, { "from": "q-eng", "to": "q-eng", "label": "combine, damp, clamp", "kind": "self" }, { "from": "q-eng", "to": "q-dsr", "label": "write desired capacity", "kind": "call" }, { "from": "q-dsr", "to": "q-eng", "label": "committed · p99 2 s", "kind": "return" }, { "from": "q-eng", "to": "q-jrn", "label": "decision + all inputs", "kind": "async" }, { "from": "q-rec", "to": "q-dsr", "label": "read desired", "kind": "call" }, { "from": "q-rec", "to": "q-prov", "label": "observe actual", "kind": "call" }, { "from": "q-prov", "to": "q-rec", "label": "instances serving", "kind": "return" }, { "from": "q-rec", "to": "q-prov", "label": "apply delta · p99 3 s", "kind": "call" }, { "from": "q-rec", "to": "q-jrn", "label": "actuation outcome", "kind": "async" } ], "note": "The engine never calls the provider and the reconciler never reads a signal. The two halves meet only at the desired-state record.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "19-signal-hierarchy", "title": "Which Signal Drives the Loop — A Declared Hierarchy", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1720 }, "nodeWidth": 215, "stages": [ { "title": "Preferred — leads demand", "nodes": [ { "id": "h-age", "label": "Oldest Message Age", "kind": "queue", "sub": "rank 1 · queued work" }, { "id": "h-conc", "label": "Concurrency", "kind": "app", "sub": "arrival x service" } ] }, { "title": "Fallback — lags demand", "nodes": [ { "id": "h-cpu", "label": "Utilization", "kind": "app", "sub": "rank 2 · always there" }, { "id": "h-burn", "label": "SLO Burn Rate", "kind": "app", "sub": "rank 3 · slow, noisy" } ] }, { "title": "Resolve within the interval", "nodes": [ { "id": "h-fresh", "label": "Fresh Signals Only", "kind": "decision", "sub": "stale ones drop out" }, { "id": "h-rank", "label": "Highest Rank Wins", "kind": "decision", "sub": "for the setpoint" }, { "id": "h-vote", "label": "Lower Ranks Vote", "kind": "app", "sub": "scale-in must agree" } ] }, { "title": "Result", "nodes": [ { "id": "h-out", "label": "One Proposed Capacity", "kind": "app", "sub": "with its driver named" }, { "id": "h-why", "label": "Driving Signal Recorded", "kind": "store", "sub": "in the journal" } ] } ], "edges": [ { "from": "h-age", "to": "h-fresh", "label": "if fresh" }, { "from": "h-cpu", "to": "h-fresh", "label": "if rank 1 stale" }, { "from": "h-vote", "to": "h-out", "label": "no lone scale-in" } ], "note": "Conflict inside one interval is resolved by rank on scale-out and by unanimity on scale-in. Being late to add capacity costs latency; being wrong to remove it costs availability.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "20-policy-combination", "title": "Policy Evaluation and Combination", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1700 }, "nodeWidth": 210, "stages": [ { "title": "Active policies", "nodes": [ { "id": "y-tt", "label": "Target Tracking", "kind": "app", "sub": "hold a setpoint" }, { "id": "y-step", "label": "Step / Threshold", "kind": "app", "sub": "steps per band" }, { "id": "y-sch", "label": "Scheduled", "kind": "app", "sub": "floor or ceiling" }, { "id": "y-fc", "label": "Forecast Floor", "kind": "app", "sub": "independent floor" } ] }, { "title": "Each proposes", "nodes": [ { "id": "y-prop", "label": "Proposed Capacity", "kind": "app", "sub": "integer per policy" }, { "id": "y-arith", "label": "Arithmetic Recorded", "kind": "store", "sub": "shown, not implied" } ] }, { "title": "Combine", "nodes": [ { "id": "y-out", "label": "Scale-Out: Maximum", "kind": "decision", "sub": "one may raise" }, { "id": "y-in", "label": "Scale-In: Minimum Agreed", "kind": "decision", "sub": "none may lower alone" } ] }, { "title": "Clamp", "nodes": [ { "id": "y-minmax", "label": "Target [min, max]", "kind": "security" }, { "id": "y-fleet", "label": "Fleet Ceiling", "kind": "security", "sub": "serve, do not grow" }, { "id": "y-spend", "label": "Spend Ceiling", "kind": "security", "sub": "per region" } ] }, { "title": "Declare", "nodes": [ { "id": "y-dsr", "label": "Desired Capacity", "kind": "store", "icon": "postgresql" }, { "id": "y-dry", "label": "Dry-Run Target", "kind": "risk", "sub": "journalled, not applied" } ] } ], "edges": [ { "from": "y-fc", "to": "y-out", "label": "raises only", "route": "gutter" }, { "from": "y-fleet", "to": "y-dry", "label": "reached: hold", "kind": "error" } ], "note": "A forecast enters as a floor, never as a bias on the reactive loop. A wrong forecast then costs money, not an outage.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "21-stability-controls", "title": "Stability — What Stops the Loop Fighting Itself", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1740 }, "nodeWidth": 210, "stages": [ { "title": "Dead band", "nodes": [ { "id": "z-hys", "label": "Hysteresis", "kind": "app", "sub": "15% of setpoint" }, { "id": "z-noise", "label": "Noise Below Band", "kind": "app", "sub": "no change at all" } ] }, { "title": "Persistence", "nodes": [ { "id": "z-out", "label": "Sustain Out", "kind": "app", "sub": "2 intervals", "icon": false }, { "id": "z-in", "label": "Sustain In", "kind": "app", "sub": "6 intervals", "icon": false } ] }, { "title": "Rate limit", "nodes": [ { "id": "z-grow", "label": "Growth Cap", "kind": "app", "sub": "+100% / 60 s" }, { "id": "z-shrink", "label": "Reduction Cap", "kind": "security", "sub": "-10% / 60 s" } ] }, { "title": "Cooldown", "nodes": [ { "id": "z-cool", "label": "Scale-In Suppressed", "kind": "decision", "sub": "while still arriving" }, { "id": "z-pend", "label": "Pending Capacity", "kind": "app", "sub": "not yet serving" } ] }, { "title": "Guard", "nodes": [ { "id": "z-osc", "label": "Oscillation Detector", "kind": "security", "sub": "3 reversals / 15 min" }, { "id": "z-frz", "label": "Freeze and Alert", "kind": "risk", "sub": "names the signal" } ] }, { "title": "Record", "nodes": [ { "id": "z-sup", "label": "Suppressed Decision", "kind": "store", "sub": "a distinct outcome" } ] } ], "edges": [ { "from": "z-pend", "to": "z-cool", "label": "still becoming serving" }, { "from": "z-osc", "to": "z-frz", "label": "reversal 3" }, { "from": "z-noise", "to": "z-sup", "label": "no change", "kind": "async", "route": "gutter" }, { "from": "z-cool", "to": "z-sup", "label": "suppressed", "kind": "async", "route": "gutter", "labelAt": 0.35 } ], "note": "Scale-out and scale-in are deliberately asymmetric. Every suppression is journalled as its own outcome, so \"nothing happened\" is a fact with a reason rather than an absence.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "22-scale-out-sequence", "title": "Scale-Out — Sustained Breach to Serving Capacity", "layout": "sequence", "canvas": { "width": 1720 }, "lifelines": [ { "id": "w-q", "label": "Work Queue", "kind": "queue" }, { "id": "w-eng", "label": "Decision Engine", "kind": "app" }, { "id": "w-dsr", "label": "Desired State", "kind": "store", "icon": "postgresql" }, { "id": "w-rec", "label": "Reconciler", "kind": "app" }, { "id": "w-pool", "label": "Warm Pool", "kind": "store" }, { "id": "w-prov", "label": "VMSS", "kind": "external", "icon": "azure_vm-scale-sets" }, { "id": "w-lb", "label": "Load Balancer", "kind": "integration" } ], "messages": [ { "from": "w-q", "to": "w-eng", "label": "backlog age rising", "kind": "async" }, { "from": "w-eng", "to": "w-eng", "label": "interval 1: breach, hold", "kind": "self" }, { "from": "w-eng", "to": "w-eng", "label": "interval 2: sustained", "kind": "self" }, { "from": "w-eng", "to": "w-dsr", "label": "desired 40 -> 72", "kind": "call" }, { "from": "w-rec", "to": "w-dsr", "label": "read desired 72", "kind": "call" }, { "from": "w-rec", "to": "w-pool", "label": "claim 8 warm members", "kind": "call" }, { "from": "w-pool", "to": "w-lb", "label": "attach · under 10 s", "kind": "call" }, { "from": "w-rec", "to": "w-prov", "label": "provision 24 cold", "kind": "call" }, { "from": "w-prov", "to": "w-lb", "label": "boot, warm, health", "kind": "async" }, { "from": "w-lb", "to": "w-rec", "label": "registered: counts now", "kind": "return" }, { "from": "w-eng", "to": "w-eng", "label": "scale-in suppressed", "kind": "self" } ], "note": "p95 to serving capacity: 60 s for the warm-pool-backed share, 240 s for the cold share. The warm pool exists to cover the first of those windows, not the second.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "23-scale-in-sequence", "title": "Scale-In — A Request the Workload May Refuse", "layout": "sequence", "canvas": { "width": 1720 }, "lifelines": [ { "id": "x-eng", "label": "Decision Engine", "kind": "app" }, { "id": "x-dsr", "label": "Desired State", "kind": "store", "icon": "postgresql" }, { "id": "x-rec", "label": "Reconciler", "kind": "app" }, { "id": "x-drn", "label": "Drain Coordinator", "kind": "app" }, { "id": "x-inst", "label": "Instance", "kind": "external" }, { "id": "x-lb", "label": "Load Balancer", "kind": "integration" }, { "id": "x-jrn", "label": "Journal", "kind": "store", "icon": "azure_azure-data-explorer-clusters" } ], "messages": [ { "from": "x-eng", "to": "x-eng", "label": "6 intervals under band", "kind": "self" }, { "from": "x-eng", "to": "x-dsr", "label": "desired 72 -> 66", "kind": "call" }, { "from": "x-rec", "to": "x-rec", "label": "delta capped at -10%", "kind": "self" }, { "from": "x-rec", "to": "x-drn", "label": "select 6 by lease state", "kind": "call" }, { "from": "x-drn", "to": "x-inst", "label": "may I stop?", "kind": "call" }, { "from": "x-inst", "to": "x-drn", "label": "lease held: refuse", "kind": "error" }, { "from": "x-drn", "to": "x-lb", "label": "deregister the rest", "kind": "call" }, { "from": "x-drn", "to": "x-inst", "label": "stop new work", "kind": "call" }, { "from": "x-drn", "to": "x-drn", "label": "wait to 120 s deadline", "kind": "self" }, { "from": "x-drn", "to": "x-inst", "label": "terminate", "kind": "call" }, { "from": "x-drn", "to": "x-jrn", "label": "refusals + drains", "kind": "async" } ], "note": "An instance holding a work lease refuses removal, and the reconciler re-derives the delta next interval rather than forcing it. Removing an instance still doing work is the failure this design exists to survive.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "24-warm-pool-lifecycle", "title": "Warm Pool Lifecycle", "layout": "cycle", "canvas": { "width": 1500 }, "rx": 430, "ry": 210, "centre": { "label": "Warm Pool", "sub": "5% of steady state" }, "nodes": [ { "id": "wp1", "label": "Size", "kind": "app", "sub": "burst x time-to-serve", "icon": false }, { "id": "wp2", "label": "Pre-Warm", "kind": "app", "sub": "image, deps, cache" }, { "id": "wp3", "label": "Hold", "kind": "store", "sub": "cost accounted apart" }, { "id": "wp4", "label": "Attach", "kind": "app", "sub": "under 10 s", "icon": false }, { "id": "wp5", "label": "Measure", "kind": "app", "sub": "hit rate, penalty" }, { "id": "wp6", "label": "Recycle", "kind": "security", "sub": "never a stale image" } ], "ringLabels": [ "target size", "ready members", "burst arrives", "serving instantly", "resize evidence", "age limit reached" ], "note": "A pool miss is not a failure, it is a recorded latency penalty against the target. Empty pool falls back to cold provisioning.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "25-target-class-pipelines", "title": "Four Classes of Target, One Loop", "layout": "swimlane", "canvas": { "width": 1800 }, "laneHeaderWidth": 168, "stages": [ "Driving signal", "Policy form", "Actuation", "Counted when" ], "lanes": [ { "title": "Stateless service", "cells": [ [ { "label": "Concurrency", "kind": "app", "sub": "arrival x service" } ], [ { "label": "Target tracking", "kind": "app" } ], [ { "label": "VMSS capacity", "kind": "integration" } ], [ { "label": "LB registered", "kind": "app" } ] ] }, { "title": "Queue worker pool", "cells": [ [ { "label": "Oldest message age", "kind": "queue", "sub": "leads demand" } ], [ { "label": "Target tracking", "kind": "app", "sub": "age setpoint" } ], [ { "label": "Replica count", "kind": "integration" } ], [ { "label": "Subscription active", "kind": "app" } ] ] }, { "title": "Batch consumer", "cells": [ [ { "label": "Consumer lag", "kind": "queue", "sub": "plus schedule" } ], [ { "label": "Scheduled + step", "kind": "app" } ], [ { "label": "Replica count", "kind": "integration" } ], [ { "label": "Partition assigned", "kind": "app" } ] ] }, { "title": "Node group", "cells": [ [ { "label": "Unschedulable pods", "kind": "app", "sub": "derived, not raw" } ], [ { "label": "Derivative of above", "kind": "app", "sub": "no policy of its own" } ], [ { "label": "AKS node count", "kind": "integration" } ], [ { "label": "Node Ready", "kind": "app" } ] ] } ], "note": "The node group has no independent opinion about demand. It supplies what the workload layer declared, or reports unmet demand.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "26-capacity-unavailability", "title": "When the Capacity Is Not There", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1720 }, "nodeWidth": 210, "stages": [ { "title": "Request", "nodes": [ { "id": "n-req", "label": "Provision Request", "kind": "app", "sub": "preferred shape" } ] }, { "title": "Refusal", "nodes": [ { "id": "n-stock", "label": "Zonal Stockout", "kind": "risk" }, { "id": "n-quota", "label": "Quota Exhausted", "kind": "risk" }, { "id": "n-gpu", "label": "Accelerator Scarce", "kind": "risk" }, { "id": "n-throt", "label": "API Throttled", "kind": "risk", "sub": "different problem" } ] }, { "title": "Declared fallback", "nodes": [ { "id": "n-z2", "label": "Next Zone", "kind": "app", "sub": "ordered list" }, { "id": "n-s2", "label": "Next Shape", "kind": "app", "sub": "declared only" }, { "id": "n-spot", "label": "Spot then On-Demand", "kind": "app", "sub": "above the floor" } ] }, { "title": "Exhausted", "nodes": [ { "id": "n-unmet", "label": "Unmet Demand Signal", "kind": "risk", "sub": "surfaced, not retried" }, { "id": "n-alert", "label": "Alert", "kind": "platform", "sub": "capacity constrained", "icon": "azure_alerts" } ] }, { "title": "Meanwhile", "nodes": [ { "id": "n-hold", "label": "Hold What Serves", "kind": "security", "sub": "no scale-in" }, { "id": "n-time", "label": "Time Constrained", "kind": "store", "sub": "reported per target" } ] } ], "edges": [ { "from": "n-throt", "to": "n-unmet", "label": "breaker, not fallback", "kind": "error", "route": "gutter" }, { "from": "n-unmet", "to": "n-hold", "label": "degrade, keep serving" } ], "note": "Throttling and scarcity look alike and are handled differently: throttling is retried with backoff behind a breaker, scarcity is a fallback list and then an honest signal.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "27-deployment-architecture", "title": "Deployment — One Region, Three Availability Zones", "layout": "nested", "canvas": { "width": 1800 }, "boxes": [ { "title": "Azure · Sweden Central · control plane", "kind": "cloud", "dir": "row", "children": [ { "title": "Zone 1", "kind": "boundary", "nodes": [ { "id": "v-a1", "label": "AKS System Pool", "kind": "app", "sub": "3 nodes" }, { "id": "v-a2", "label": "Decision Pods", "kind": "app", "sub": "shards 0-2" }, { "id": "v-a3", "label": "Reconciler Pods", "kind": "app", "sub": "4 replicas" } ] }, { "title": "Zone 2", "kind": "boundary", "nodes": [ { "id": "v-b1", "label": "AKS System Pool", "kind": "app", "sub": "3 nodes" }, { "id": "v-b2", "label": "Decision Pods", "kind": "app", "sub": "shards 3-5" }, { "id": "v-b3", "label": "Reconciler Pods", "kind": "app", "sub": "4 replicas" } ] }, { "title": "Zone 3", "kind": "boundary", "nodes": [ { "id": "v-c1", "label": "AKS System Pool", "kind": "app", "sub": "3 nodes" }, { "id": "v-c2", "label": "Decision Pods", "kind": "app", "sub": "standby shards" }, { "id": "v-c3", "label": "Signal Collectors", "kind": "app", "sub": "6 replicas" } ] } ] }, { "title": "Zone-redundant regional services", "kind": "boundary", "dir": "row", "children": [ { "title": "Authoritative state", "kind": "boundary", "nodes": [ { "id": "v-pg", "label": "PostgreSQL Flexible", "kind": "store", "sub": "sync standby · RPO 0" }, { "id": "v-lease", "label": "Lease Store", "kind": "security", "sub": "etcd via AKS" } ] }, { "title": "Signal and evidence", "kind": "boundary", "nodes": [ { "id": "v-mimir", "label": "Mimir", "kind": "store", "sub": "3 AZ · Blob backend" }, { "id": "v-eh", "label": "Event Hubs", "kind": "queue", "sub": "zone redundant" }, { "id": "v-adx", "label": "Data Explorer", "kind": "store", "sub": "leader-follower" } ] }, { "title": "Platform", "kind": "boundary", "nodes": [ { "id": "v-kv", "label": "Key Vault", "kind": "security", "sub": "private endpoint", "icon": "azure_keyvault" }, { "id": "v-graf", "label": "Grafana", "kind": "platform" }, { "id": "v-am", "label": "Alertmanager", "kind": "platform" } ] } ] } ], "outside": [ { "id": "v-vmss", "label": "Managed VMSS Fleets", "kind": "external", "sub": "50k -> 200k instances" }, { "id": "v-np", "label": "Managed Node Pools", "kind": "external", "sub": "the fleet under them" } ], "edges": [ { "from": "v-a2", "to": "v-pg", "label": "desired write" }, { "from": "v-b3", "to": "v-vmss", "label": "actuate" }, { "from": "v-c3", "to": "v-mimir", "label": "remote write", "kind": "async" } ], "note": "Losing one zone loses one third of the decision shards and no desired state. The remaining zones take the leases; already-declared capacity keeps converging throughout.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "28-multi-region-topology", "title": "Multi-Region — Independent Control Planes", "layout": "nested", "canvas": { "width": 1760 }, "boxes": [ { "title": "Region A · Sweden Central", "kind": "cloud", "dir": "row", "children": [ { "title": "Control plane", "kind": "boundary", "nodes": [ { "id": "m-a-ctl", "label": "Full Control Plane", "kind": "app", "sub": "2,000 targets" }, { "id": "m-a-st", "label": "Regional State", "kind": "store", "sub": "no remote read" } ] }, { "title": "Managed fleet", "kind": "boundary", "nodes": [ { "id": "m-a-fl", "label": "200k Instances", "kind": "external", "sub": "design ceiling" } ] } ] }, { "title": "Region B · West Europe", "kind": "cloud", "dir": "row", "children": [ { "title": "Control plane", "kind": "boundary", "nodes": [ { "id": "m-b-ctl", "label": "Full Control Plane", "kind": "app", "sub": "identical build" }, { "id": "m-b-st", "label": "Regional State", "kind": "store", "sub": "no remote read" } ] }, { "title": "Managed fleet", "kind": "boundary", "nodes": [ { "id": "m-b-fl", "label": "200k Instances", "kind": "external" } ] } ] }, { "title": "Global · declarative and reporting only", "kind": "boundary", "dir": "row", "children": [ { "title": "Intent", "kind": "boundary", "nodes": [ { "id": "m-git", "label": "Policy Repository", "kind": "external", "sub": "reviewed, versioned" }, { "id": "m-cd", "label": "Argo CD", "kind": "app", "sub": "per-region sync" } ] }, { "title": "Evidence", "kind": "boundary", "nodes": [ { "id": "m-cost", "label": "Fleet Cost View", "kind": "app", "sub": "async, lagging" }, { "id": "m-sla", "label": "Fleet SLO View", "kind": "platform", "sub": "never a dependency" } ] } ] } ], "edges": [ { "from": "m-cd", "to": "m-a-ctl", "label": "declared config", "kind": "batch" }, { "from": "m-cd", "to": "m-b-ctl", "label": "declared config", "kind": "batch" }, { "from": "m-a-st", "to": "m-cost", "label": "export", "kind": "async" }, { "from": "m-b-st", "to": "m-cost", "label": "export", "kind": "async", "route": "tb" } ], "note": "Adding a region is a deployment, not a design change. Region B failing entirely has no effect on Region A's control loop.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "29-cicd-and-policy-promotion", "title": "Shipping the Controller, and Shipping a Policy", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1780 }, "nodeWidth": 205, "stages": [ { "title": "Author", "nodes": [ { "id": "c-code", "label": "Controller Code", "kind": "app", "sub": "Go" }, { "id": "c-pol", "label": "Policy Change", "kind": "app", "sub": "declarative" } ] }, { "title": "Review", "nodes": [ { "id": "c-pr", "label": "Pull Request", "kind": "app", "sub": "CODEOWNERS" }, { "id": "c-2p", "label": "Second Approver", "kind": "security", "sub": "ceilings and max" } ] }, { "title": "Prove", "nodes": [ { "id": "c-unit", "label": "Unit and Sim", "kind": "app", "sub": "synthetic demand" }, { "id": "c-cf", "label": "Counterfactual Replay", "kind": "app", "sub": "against real history" }, { "id": "c-diff", "label": "Capacity Diff", "kind": "decision", "sub": "cost and latency" } ] }, { "title": "Stage", "nodes": [ { "id": "c-dry", "label": "Dry Run on Target", "kind": "app", "sub": "journalled only" }, { "id": "c-can", "label": "Canary Targets", "kind": "app", "sub": "5% of the fleet" } ] }, { "title": "Promote", "nodes": [ { "id": "c-cd", "label": "Argo CD Sync", "kind": "app", "sub": "region by region" }, { "id": "c-ver", "label": "Version Pinned", "kind": "store", "sub": "immutable in journal" } ] }, { "title": "Revert", "nodes": [ { "id": "c-rb", "label": "Roll Back Policy", "kind": "security", "sub": "capacity unchanged" } ] } ], "edges": [ { "from": "c-diff", "to": "c-rb", "label": "unacceptable", "kind": "error", "route": "gutter" }, { "from": "c-can", "to": "c-rb", "label": "reversals rise", "kind": "error", "route": "gutter", "labelAt": 0.4 } ], "note": "A policy roll-back changes the next decision, never the current capacity. The fleet is not disturbed by the deployment that changes how it will be decided.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "30-observability", "title": "Observability — Signal Type by Loop Stage", "layout": "grid", "canvas": { "width": 1800 }, "laneHeaderWidth": 150, "columns": [ "Signal plane", "Decision plane", "Actuation plane", "Managed capacity" ], "lanes": [ { "title": "Metrics", "cells": [ [ { "label": "Ingest lag p99", "kind": "platform", "sub": "target 5 s" } ], [ { "label": "Decision latency p99", "kind": "platform", "sub": "target 2 s" } ], [ { "label": "Actuation latency p99", "kind": "platform", "sub": "target 3 s" } ], [ { "label": "Desired vs actual", "kind": "platform", "sub": "per target" } ] ] }, { "title": "Health", "cells": [ [ { "label": "Signal freshness", "kind": "app" } ], [ { "label": "Lease held per shard", "kind": "security" } ], [ { "label": "Breaker state", "kind": "security" } ], [ { "label": "Time-to-serving", "kind": "app", "sub": "distribution", "icon": "mat_timer" } ] ] }, { "title": "Quality", "cells": [ [ { "label": "Samples rejected", "kind": "risk", "sub": "stale or implausible" } ], [ { "label": "Suppressed decisions", "kind": "app", "sub": "by damping" } ], [ { "label": "Partial actuations", "kind": "risk" } ], [ { "label": "Warm-pool hit rate", "kind": "app" } ] ] }, { "title": "Alerts", "cells": [ [ { "label": "Stale past horizon", "kind": "platform" } ], [ { "label": "Pinned at max 10 min", "kind": "platform" } ], [ { "label": "3 failed intervals", "kind": "platform" } ], [ { "label": "Oscillation freeze", "kind": "platform" } ] ] }, { "title": "Explain", "cells": [ [ { "label": "Signal history", "kind": "store", "sub": "13 months rolled" } ], [ { "label": "Why this capacity", "kind": "store", "sub": "journal only" } ], [ { "label": "Actuation trace", "kind": "store", "sub": "1 : 1 to decision" } ], [ { "label": "Cost of stability", "kind": "store", "sub": "currency per day" } ] ] } ], "note": "Every alert names a condition an operator can act on. \"Why this capacity\" is answered from the journal without replaying a single metric.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "31-cost-and-efficiency", "title": "Cost — Making the Price of Stability Visible", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1740 }, "nodeWidth": 210, "stages": [ { "title": "Attribute", "nodes": [ { "id": "f-serve", "label": "Serving Capacity", "kind": "store", "sub": "per hour, per team" }, { "id": "f-pool", "label": "Warm-Pool Cost", "kind": "store", "sub": "accounted apart", "icon": "azure_cost-management" }, { "id": "f-ctl", "label": "Controller Cost", "kind": "store", "sub": "under 1.5%" } ] }, { "title": "Measure", "nodes": [ { "id": "f-eff", "label": "Capacity Efficiency", "kind": "app", "sub": "served vs provisioned" }, { "id": "f-head", "label": "Policy Headroom", "kind": "app", "sub": "what the setpoint holds" } ] }, { "title": "Price the stability", "nodes": [ { "id": "f-band", "label": "Dead Band", "kind": "app" }, { "id": "f-sus", "label": "Sustain Windows", "kind": "app", "icon": false }, { "id": "f-lim", "label": "Scale-In Rate Limit", "kind": "app" }, { "id": "f-cool", "label": "Cooldowns", "kind": "app" } ] }, { "title": "Report", "nodes": [ { "id": "f-cos", "label": "Cost of Stability", "kind": "store", "sub": "currency per day" }, { "id": "f-tune", "label": "The Tuning Number", "kind": "decision", "sub": "latency vs cost" } ] }, { "title": "Act", "nodes": [ { "id": "f-bud", "label": "Budget Approached", "kind": "risk", "sub": "per target, monthly" }, { "id": "f-aggr", "label": "Scale-In Sharper", "kind": "app", "sub": "inside safety bounds" }, { "id": "f-min", "label": "Alert, Never Breach Min", "kind": "security" } ] } ], "edges": [ { "from": "f-bud", "to": "f-aggr", "label": "within bounds" }, { "from": "f-aggr", "to": "f-min", "label": "floor holds" }, { "from": "f-cos", "to": "f-tune", "label": "argue with this" } ], "note": "Capacity retained by damping is not waste and not free. Pricing it in currency per day is what turns a tuning argument into a decision.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "32-operations-loop", "title": "The Operator's Loop", "layout": "cycle", "canvas": { "width": 1500 }, "rx": 430, "ry": 210, "centre": { "label": "Operate", "sub": "tune against evidence" }, "nodes": [ { "id": "o1", "label": "Alert Fires", "kind": "platform", "sub": "named condition" }, { "id": "o2", "label": "Ask the Journal", "kind": "store", "sub": "why this capacity" }, { "id": "o3", "label": "Override", "kind": "security", "sub": "expires in 4 h" }, { "id": "o4", "label": "Draft New Policy", "kind": "app", "sub": "as a version" }, { "id": "o5", "label": "Replay Counterfactual", "kind": "app", "sub": "against history" }, { "id": "o6", "label": "Promote or Discard", "kind": "decision", "sub": "cost diff shown" } ], "ringLabels": [ "a target, a time", "the driving signal", "capacity held", "candidate version", "what it would have done", "policy or nothing" ], "note": "An override buys time to think; it never becomes the fix. Expiry is mandatory, so control returns to the policy whether or not anyone remembers.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "33-security-trust-zones", "title": "Trust Zones — Every Crossing Authenticated", "layout": "zones", "canvas": { "width": 1780 }, "zones": [ { "title": "Untrusted · human and external", "kind": "trust", "nodes": [ { "id": "b-op", "label": "Operator", "kind": "actor", "sub": "Entra + MFA" }, { "id": "b-fc", "label": "Forecast Vendor", "kind": "external", "sub": "signed payload" }, { "id": "b-bad", "label": "Compromised Source", "kind": "risk", "sub": "assumed possible" } ] }, { "title": "Control surface · private", "kind": "trust", "nodes": [ { "id": "b-api", "label": "Control API", "kind": "integration", "sub": "RBAC · private only", "icon": "azure_AzureAPIManagement__Web" }, { "id": "b-git", "label": "Policy Repository", "kind": "app", "sub": "reviewed changes" } ] }, { "title": "Signal plane · read only", "kind": "trust", "nodes": [ { "id": "b-coll", "label": "Collectors", "kind": "app", "sub": "read identity" }, { "id": "b-gate", "label": "Qualification Gate", "kind": "decision", "sub": "reject unsigned" } ] }, { "title": "Decision plane · writes state", "kind": "trust", "nodes": [ { "id": "b-eng", "label": "Decision Engine", "kind": "app", "sub": "write identity" }, { "id": "b-dsr", "label": "Desired State", "kind": "store", "sub": "no capacity access", "icon": "postgresql" } ] }, { "title": "Actuation plane · changes capacity", "kind": "trust", "nodes": [ { "id": "b-rec", "label": "Reconciler", "kind": "app", "sub": "actuate identity" }, { "id": "b-arm", "label": "Capacity APIs", "kind": "external", "sub": "scoped to groups" } ] } ], "edges": [ { "from": "b-op", "to": "b-api", "label": "OIDC + MFA" }, { "from": "b-fc", "to": "b-coll", "label": "signed feed" }, { "from": "b-bad", "to": "b-gate", "label": "rejected", "kind": "error" }, { "from": "b-api", "to": "b-eng", "label": "config only" }, { "from": "b-coll", "to": "b-eng", "label": "qualified signals" }, { "from": "b-eng", "to": "b-dsr", "label": "desired write" }, { "from": "b-dsr", "to": "b-rec", "label": "desired read" }, { "from": "b-rec", "to": "b-arm", "label": "scoped mTLS" } ], "note": "The signal path and the capacity path never share an identity. Compromising a metrics source cannot change a single instance.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "34-identity-separation", "title": "Three Identities, No Standing Credentials", "layout": "sequence", "canvas": { "width": 1700 }, "lifelines": [ { "id": "id-pod", "label": "Controller Pod", "kind": "app" }, { "id": "id-sa", "label": "K8s Service Account", "kind": "security" }, { "id": "id-entra", "label": "Entra ID", "kind": "security" }, { "id": "id-kv", "label": "Key Vault", "kind": "security", "icon": "azure_keyvault" }, { "id": "id-sig", "label": "Signal Source", "kind": "external" }, { "id": "id-arm", "label": "Capacity API", "kind": "external" }, { "id": "id-aud", "label": "Audit Log", "kind": "store" } ], "messages": [ { "from": "id-pod", "to": "id-sa", "label": "projected token", "kind": "call" }, { "from": "id-sa", "to": "id-entra", "label": "federated exchange", "kind": "call" }, { "from": "id-entra", "to": "id-pod", "label": "token · 1 h · scoped", "kind": "return" }, { "from": "id-pod", "to": "id-sig", "label": "read as signal-reader", "kind": "call" }, { "from": "id-pod", "to": "id-kv", "label": "no secret to fetch", "kind": "self" }, { "from": "id-pod", "to": "id-arm", "label": "actuate as capacity-writer", "kind": "call" }, { "from": "id-arm", "to": "id-pod", "label": "scoped to this group only", "kind": "return" }, { "from": "id-pod", "to": "id-arm", "label": "another group: denied", "kind": "error" }, { "from": "id-entra", "to": "id-aud", "label": "every exchange", "kind": "async" } ], "note": "Reading signals, writing desired state and actuating capacity are three separate workload identities. None of them is a fleet-wide administrative role.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "35-rbac-and-change-control", "title": "Who May Change What", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1740 }, "nodeWidth": 215, "stages": [ { "title": "Roles", "nodes": [ { "id": "rb-v", "label": "Viewer", "kind": "actor", "sub": "read everything" }, { "id": "rb-p", "label": "Policy Author", "kind": "actor", "sub": "propose versions" }, { "id": "rb-o", "label": "Operator", "kind": "actor", "sub": "override, pause" }, { "id": "rb-a", "label": "Administrator", "kind": "actor", "sub": "bounds, ceilings" } ] }, { "title": "Change path", "nodes": [ { "id": "rb-req", "label": "Proposed Change", "kind": "app", "sub": "with justification" }, { "id": "rb-gate", "label": "Approval Gate", "kind": "decision", "sub": "role dependent" } ] }, { "title": "Extra scrutiny", "nodes": [ { "id": "rb-2p", "label": "Second Approver", "kind": "security", "sub": "ceiling or max" }, { "id": "rb-exp", "label": "Mandatory Expiry", "kind": "security", "sub": "overrides only" } ] }, { "title": "Effect", "nodes": [ { "id": "rb-eff", "label": "Versioned Config", "kind": "store", "sub": "effective from" }, { "id": "rb-hard", "label": "Still Inside Bounds", "kind": "security", "sub": "no exception" } ] }, { "title": "Evidence", "nodes": [ { "id": "rb-aud", "label": "Audit Record", "kind": "security", "sub": "actor, before, after" }, { "id": "rb-ret", "label": "13 Months", "kind": "store", "sub": "tamper evident" } ] } ], "edges": [ { "from": "rb-o", "to": "rb-exp", "label": "4 h default", "route": "gutter" }, { "from": "rb-a", "to": "rb-2p", "label": "always", "route": "gutter", "labelAt": 0.35 } ], "note": "An operator can pin a target but cannot raise its maximum. Raising a maximum needs an administrator and a second approver, and is recorded either way.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "36-blindness-and-degradation", "title": "What It Does When It Cannot See", "layout": "flow", "chain": true, "align": "middle", "canvas": { "width": 1760 }, "nodeWidth": 210, "stages": [ { "title": "Loss", "nodes": [ { "id": "e-one", "label": "One Signal Stale", "kind": "risk", "sub": "past 3 intervals" }, { "id": "e-all", "label": "Signal Store Down", "kind": "risk", "sub": "completely blind" }, { "id": "e-eng", "label": "Decision Engine Down", "kind": "risk" } ] }, { "title": "Immediate", "nodes": [ { "id": "e-static", "label": "Fail Static", "kind": "security", "sub": "hold last declared" }, { "id": "e-noin", "label": "No Scale-In While Blind", "kind": "security", "sub": "never guess down" }, { "id": "e-cont", "label": "Actuation Continues", "kind": "app", "sub": "desired is durable" } ] }, { "title": "If it persists", "nodes": [ { "id": "e-diur", "label": "Past a Diurnal Turn", "kind": "decision", "sub": "declared threshold" }, { "id": "e-base", "label": "Schedule Baseline", "kind": "app", "sub": "opt-in per target" }, { "id": "e-freeze", "label": "Stay Frozen", "kind": "security", "sub": "the default" } ] }, { "title": "Always", "nodes": [ { "id": "e-alert", "label": "Alert with Cause", "kind": "platform", "sub": "names the source" }, { "id": "e-jrn", "label": "Journalled as Degraded", "kind": "store", "sub": "a real outcome" } ] } ], "edges": [ { "from": "e-diur", "to": "e-base", "label": "if declared" }, { "from": "e-diur", "to": "e-freeze", "label": "otherwise" }, { "from": "e-eng", "to": "e-cont", "label": "unaffected", "route": "gutter" } ], "note": "Freezing is right for an outage measured in minutes and increasingly wrong past a diurnal turn. Which of the two applies is a per-target declaration, not a runtime guess.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "37-failure-modes", "title": "Named Failure Modes and Their Handling", "layout": "nested", "canvas": { "width": 1800 }, "boxes": [ { "title": "Signal failures", "kind": "boundary", "dir": "row", "children": [ { "title": "Assumed to occur", "kind": "boundary", "nodes": [ { "id": "x-stale", "label": "Staleness", "kind": "risk", "sub": "source stops" }, { "id": "x-corr", "label": "Corruption", "kind": "risk", "sub": "implausible value" }, { "id": "x-out", "label": "Store Outage", "kind": "risk" }, { "id": "x-skew", "label": "Clock Skew", "kind": "risk" } ] }, { "title": "Handling", "kind": "boundary", "nodes": [ { "id": "x-h1", "label": "Mark Stale, Degrade", "kind": "security" }, { "id": "x-h2", "label": "Clamp, Quarantine", "kind": "security" }, { "id": "x-h3", "label": "Fail Static", "kind": "security", "sub": "no scale-in" }, { "id": "x-h4", "label": "Reject, Alert", "kind": "security" } ] } ] }, { "title": "Actuation failures", "kind": "boundary", "dir": "row", "children": [ { "title": "Assumed to occur", "kind": "boundary", "nodes": [ { "id": "x-throt", "label": "API Throttling", "kind": "risk" }, { "id": "x-scarce", "label": "Capacity Scarcity", "kind": "risk" }, { "id": "x-part", "label": "Partial Actuation", "kind": "risk" }, { "id": "x-down", "label": "Downstream Saturation", "kind": "risk" } ] }, { "title": "Handling", "kind": "boundary", "nodes": [ { "id": "x-h5", "label": "Backoff, Breaker", "kind": "security", "sub": "5 failures" }, { "id": "x-h6", "label": "Zone / Shape List", "kind": "security" }, { "id": "x-h7", "label": "Re-Derive from Actual", "kind": "security" }, { "id": "x-h8", "label": "Dependency Ceiling", "kind": "security", "sub": "inhibit scale-out" } ] } ] }, { "title": "Controller failures", "kind": "boundary", "dir": "row", "children": [ { "title": "Assumed to occur", "kind": "boundary", "nodes": [ { "id": "x-crash", "label": "Crash Mid-Decision", "kind": "risk" }, { "id": "x-split", "label": "Split Brain", "kind": "risk", "sub": "two replicas" }, { "id": "x-mis", "label": "Policy Misconfigured", "kind": "risk" }, { "id": "x-pois", "label": "Poison Target", "kind": "risk", "sub": "crash-looping" } ] }, { "title": "Handling", "kind": "boundary", "nodes": [ { "id": "x-h9", "label": "Durable Desired State", "kind": "security", "sub": "resume, do not redo" }, { "id": "x-h10", "label": "Lease per Shard", "kind": "security", "sub": "no lease, no write" }, { "id": "x-h11", "label": "Hard Bounds, Rate Caps", "kind": "security" }, { "id": "x-h12", "label": "No Throughput Gain", "kind": "security", "sub": "3 intervals: freeze" } ] } ] } ], "edges": [ { "from": "x-stale", "to": "x-h1" }, { "from": "x-throt", "to": "x-h5" }, { "from": "x-crash", "to": "x-h9" } ], "note": "Twelve failure classes, each with a named handling. None of them is \"retry until it works\", and none of them removes capacity that is currently serving.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } } ]