[ { "id": "01-system-context", "title": "AI Executive Office — System Context", "layout": "context", "canvas": { "width": 1760 }, "colWidth": 262, "system": { "label": "AI Executive Office", "sub": "Multi-tenant decision platform" }, "groups": [ { "side": "left", "title": "The executive office", "nodes": [ { "id": "cxo", "label": "CXO", "kind": "actor", "rel": "asks · approves", "dir": "in" }, { "id": "cos", "label": "Chief of staff", "kind": "actor", "rel": "investigates", "dir": "in" }, { "id": "gov", "label": "Governance officer", "kind": "actor", "rel": "audits", "dir": "in" } ] }, { "side": "top", "title": "Systems of record", "nodes": [ { "id": "erp", "label": "ERP and finance", "kind": "external", "rel": "ledger", "dir": "in", "kind2": "batch", "icon": "fa5_server" }, { "id": "proc", "label": "Procurement", "kind": "external", "rel": "POs", "dir": "in", "kind2": "batch", "icon": "fa5_server" }, { "id": "ppm", "label": "Projects and portfolio", "kind": "external", "rel": "schedule", "dir": "in", "kind2": "batch", "icon": "fa5_server" }, { "id": "hrcrm", "label": "HR, CRM, supply chain", "kind": "external", "rel": "workforce", "dir": "in", "kind2": "batch", "icon": "fa5_server" } ] }, { "side": "right", "title": "Knowledge and analytics", "nodes": [ { "id": "docs", "label": "Document estate", "kind": "external", "rel": "policies", "dir": "in", "icon": "fa5_folder_open" }, { "id": "lake", "label": "Existing lake and BI", "kind": "external", "rel": "marts", "dir": "in", "kind2": "batch", "icon": "fa5_database" }, { "id": "graph365", "label": "Email and calendar", "kind": "external", "rel": "IMAP · CalDAV", "dir": "in", "icon": "fa5_envelope" }, { "id": "market", "label": "External market data", "kind": "external", "rel": "indices", "dir": "in" } ] }, { "side": "bottom", "title": "Platform dependencies", "nodes": [ { "id": "entra", "label": "Keycloak + AD", "kind": "security", "rel": "SSO · MFA", "dir": "in" }, { "id": "teams", "label": "Mattermost", "kind": "external", "rel": "brief", "kind2": "async", "icon": "fa5_comments" }, { "id": "siem", "label": "Regulator and SOC", "kind": "external", "rel": "evidence", "kind2": "batch" } ] } ], "note": "One tenant is drawn. The platform runs many, isolated by the tier the tenant bought — see view 10.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "AI Executive Office — High-Level Architecture", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "stages": [ { "title": "Executive experience", "nodes": [ { "id": "h-teams", "label": "Mattermost app", "kind": "app", "sub": "brief · approvals", "icon": "fa5_comments" }, { "id": "h-web", "label": "Executive web", "kind": "app", "sub": "React on Kubernetes", "icon": "react" }, { "id": "h-mob", "label": "Mobile", "kind": "app", "sub": "MDM managed" } ] }, { "title": "Edge and identity", "nodes": [ { "id": "h-afd", "label": "HAProxy + WAF", "kind": "integration", "sub": "TLS · rate limit", "icon": "haproxy" }, { "id": "h-apim", "label": "Kong Gateway", "kind": "integration", "sub": "tenant quota" }, { "id": "h-entra", "label": "Keycloak", "kind": "security", "sub": "token exchange · MFA" } ] }, { "title": "Orchestration and decision", "nodes": [ { "id": "h-orch", "label": "Executive Orchestrator", "kind": "app", "sub": "LangGraph runtime", "icon": "agent" }, { "id": "h-spec", "label": "Specialist agents", "kind": "app", "sub": "10 capability packs", "icon": "agent" }, { "id": "h-dec", "label": "Decision engine", "kind": "app", "sub": "situation to option set", "icon": "fa5_balance_scale" }, { "id": "h-inv", "label": "Investigation runs", "kind": "app", "sub": "Temporal workflows", "icon": "fa5_microscope" } ] }, { "title": "Grounding and action", "nodes": [ { "id": "h-tool", "label": "Tool plane", "kind": "integration", "sub": "MCP · caller token", "icon": "fa5_plug" }, { "id": "h-srch", "label": "OpenSearch", "kind": "store", "sub": "hybrid · ACL trimmed" }, { "id": "h-sem", "label": "Semantic model", "kind": "store", "sub": "the only KPI source", "icon": "fa5_calculator" }, { "id": "h-ml", "label": "KServe endpoints", "kind": "app", "sub": "forecast · anomaly", "icon": "fa5_chart_line" }, { "id": "h-exec", "label": "Execution plane", "kind": "integration", "sub": "Camunda + Camel", "icon": "fa5_paper_plane" } ] }, { "title": "Data and knowledge", "nodes": [ { "id": "h-lake", "label": "MinIO + Iceberg", "kind": "store", "sub": "bronze · silver · gold" }, { "id": "h-wh", "label": "Trino warehouse", "kind": "store", "sub": "canonical model" }, { "id": "h-kg", "label": "Entity graph", "kind": "store", "sub": "Neo4j", "icon": "fa5_project_diagram" }, { "id": "h-es", "label": "Kafka", "kind": "queue", "sub": "CDC · signals" }, { "id": "h-rec", "label": "Decision store", "kind": "store", "sub": "PostgreSQL · append-only", "icon": "fa5_gavel" } ] }, { "title": "Enterprise systems", "nodes": [ { "id": "h-erp", "label": "ERP and finance", "kind": "external", "icon": "fa5_server" }, { "id": "h-proc", "label": "Procurement", "kind": "external", "icon": "fa5_server" }, { "id": "h-ppm", "label": "Projects", "kind": "external", "icon": "fa5_server" }, { "id": "h-doc", "label": "Document estate", "kind": "external", "icon": "fa5_folder_open" } ] } ], "edges": [ { "from": "h-exec", "to": "h-proc", "label": "approved write", "kind": "sync" }, { "from": "h-erp", "to": "h-es", "label": "CDC", "kind": "async" }, { "from": "h-rec", "to": "h-dec", "label": "outcome check", "kind": "batch" } ], "note": "The model never reaches a system of record. Every arrow into the right-hand column is a typed tool or an approved action.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "03-actors-and-journeys", "title": "Actors and Their Core Journeys", "layout": "actors", "canvas": { "width": 1800 }, "cardWidth": 272, "groups": [ { "title": "The executive office — the people the platform is for", "kind": "boundary", "actors": [ { "id": "a-cxo", "label": "CXO", "sub": "3–8 per tenant", "goal": "Tell me what changed overnight and settle the decisions that need me, before my first meeting.", "journeys": [ { "id": "j-morning", "label": "Morning brief to approval", "sub": "daily" }, { "label": "Ask across every system" }, { "label": "Weigh an option set" } ] }, { "id": "a-cos", "label": "Chief of staff", "sub": "1–3 per CXO", "goal": "Have the investigation already done, with the numbers reconciled, before my principal asks.", "journeys": [ { "label": "Delegated investigation" }, { "label": "Prepare the option set" }, { "label": "Chase an executed action" } ] }, { "id": "a-bu", "label": "Business unit head", "sub": "20–200 per tenant", "goal": "See the exception in my area before it reaches the CEO, and be the one who fixes it.", "journeys": [ { "label": "Own an escalation" }, { "label": "Respond to a variance" } ] } ] }, { "title": "Assurance and operation", "kind": "trust", "actors": [ { "id": "a-gov", "label": "Governance officer", "sub": "risk and compliance", "goal": "Show a regulator exactly how the platform reached a decision that moved money.", "journeys": [ { "id": "j-audit", "label": "Reconstruct a decision", "sub": "on demand" }, { "label": "Review the abstention log" } ] }, { "id": "a-impl", "label": "Implementation lead", "sub": "delivery partner", "goal": "Stand a new organisation up on the platform in six weeks without writing product code.", "journeys": [ { "id": "j-onboard", "label": "Onboard a tenant", "sub": "6 weeks" }, { "label": "Map a source to canon" }, { "label": "Publish a KPI pack" } ] }, { "id": "a-tadmin", "label": "Tenant administrator", "sub": "customer side", "goal": "Change a threshold or an approval limit myself, on a Tuesday, without raising a ticket.", "journeys": [ { "label": "Set approval thresholds" }, { "label": "Grant and revoke access" } ] }, { "id": "a-sre", "label": "Platform SRE", "kind": "platform", "sub": "platform run team", "goal": "Know which tenant is degraded and why, without opening tenant data to find out.", "journeys": [ { "label": "Triage a degraded tenant" }, { "label": "Drain a site" } ] } ] }, { "title": "Machines that act without being asked", "kind": "onprem", "actors": [ { "id": "a-detect", "label": "Detection sweep", "kind": "platform", "sub": "hourly + on event", "goal": "Find the exception worth an executive's attention, and nothing else.", "journeys": [ { "label": "Score signals against baselines" }, { "label": "Raise a situation" } ], "icon": "fa5_binoculars" }, { "id": "a-ingest", "label": "Ingestion pipelines", "kind": "platform", "sub": "per source contract", "goal": "Land every source inside its freshness contract, or say loudly that I did not.", "journeys": [ { "label": "Land and reconcile a source" }, { "label": "Publish a staleness flag" } ] }, { "id": "a-outcome", "label": "Outcome monitor", "kind": "platform", "sub": "per executed action", "goal": "Close the loop: prove the intervention worked, or reopen the decision.", "journeys": [ { "label": "Track a KPI after an action" }, { "label": "Reopen a failed intervention" } ], "icon": "fa5_heartbeat" }, { "id": "a-src", "label": "Source systems", "kind": "external", "sub": "12 classes", "goal": "Be read on a schedule I can sustain, and written to only through my own front door.", "journeys": [ { "label": "Serve a governed read" }, { "label": "Accept an approved write" } ], "icon": "fa5_server" } ] } ], "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "04-journey-cxo-decision", "title": "Journey — CXO, Morning Brief to Approved Intervention", "layout": "journey", "canvas": { "width": 1760 }, "cellWidth": 232, "actor": { "label": "CXO", "sub": "group chief executive", "goal": "Settle the decisions that need me before my first meeting", "trigger": "07:10 — the morning brief arrives in the chat client", "success": "Three decisions closed, each defensible to the board" }, "phases": [ { "title": "Brief", "sub": "07:10, in chat" }, { "title": "Investigate", "sub": "root cause" }, { "title": "Forecast", "sub": "do-nothing case" }, { "title": "Decide", "moment": true }, { "title": "Watch", "moment": true } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Reads three exceptions" } ], [ { "label": "Asks one question" }, { "label": "Drills into a project" } ], [ { "label": "Asks the do-nothing case" } ], [ { "label": "Compares three options" }, { "label": "Approves option 2" } ], [ { "label": "Checks a week later" } ] ] }, { "title": "Touchpoint", "kind": "touch", "cells": [ [ { "label": "Brief card" } ], [ { "label": "Copilot thread" } ], [ { "label": "Scenario panel" } ], [ { "label": "Decision card" } ], [ { "label": "Outcome tile" } ] ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Detection sweep", "icon": "fa5_binoculars" } ], [ { "label": "Orchestrator + tools" } ], [ { "label": "Forecast endpoint" } ], [ { "label": "Decision record", "icon": "fa5_gavel" } ], [ { "label": "Outcome monitor", "icon": "fa5_heartbeat" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Confident", "Neutral", "Exposed" ], "points": [ 2, 1, 1, 0, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "Is this all of it?" } ], [ { "label": "Differs from board pack" } ], [ { "label": "Confidence with no basis" } ], [ { "label": "Cannot defend it" } ], [ { "label": "Nobody closed the loop" } ] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [ { "label": "Coverage stated" } ], [ { "label": "One measure definition" } ], [ { "label": "Interval, not adjectives" } ], [ { "label": "Evidence pack per claim" } ], [ { "label": "Outcome reopens it" } ] ] } ], "chain": true, "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "05-journey-tenant-onboarding", "title": "Journey — Implementation Lead, Onboarding a Tenant", "layout": "journey", "canvas": { "width": 1760 }, "cellWidth": 232, "actor": { "label": "Implementation lead", "sub": "delivery partner", "goal": "A new organisation live in six weeks with no product code forked", "trigger": "Contract signed; the sovereignty tier is set", "success": "The CXO's first brief is right on day one" }, "phases": [ { "title": "Provision", "sub": "day 1–3" }, { "title": "Connect", "sub": "week 1–2" }, { "title": "Map to canon", "sub": "week 2–4", "moment": true }, { "title": "Configure", "sub": "week 4–5" }, { "title": "Prove", "sub": "week 6", "moment": true } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Picks isolation tier" }, { "label": "Runs the tenant pipeline" } ], [ { "label": "Registers 6 sources" } ], [ { "label": "Maps fields to canon" }, { "label": "Reconciles to the board pack" } ], [ { "label": "Loads an industry pack" }, { "label": "Sets approval limits" } ], [ { "label": "Runs the scenario suite" } ] ] }, { "title": "Touchpoint", "kind": "touch", "cells": [ [ { "label": "Tenant console" } ], [ { "label": "Source registry" } ], [ { "label": "Mapping workbench" } ], [ { "label": "Config studio" } ], [ { "label": "Evaluation report" } ] ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Terraform + Helm" } ], [ { "label": "Airflow + Debezium" } ], [ { "label": "Canonical model + graph" } ], [ { "label": "Versioned config artifacts" } ], [ { "label": "Golden-question harness" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "In control", "Working", "Sinking" ], "points": [ 2, 1, 0, 1, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "Which tier did they buy?" } ], [ { "label": "No read API on the old ERP" } ], [ { "label": "Their cost centre is not ours" } ], [ { "label": "Every tenant wants a tweak" } ], [ { "label": "Right answer, wrong wording" } ] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [ { "label": "Tier is a deployment parameter" } ], [ { "label": "CDC and file drop both allowed" } ], [ { "label": "Mapping is config, not a fork" } ], [ { "label": "Config schema is versioned" } ], [ { "label": "Eval gate blocks go-live" } ] ] } ], "chain": true, "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "06-journey-governance-audit", "title": "Journey — Governance Officer, Reconstructing a Decision", "layout": "journey", "canvas": { "width": 1600 }, "cellWidth": 250, "actor": { "label": "Governance officer", "sub": "risk and compliance", "goal": "Show the regulator how a decision that moved money was reached", "trigger": "An audit request naming a decision from four months ago", "success": "A reconstructable chain from question to executed action" }, "phases": [ { "title": "Locate", "sub": "find the decision" }, { "title": "Reconstruct", "sub": "who saw what" }, { "title": "Verify", "sub": "were the numbers right?", "moment": true }, { "title": "Attest", "sub": "sign the pack", "moment": true } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Searches by amount and date" } ], [ { "label": "Reads the question and plan" }, { "label": "Opens every tool call" } ], [ { "label": "Re-runs the KPI as-of" } ], [ { "label": "Exports the evidence pack" } ] ] }, { "title": "Touchpoint", "kind": "touch", "cells": [ [ { "label": "Governance centre" } ], [ { "label": "Decision timeline" } ], [ { "label": "Evidence viewer" } ], [ { "label": "Signed export" } ] ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Decision store index", "icon": "fa5_gavel" } ], [ { "label": "Trace + audit log" } ], [ { "label": "As-of semantic query" } ], [ { "label": "Object lock + hash chain" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Defensible", "Workable", "Indefensible" ], "points": [ 1, 1, 0, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "Chat logs are not a record" } ], [ { "label": "Which model version was it?" } ], [ { "label": "Recomputed number has moved" } ], [ { "label": "Export is just a screenshot" } ] ] }, { "title": "What answers it", "kind": "gain", "cells": [ [ { "label": "Decision is the record, chat is a view" } ], [ { "label": "Model and prompt version pinned" } ], [ { "label": "Evidence snapshot, not a re-run" } ], [ { "label": "Hash-chained, WORM retained" } ] ] } ], "chain": true, "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "07-layered-architecture", "title": "Layered Architecture — What Depends on What", "layout": "bands", "canvas": { "width": 1780 }, "layerHeaderWidth": 168, "bands": [ { "name": "Experience", "nodes": [ { "id": "l-teams", "label": "Mattermost app", "kind": "app", "sub": "brief · approve", "icon": "fa5_comments" }, { "id": "l-web", "label": "Executive web", "kind": "app", "sub": "React on Kubernetes", "icon": "react" }, { "id": "l-mob", "label": "Mobile", "kind": "app", "sub": "MDM managed" }, { "id": "l-adm", "label": "Tenant console", "kind": "app", "sub": "config, not code" } ] }, { "name": "Edge and API", "nodes": [ { "id": "l-afd", "label": "HAProxy + WAF", "kind": "integration", "sub": "TLS 1.3 · rate limit", "icon": "haproxy" }, { "id": "l-apim", "label": "Kong Gateway", "kind": "integration", "sub": "per-tenant quota" }, { "id": "l-bff", "label": "Experience API", "kind": "integration", "sub": "one contract per surface", "icon": "fa5_code" } ] }, { "name": "Orchestration", "nodes": [ { "id": "l-orch", "label": "Executive Orchestrator", "kind": "app", "sub": "intent · plan · compose", "icon": "agent" }, { "id": "l-agents", "label": "Specialist agents", "kind": "app", "sub": "finance · risk · projects", "icon": "agent" }, { "id": "l-dec", "label": "Decision engine", "kind": "app", "sub": "situation to options", "icon": "fa5_balance_scale" }, { "id": "l-run", "label": "Investigation runner", "kind": "app", "sub": "Temporal", "icon": "fa5_microscope" }, { "id": "l-state", "label": "Conversation state", "kind": "store", "sub": "Redis · 24 h" } ] }, { "name": "Grounding", "nodes": [ { "id": "l-tool", "label": "Tool plane", "kind": "integration", "sub": "MCP servers · typed", "icon": "fa5_plug" }, { "id": "l-retr", "label": "Retrieval service", "kind": "app", "sub": "hybrid + trimming", "icon": "fa5_search" }, { "id": "l-metric", "label": "Metric service", "kind": "app", "sub": "the only KPI path", "icon": "fa5_calculator" }, { "id": "l-pred", "label": "Prediction service", "kind": "app", "sub": "forecast · anomaly", "icon": "fa5_chart_line" }, { "id": "l-guard", "label": "Guardrail service", "kind": "security", "sub": "ground · abstain", "icon": "fa5_shield_alt" } ] }, { "name": "AI platform", "nodes": [ { "id": "l-aoai", "label": "vLLM serving", "kind": "app", "sub": "reasoning · routing · embed" }, { "id": "l-foundry", "label": "LangGraph + Langfuse", "kind": "platform", "sub": "agents · evals · tracing" }, { "id": "l-search", "label": "OpenSearch", "kind": "store", "sub": "vector + BM25" }, { "id": "l-safety", "label": "Llama Guard + NeMo", "kind": "security", "sub": "shields · groundedness", "icon": "fa5_shield_alt" }, { "id": "l-reg", "label": "Prompt registry", "kind": "store", "sub": "versioned · pinned", "icon": "fa5_file_alt" } ] }, { "name": "Data and analytics", "nodes": [ { "id": "l-lake", "label": "MinIO object store", "kind": "store", "sub": "medallion" }, { "id": "l-wh", "label": "Trino + Iceberg", "kind": "store", "sub": "canonical model" }, { "id": "l-sem", "label": "Semantic model", "kind": "store", "sub": "Cube measures", "icon": "fa5_calculator" }, { "id": "l-kg", "label": "Entity graph", "kind": "store", "sub": "Neo4j", "icon": "fa5_project_diagram" }, { "id": "l-aml", "label": "MLflow + KServe", "kind": "app", "sub": "registered endpoints" }, { "id": "l-rti", "label": "Kafka Streams", "kind": "store", "sub": "signal streams" } ] }, { "name": "Integration", "nodes": [ { "id": "l-adf", "label": "Airflow + dbt", "kind": "integration", "sub": "batch + CDC" }, { "id": "l-eh", "label": "Kafka", "kind": "queue", "sub": "events in" }, { "id": "l-sb", "label": "Action queue", "kind": "queue", "sub": "Temporal sagas", "icon": "temporal" }, { "id": "l-la", "label": "Camunda 8", "kind": "integration", "sub": "execution plane" }, { "id": "l-conn", "label": "Connector identities", "kind": "security", "sub": "one per system" } ] }, { "name": "Cross-cutting", "accent": "#e1d5e7", "nodes": [ { "id": "l-entra", "label": "Keycloak", "kind": "security", "sub": "token exchange · JIT" }, { "id": "l-kv", "label": "Vault + HSM", "kind": "security", "sub": "per-tenant key" }, { "id": "l-purv", "label": "OpenMetadata", "kind": "platform", "sub": "catalogue · lineage" }, { "id": "l-mon", "label": "Prometheus + Grafana", "kind": "platform", "sub": "traces · cost" }, { "id": "l-def", "label": "Falco + OpenSearch", "kind": "security", "sub": "posture · SIEM", "icon": "fa5_shield_virus" }, { "id": "l-pol", "label": "OPA Gatekeeper", "kind": "platform", "sub": "admission guardrails" } ] } ], "edges": [ { "from": "l-bff", "to": "l-orch", "label": "one call per turn" }, { "from": "l-orch", "to": "l-tool", "label": "MCP tool call" }, { "from": "l-metric", "to": "l-sem", "label": "Cube only" }, { "from": "l-retr", "to": "l-search", "label": "filtered query" }, { "from": "l-la", "to": "l-dec", "label": "outcome callback", "kind": "async", "route": "gutter" } ], "note": "Dependencies point down. The one upward arrow is the execution plane reporting an outcome, and it is asynchronous by design.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "08-container-architecture", "title": "Container Architecture — Deployable Units in One Tenant", "layout": "nested", "canvas": { "width": 1800 }, "boxes": [ { "title": "Primary data centre — one tenant runtime, in country", "kind": "onprem", "dir": "col", "children": [ { "title": "Edge", "kind": "boundary", "nodes": [ { "id": "c-afd", "label": "HAProxy + WAF", "kind": "integration", "sub": "active / active", "icon": "haproxy" }, { "id": "c-apim", "label": "Kong Gateway", "kind": "integration", "sub": "internal only" }, { "id": "c-bot", "label": "Mattermost bot", "kind": "integration", "sub": "webhook service", "icon": "fa5_comments" } ] }, { "title": "Application plane — Kubernetes namespace per tenant", "kind": "boundary", "nodes": [ { "id": "c-api", "label": "Experience API", "kind": "app", "sub": "FastAPI · 3–30 pods", "icon": "fa5_code" }, { "id": "c-orch", "label": "Orchestrator host", "kind": "app", "sub": "LangGraph", "icon": "agent" }, { "id": "c-mcp", "label": "MCP tool servers", "kind": "integration", "sub": "one per domain", "icon": "fa5_plug" }, { "id": "c-dec", "label": "Decision service", "kind": "app", "sub": "option sets", "icon": "fa5_balance_scale" }, { "id": "c-run", "label": "Investigation runner", "kind": "app", "sub": "Temporal worker", "icon": "fa5_microscope" }, { "id": "c-cfg", "label": "Config service", "kind": "app", "sub": "tenant packs", "icon": "fa5_sliders_h" }, { "id": "c-gov", "label": "Governance API", "kind": "app", "sub": "audit export", "icon": "fa5_file_contract" } ] }, { "title": "AI plane — GPU node pool, no egress", "kind": "boundary", "nodes": [ { "id": "c-aoai", "label": "vLLM inference", "kind": "app", "sub": "Llama 3.3 70B" }, { "id": "c-agent", "label": "Agent runtime", "kind": "app", "sub": "LangGraph + MCP", "icon": "agent" }, { "id": "c-srch", "label": "OpenSearch", "kind": "store", "sub": "3 data nodes" }, { "id": "c-safe", "label": "Guardrail service", "kind": "security", "sub": "Llama Guard 3", "icon": "fa5_shield_alt" }, { "id": "c-aml", "label": "KServe endpoints", "kind": "app", "sub": "forecast · anomaly", "icon": "fa5_chart_line" } ] }, { "title": "Data plane", "kind": "boundary", "nodes": [ { "id": "c-fab", "label": "Trino + Spark", "kind": "store", "sub": "MinIO + Iceberg" }, { "id": "c-sem", "label": "Semantic model", "kind": "store", "sub": "Cube · row policies", "icon": "fa5_calculator" }, { "id": "c-cos", "label": "Neo4j", "kind": "store", "sub": "causal cluster" }, { "id": "c-sql", "label": "PostgreSQL", "kind": "store", "sub": "decision store" }, { "id": "c-redis", "label": "Redis", "kind": "store", "sub": "state · semantic cache" }, { "id": "c-blob", "label": "Evidence store", "kind": "store", "sub": "MinIO · object lock", "icon": "fa5_archive" } ] }, { "title": "Integration and execution", "kind": "boundary", "nodes": [ { "id": "c-adf", "label": "Airflow", "kind": "integration", "sub": "pipelines", "icon": "airflow" }, { "id": "c-es", "label": "Kafka", "kind": "queue", "sub": "ingest" }, { "id": "c-sb", "label": "Temporal", "kind": "queue", "sub": "action sagas" }, { "id": "c-la", "label": "Camunda 8", "kind": "integration", "sub": "execution plane" }, { "id": "c-shir", "label": "Edge collector", "kind": "integration", "sub": "DMZ reach", "icon": "fa5_plug" } ] }, { "title": "Platform services", "kind": "trust", "nodes": [ { "id": "c-entra", "label": "Keycloak", "kind": "security", "sub": "token exchange" }, { "id": "c-kv", "label": "Vault + HSM", "kind": "security", "sub": "tenant key" }, { "id": "c-purv", "label": "OpenMetadata", "kind": "platform", "sub": "lineage" }, { "id": "c-mon", "label": "Prometheus", "kind": "platform", "sub": "Grafana · Loki · Tempo" }, { "id": "c-sent", "label": "OpenSearch SIEM", "kind": "security", "sub": "SIEM" } ] } ] } ], "outside": [ { "id": "c-erp", "label": "ERP and finance", "kind": "external", "icon": "fa5_server" }, { "id": "c-proc", "label": "Procurement", "kind": "external", "icon": "fa5_server" }, { "id": "c-ppm", "label": "Projects", "kind": "external", "icon": "fa5_server" }, { "id": "c-doc", "label": "Document estate", "kind": "external", "icon": "fa5_folder_open" }, { "id": "c-m365", "label": "Mail and calendar", "kind": "external", "icon": "fa5_envelope" } ], "edges": [ { "from": "c-apim", "to": "c-api", "label": "mTLS" }, { "from": "c-orch", "to": "c-aoai", "label": "in-cluster mTLS" }, { "from": "c-la", "to": "c-proc", "label": "approved write", "route": "gutter" }, { "from": "c-adf", "to": "c-erp", "label": "CDC pull", "kind": "batch", "route": "gutter" }, { "from": "c-mcp", "to": "c-sem", "label": "as the caller", "route": "gutter" } ], "note": "Pooled-tier tenants share the AI and data planes with a per-tenant index, schema and row policy. The siloed tier deploys this whole picture on its own cluster — view 10.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "09-integration-catalogue", "title": "Integration Catalogue — Every Interface In and Out", "layout": "hub", "canvas": { "width": 1720 }, "left": { "title": "Consumers", "nodes": [ { "id": "i-teams", "label": "Mattermost app", "kind": "app", "rel": "bot API", "icon": "fa5_comments" }, { "id": "i-web", "label": "Executive web", "kind": "app", "rel": "HTTPS · SSE", "icon": "react" }, { "id": "i-adm", "label": "Tenant console", "kind": "app", "rel": "admin API" }, { "id": "i-exp", "label": "Audit export", "kind": "external", "rel": "signed", "kind2": "batch" }, { "id": "i-pbi", "label": "Superset", "kind": "external", "rel": "same measures" } ] }, "centre": { "title": "Integration layer", "nodes": [ { "id": "i-apim", "label": "Kong Gateway", "kind": "integration", "sub": "north–south" }, { "id": "i-adf", "label": "Airflow + dbt", "kind": "integration", "sub": "batch + CDC" }, { "id": "i-es", "label": "Kafka", "kind": "queue", "sub": "event in" }, { "id": "i-la", "label": "Camunda + Camel", "kind": "integration", "sub": "action out" }, { "id": "i-shir", "label": "Edge collector", "kind": "integration", "sub": "DMZ reach", "icon": "fa5_plug" } ] }, "right": { "title": "Source and target systems", "nodes": [ { "id": "i-erp", "label": "ERP and finance", "kind": "external", "rel": "OData CDC", "dir": "out", "kind2": "batch", "icon": "fa5_server" }, { "id": "i-proc", "label": "Procurement", "kind": "external", "rel": "REST r/w", "dir": "out", "icon": "fa5_server" }, { "id": "i-ppm", "label": "Projects", "kind": "external", "rel": "REST hourly", "dir": "out", "kind2": "batch", "icon": "fa5_server" }, { "id": "i-hr", "label": "HR and CRM", "kind": "external", "rel": "nightly", "dir": "out", "kind2": "batch", "icon": "fa5_server" }, { "id": "i-scm", "label": "Supply chain", "kind": "external", "rel": "events", "dir": "out", "kind2": "async", "icon": "fa5_truck" }, { "id": "i-doc", "label": "Document estate", "kind": "external", "rel": "delta crawl", "dir": "out", "kind2": "batch", "icon": "fa5_folder_open" }, { "id": "i-wf", "label": "Workflow engine", "kind": "external", "rel": "approved", "dir": "out", "icon": "fa5_sitemap" }, { "id": "i-notif", "label": "Chat and email", "kind": "external", "rel": "SMTP · webhook", "dir": "out", "kind2": "async", "icon": "fa5_comments" } ] }, "note": "Fourteen interfaces, four cadences. Mobile shares the web contract; the existing lake is registered as an external Iceberg catalogue rather than copied. Only procurement and the workflow engine are written to, and only after an approval.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "10-multi-tenancy-and-isolation", "title": "Multi-Tenancy — Isolation as a Purchased Tier", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Shared control plane — never holds tenant business data", "kind": "boundary", "nodes": [ { "id": "t-reg", "label": "Tenant registry", "kind": "store", "sub": "tier · site · keys", "icon": "fa5_address-book" }, { "id": "t-cfg", "label": "Config service", "kind": "app", "sub": "versioned packs", "icon": "fa5_sliders_h" }, { "id": "t-onb", "label": "Onboarding pipeline", "kind": "app", "sub": "Terraform + Argo CD" }, { "id": "t-cat", "label": "Industry packs", "kind": "store", "sub": "gov · bank · energy", "icon": "fa5_boxes" }, { "id": "t-obs", "label": "Platform telemetry", "kind": "platform", "sub": "metadata only" } ] }, { "title": "Pooled tier — shared runtime, logical isolation", "kind": "onprem", "dir": "row", "children": [ { "title": "Shared compute and AI", "kind": "boundary", "nodes": [ { "id": "p-aca", "label": "Shared namespace", "kind": "app", "sub": "tenant claim per request", "icon": "kubernetes" }, { "id": "p-aoai", "label": "vLLM pool", "kind": "app", "sub": "per-tenant quota" }, { "id": "p-srch", "label": "OpenSearch", "kind": "store", "sub": "index per tenant" } ] }, { "title": "Shared data, separated", "kind": "boundary", "nodes": [ { "id": "p-sql", "label": "PostgreSQL cluster", "kind": "store", "sub": "RLS + tenant key" }, { "id": "p-fab", "label": "Trino + Iceberg", "kind": "store", "sub": "schema per tenant" }, { "id": "p-blob", "label": "Evidence store", "kind": "store", "sub": "container per tenant", "icon": "fa5_archive" } ] } ] }, { "title": "Siloed tier — sovereign, dedicated deployment", "kind": "trust", "dir": "row", "children": [ { "title": "Dedicated runtime", "kind": "boundary", "nodes": [ { "id": "s-aca", "label": "Dedicated cluster", "kind": "app", "sub": "one per tenant", "icon": "kubernetes" }, { "id": "s-aoai", "label": "vLLM deployment", "kind": "app", "sub": "dedicated GPUs" }, { "id": "s-srch", "label": "OpenSearch cluster", "kind": "store", "sub": "dedicated", "icon": "opensearch" } ] }, { "title": "Dedicated data and keys", "kind": "boundary", "nodes": [ { "id": "s-sql", "label": "PostgreSQL", "kind": "store", "sub": "dedicated cluster" }, { "id": "s-fab", "label": "Trino + Iceberg", "kind": "store", "sub": "dedicated compute" }, { "id": "s-kv", "label": "Vault + HSM", "kind": "security", "sub": "customer-held key" } ] } ] } ], "outside": [ { "id": "t-a", "label": "Ministry A", "kind": "external", "sub": "siloed" }, { "id": "t-b", "label": "Bank B", "kind": "external", "sub": "siloed" }, { "id": "t-c", "label": "Group C", "kind": "external", "sub": "pooled" }, { "id": "t-risk", "label": "Shared index is the leak path", "kind": "risk", "sub": "filter is mandatory, tested per release" } ], "edges": [ { "from": "t-reg", "to": "p-aca", "label": "tier lookup" }, { "from": "t-onb", "to": "s-aca", "label": "deploys the same packs", "kind": "batch" } ], "note": "One codebase, two deployment shapes. A tenant moves tier by re-running the onboarding pipeline against a new cluster, not by forking the product.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "11-data-architecture-zones", "title": "Data Architecture — Zones by Ownership and Rebuildability", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Analytical estate — every zone below is rebuildable from the one above it", "kind": "onprem", "dir": "col", "children": [ { "title": "Bronze — landed as received, never edited", "kind": "boundary", "nodes": [ { "id": "z-ext", "label": "Source extracts", "kind": "store", "sub": "Iceberg · 90 d" }, { "id": "z-cdc", "label": "CDC feeds", "kind": "store", "sub": "append-only" }, { "id": "z-docs", "label": "Document originals", "kind": "store", "sub": "hash on land" }, { "id": "z-evt", "label": "Event archive", "kind": "store", "sub": "replayable" } ] }, { "title": "Silver — conformed to the canonical model", "kind": "boundary", "nodes": [ { "id": "z-ent", "label": "Conformed entities", "kind": "store", "sub": "canonical keys" }, { "id": "z-mdm", "label": "Resolved master", "kind": "store", "sub": "supplier · project" }, { "id": "z-chunk", "label": "Document chunks", "kind": "store", "sub": "ACL carried through" }, { "id": "z-ts", "label": "Time series", "kind": "store", "sub": "KPI history", "icon": "fa5_chart_line" } ] }, { "title": "Gold — serving, and only serving", "kind": "boundary", "nodes": [ { "id": "z-wh", "label": "Canonical warehouse", "kind": "store", "sub": "star schema", "icon": "fa5_warehouse" }, { "id": "z-sem", "label": "Semantic model", "kind": "store", "sub": "one KPI definition", "icon": "fa5_calculator" }, { "id": "z-idx", "label": "Search index", "kind": "store", "sub": "vector + ACL fields" }, { "id": "z-kg", "label": "Entity graph", "kind": "store", "sub": "cross-domain joins", "icon": "fa5_project_diagram" }, { "id": "z-feat", "label": "Feature store", "kind": "store", "sub": "model inputs" } ] } ] }, { "title": "Operational estate — the platform's own system of record, rebuildable from nothing", "kind": "trust", "nodes": [ { "id": "z-dec", "label": "Decision store", "kind": "store", "sub": "RPO 5 min · WAL ship", "icon": "fa5_gavel" }, { "id": "z-act", "label": "Action proposals", "kind": "store", "sub": "state machine" }, { "id": "z-aud", "label": "Audit and lineage", "kind": "store", "sub": "WORM · 10 y", "icon": "fa5_file_contract" }, { "id": "z-ev", "label": "Evidence snapshots", "kind": "store", "sub": "object lock", "icon": "fa5_camera" }, { "id": "z-cfg", "label": "Tenant config", "kind": "store", "sub": "versioned · in Git", "icon": "fa5_sliders_h" } ] } ], "outside": [ { "id": "z-src", "label": "Source systems", "kind": "external", "sub": "truth for the business", "icon": "fa5_server" }, { "id": "z-risk", "label": "Lose the decision store and the audit trail is gone", "kind": "risk", "sub": "the only zone with a real RPO" } ], "edges": [ { "from": "z-src", "to": "z-ext", "label": "extract", "kind": "batch" }, { "from": "z-sem", "to": "z-ev", "label": "as-of snapshot", "route": "gutter" } ], "note": "Gold is a cache with a rebuild script. The operational estate is not: it is what the regulator reads, so it carries the backup, the retention and the RPO.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "12-data-flow", "title": "Data Flow — Source to Answer, with Cadence", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Sources", "nodes": [ { "id": "f-erp", "label": "ERP", "kind": "external", "sub": "tables + OData", "icon": "fa5_server" }, { "id": "f-proc", "label": "Procurement", "kind": "external", "sub": "REST", "icon": "fa5_server" }, { "id": "f-ppm", "label": "Projects", "kind": "external", "sub": "REST", "icon": "fa5_server" }, { "id": "f-doc", "label": "Documents", "kind": "external", "sub": "file shares", "icon": "fa5_folder_open" }, { "id": "f-scm", "label": "Supply chain", "kind": "external", "sub": "events", "icon": "fa5_truck" } ] }, { "title": "Ingest", "nodes": [ { "id": "f-cdc", "label": "CDC pull", "kind": "integration", "sub": "15 min" }, { "id": "f-batch", "label": "Scheduled copy", "kind": "integration", "sub": "nightly" }, { "id": "f-stream", "label": "Kafka", "kind": "queue", "sub": "seconds" }, { "id": "f-crawl", "label": "Document crawl", "kind": "integration", "sub": "delta · 4 h" } ] }, { "title": "Land", "nodes": [ { "id": "f-bronze", "label": "Bronze", "kind": "store", "sub": "as received" }, { "id": "f-qual", "label": "Quality gate", "kind": "decision", "sub": "row count · schema" }, { "id": "f-quar", "label": "Quarantine", "kind": "risk", "sub": "flagged, not dropped" } ] }, { "title": "Conform", "nodes": [ { "id": "f-map", "label": "Canonical mapping", "kind": "app", "sub": "tenant config" }, { "id": "f-mdm", "label": "Entity resolution", "kind": "app", "sub": "supplier · project", "icon": "fa5_object_group" }, { "id": "f-silver", "label": "Silver", "kind": "store", "sub": "conformed" } ] }, { "title": "Serve", "nodes": [ { "id": "f-wh", "label": "Warehouse", "kind": "store", "sub": "star schema" }, { "id": "f-sem", "label": "Semantic model", "kind": "store", "sub": "measures", "icon": "fa5_calculator" }, { "id": "f-idx", "label": "Search index", "kind": "store", "sub": "+ ACL" }, { "id": "f-kg", "label": "Entity graph", "kind": "store", "sub": "edges", "icon": "fa5_project_diagram" }, { "id": "f-fresh", "label": "Freshness register", "kind": "platform", "sub": "per source", "icon": "fa5_clock" } ] }, { "title": "Consume", "nodes": [ { "id": "f-tool", "label": "Tool plane", "kind": "integration", "sub": "MCP · typed reads", "icon": "fa5_plug" }, { "id": "f-det", "label": "Detection sweep", "kind": "app", "sub": "hourly", "icon": "fa5_binoculars" }, { "id": "f-pbi", "label": "Superset", "kind": "external", "sub": "same measures" } ] } ], "edges": [ { "from": "f-qual", "to": "f-quar", "label": "fails", "kind": "error" }, { "from": "f-fresh", "to": "f-tool", "label": "staleness on every answer", "route": "gutter" } ], "note": "No source is real-time by default. Each declares a freshness contract, and the answer states which one it used.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "13-canonical-data-model", "title": "Canonical Data Model — The Entities Every Agent Shares", "layout": "er", "canvas": { "width": 1780, "cols": 4 }, "rowGap": 236, "entities": [ { "id": "org", "name": "organisation", "row": 0, "col": 0, "attrs": [ "org_id PK", "tenant_id FK", "legal_name", "sovereignty_tier" ] }, { "id": "bu", "name": "business_unit", "row": 0, "col": 1, "attrs": [ "bu_id PK", "org_id FK", "parent_bu_id FK", "cost_centre" ] }, { "id": "acct", "name": "financial_account", "row": 0, "col": 2, "attrs": [ "account_id PK", "bu_id FK", "account_type", "currency" ] }, { "id": "kpidef", "name": "kpi_definition", "row": 0, "col": 3, "attrs": [ "kpi_id PK", "measure_expression", "owner_role", "version" ] }, { "id": "proj", "name": "project", "row": 1, "col": 2, "attrs": [ "project_id PK", "bu_id FK", "baseline_finish", "forecast_finish" ] }, { "id": "sup", "name": "supplier", "row": 1, "col": 0, "attrs": [ "supplier_id PK", "org_id FK", "risk_grade", "source_keys[]" ] }, { "id": "po", "name": "purchase_order", "row": 1, "col": 1, "attrs": [ "po_id PK", "supplier_id FK", "project_id FK", "value · currency" ] }, { "id": "kpifact", "name": "kpi_fact", "row": 1, "col": 3, "attrs": [ "kpi_id FK", "grain_key", "as_of_date", "value" ] }, { "id": "ctr", "name": "contract", "row": 2, "col": 0, "attrs": [ "contract_id PK", "supplier_id FK", "expiry_date", "document_ref" ] }, { "id": "risk", "name": "risk", "row": 2, "col": 1, "attrs": [ "risk_id PK", "subject_type", "subject_id", "severity · likelihood" ] }, { "id": "dec", "name": "decision", "kind": "app", "row": 2, "col": 2, "attrs": [ "decision_id PK", "situation_id FK", "approver_sub", "state · as_of" ] }, { "id": "evid", "name": "evidence", "kind": "app", "row": 2, "col": 3, "attrs": [ "evidence_id PK", "decision_id FK", "source · query", "snapshot_uri" ] }, { "id": "act", "name": "action", "kind": "app", "row": 3, "col": 1, "attrs": [ "action_id PK", "decision_id FK", "target_system", "state · external_ref" ] }, { "id": "out", "name": "outcome", "kind": "app", "row": 3, "col": 2, "attrs": [ "outcome_id PK", "action_id FK", "kpi_id FK", "verdict · measured_at" ] } ], "relations": [ { "from": "org", "to": "bu", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "bu", "to": "acct", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "org", "to": "sup", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "bu", "to": "proj", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "sup", "to": "po", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "proj", "to": "po", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "sup", "to": "ctr", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "kpidef", "to": "kpifact", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "proj", "to": "risk", "label": "1 : N", "kind": "optional", "from_side": "s", "to_side": "n" }, { "from": "risk", "to": "dec", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "dec", "to": "evid", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "dec", "to": "act", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "act", "to": "out", "label": "1 : 1", "from_side": "e", "to_side": "w" } ], "note": "The four blue entities are the platform's own. Everything else is a conformed projection of a source system, keyed by source_keys[] so a merge is reversible.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "14-knowledge-and-rag-pipeline", "title": "Enterprise Knowledge — Ingest to Cited Answer", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Sources", "nodes": [ { "id": "r-sp", "label": "File shares", "kind": "external", "sub": "policies · minutes", "icon": "fa5_folder_open" }, { "id": "r-blob", "label": "Contract store", "kind": "external", "sub": "PDF", "icon": "fa5_file_contract" }, { "id": "r-board", "label": "Board papers", "kind": "external", "sub": "restricted", "icon": "fa5_file_alt" }, { "id": "r-reg", "label": "Regulations", "kind": "external", "sub": "external" } ] }, { "title": "Ingest and classify", "nodes": [ { "id": "r-crawl", "label": "Delta crawl", "kind": "integration", "sub": "WebDAV · 4 h" }, { "id": "r-di", "label": "Docling + OCR", "kind": "app", "sub": "layout · tables", "icon": "fa5_file_alt" }, { "id": "r-cls", "label": "Classification", "kind": "security", "sub": "label + sensitivity", "icon": "fa5_tags" }, { "id": "r-acl", "label": "ACL capture", "kind": "security", "sub": "source permissions" } ] }, { "title": "Chunk and enrich", "nodes": [ { "id": "r-chunk", "label": "Structure-aware chunking", "kind": "app", "sub": "per content type" }, { "id": "r-meta", "label": "Entity tagging", "kind": "app", "sub": "links to canon" }, { "id": "r-embed", "label": "Embedding", "kind": "app", "sub": "BGE-M3 on TEI" } ] }, { "title": "Index", "nodes": [ { "id": "r-idx", "label": "OpenSearch index", "kind": "store", "sub": "vector + BM25" }, { "id": "r-sec", "label": "Security fields", "kind": "security", "sub": "group ids per chunk" }, { "id": "r-ver", "label": "Version and expiry", "kind": "platform", "sub": "supersede, not delete" } ] }, { "title": "Retrieve", "nodes": [ { "id": "r-filter", "label": "Security filter", "kind": "security", "sub": "before scoring" }, { "id": "r-hyb", "label": "Hybrid query", "kind": "app", "sub": "RRF fusion" }, { "id": "r-rank", "label": "Cross-encoder rerank", "kind": "app", "sub": "top 50 → 8", "icon": "fa5_sort" } ] }, { "title": "Ground and cite", "nodes": [ { "id": "r-bind", "label": "Claim binding", "kind": "app", "sub": "evidence id per claim" }, { "id": "r-grd", "label": "Groundedness check", "kind": "security", "sub": "NLI verifier" }, { "id": "r-abs", "label": "Abstain", "kind": "risk", "sub": "no evidence, no answer", "icon": "fa5_hand_paper" } ] } ], "edges": [ { "from": "r-grd", "to": "r-abs", "label": "unsupported claim", "kind": "error" }, { "from": "r-acl", "to": "r-sec", "label": "ACL carried", "kind": "batch", "route": "gutter" } ], "note": "The filter runs inside the query, before scoring. Filtering after retrieval leaks nothing but silently returns the wrong top-k.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "15-question-to-answer-sequence", "title": "Critical Flow — One Executive Question, End to End", "layout": "sequence", "canvas": { "width": 1720 }, "lifelines": [ { "id": "q-cxo", "label": "CXO", "kind": "actor" }, { "id": "q-api", "label": "Experience API", "kind": "integration", "icon": "fa5_code" }, { "id": "q-orch", "label": "Orchestrator", "kind": "app", "icon": "agent" }, { "id": "q-tool", "label": "MCP tool plane", "kind": "integration", "icon": "fa5_plug" }, { "id": "q-metric", "label": "Metric service", "kind": "app", "icon": "fa5_calculator" }, { "id": "q-retr", "label": "Retrieval", "kind": "app", "icon": "fa5_search" }, { "id": "q-llm", "label": "vLLM", "kind": "app" }, { "id": "q-grd", "label": "Guardrail", "kind": "security", "icon": "fa5_shield_alt" } ], "messages": [ { "from": "q-cxo", "to": "q-api", "label": "\"What is our cash position, and what puts it at risk?\"", "kind": "call" }, { "from": "q-api", "to": "q-api", "label": "validate token · resolve tenant", "kind": "self" }, { "from": "q-api", "to": "q-orch", "label": "turn + on-behalf-of assertion", "kind": "call" }, { "from": "q-orch", "to": "q-llm", "label": "classify and plan", "kind": "call" }, { "from": "q-llm", "to": "q-orch", "label": "plan: 1 metric, 1 search", "kind": "return" }, { "from": "q-orch", "to": "q-tool", "label": "get_cash_position(as_of)", "kind": "call" }, { "from": "q-tool", "to": "q-tool", "label": "check scope · freshness", "kind": "self" }, { "from": "q-tool", "to": "q-metric", "label": "Cube measure, as the caller", "kind": "call" }, { "from": "q-metric", "to": "q-tool", "label": "value · as-of · lineage", "kind": "return" }, { "from": "q-tool", "to": "q-orch", "label": "typed result + evidence id", "kind": "return" }, { "from": "q-orch", "to": "q-tool", "label": "search_risk_notes(topic)", "kind": "call" }, { "from": "q-tool", "to": "q-retr", "label": "hybrid query, security filter", "kind": "call" }, { "from": "q-retr", "to": "q-tool", "label": "6 passages the caller may read", "kind": "return" }, { "from": "q-tool", "to": "q-orch", "label": "passages + evidence ids", "kind": "return" }, { "from": "q-orch", "to": "q-llm", "label": "compose from evidence only", "kind": "call" }, { "from": "q-llm", "to": "q-orch", "label": "draft + claim-to-evidence map", "kind": "return" }, { "from": "q-orch", "to": "q-grd", "label": "verify every claim", "kind": "call" }, { "from": "q-grd", "to": "q-orch", "label": "one claim unsupported", "kind": "error" }, { "from": "q-orch", "to": "q-orch", "label": "drop claim · record the gap", "kind": "self" }, { "from": "q-orch", "to": "q-api", "label": "answer · citations · freshness", "kind": "return" }, { "from": "q-api", "to": "q-cxo", "label": "answer, every number traceable", "kind": "return" } ], "note": "Target: p95 under 5 s for this shape. The model is called twice and touches no data source; the tool plane carries the caller's identity into every read.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "16-agent-orchestration", "title": "Agent Orchestration — Who Does What in a Turn", "layout": "swimlane", "canvas": { "width": 1780 }, "laneHeaderWidth": 168, "stages": [ "Interpret", "Plan", "Ground", "Compute", "Compose", "Verify" ], "lanes": [ { "title": "Executive Orchestrator", "cells": [ [ { "id": "o-int", "label": "Classify intent", "kind": "app", "sub": "small model" }, { "label": "Resolve entities", "kind": "app", "sub": "against canon" } ], [ { "id": "o-plan", "label": "Select capabilities", "kind": "app" }, { "label": "Set budget", "kind": "app", "sub": "tokens · tools · time" } ], [], [], [ { "id": "o-merge", "label": "Merge agent results", "kind": "app" } ], [ { "id": "o-emit", "label": "Answer or abstain", "kind": "decision" } ] ] }, { "title": "Specialist agents", "cells": [ [], [ { "label": "Finance agent", "kind": "app", "icon": "agent" }, { "label": "Projects agent", "kind": "app", "icon": "agent" } ], [ { "label": "Choose tools", "kind": "app", "sub": "from its MCP servers" } ], [ { "label": "Interpret results", "kind": "app" } ], [ { "label": "Domain narrative", "kind": "app" } ], [] ] }, { "title": "Tool plane", "cells": [ [], [], [ { "label": "MCP tool contract", "kind": "integration", "sub": "no free-form SQL", "icon": "fa5_file_contract" }, { "label": "Scope check", "kind": "security", "sub": "caller, not service" } ], [ { "label": "Execute read", "kind": "integration" }, { "label": "Mint evidence id", "kind": "integration" } ], [], [ { "label": "Replay for audit", "kind": "integration" } ] ] }, { "title": "Data and models", "cells": [ [ { "label": "Entity lookup", "kind": "store", "sub": "graph", "icon": "fa5_project_diagram" } ], [], [ { "label": "Search index", "kind": "store" }, { "label": "Semantic model", "kind": "store", "icon": "fa5_calculator" } ], [ { "label": "ML endpoint", "kind": "app", "sub": "forecast · anomaly", "icon": "fa5_chart_line" }, { "label": "Graph traversal", "kind": "store", "icon": "fa5_project_diagram" } ], [ { "label": "vLLM", "kind": "app", "sub": "reasoning model" } ], [] ] }, { "title": "Guardrails", "cells": [ [ { "label": "Prompt shield", "kind": "security" } ], [ { "label": "Tool allow-list", "kind": "security", "sub": "MCP tools per role" } ], [ { "label": "Sensitivity filter", "kind": "security" } ], [], [ { "label": "Claim binding", "kind": "security" } ], [ { "label": "Groundedness gate", "kind": "security" }, { "label": "Trace + cost record", "kind": "platform" } ] ] } ], "note": "Agents are capability packs inside one runtime, not separate applications. Adding a domain adds a tool catalogue and a prompt pack, not a deployment.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "17-deterministic-vs-generative", "title": "Who Answers What — Deterministic Before Generative", "layout": "grid", "canvas": { "width": 1780 }, "laneHeaderWidth": 210, "columns": [ "Semantic model", "ML endpoint", "Entity graph", "Retrieval", "Language model" ], "rows": [ { "title": "KPI value", "cells": [ [ { "label": "Cube measure", "kind": "store", "sub": "the only source", "icon": "fa5_calculator" } ], [], [], [], [ { "label": "Phrasing only", "kind": "app" } ] ] }, { "title": "Trend and variance", "cells": [ [ { "label": "Time intelligence", "kind": "store" } ], [ { "label": "Seasonality", "kind": "app" } ], [], [], [ { "label": "Phrasing only", "kind": "app" } ] ] }, { "title": "Forecast and what-if", "cells": [ [ { "label": "Actuals baseline", "kind": "store" } ], [ { "label": "Forecast + interval", "kind": "app", "sub": "MLflow · registered" } ], [], [], [ { "label": "Scenario framing", "kind": "app" } ] ] }, { "title": "Anomaly and exception", "cells": [ [ { "label": "Threshold rules", "kind": "store" } ], [ { "label": "Anomaly score", "kind": "app", "icon": "fa5_chart_area" } ], [], [], [ { "label": "Why it matters", "kind": "app" } ] ] }, { "title": "Cross-domain question", "cells": [ [ { "label": "Measures per node", "kind": "store" } ], [], [ { "label": "Traversal", "kind": "store", "sub": "supplier → project" } ], [], [ { "label": "Question to traversal", "kind": "app" } ] ] }, { "title": "Policy and contract", "cells": [ [], [], [], [ { "label": "Cited passages", "kind": "store", "sub": "ACL trimmed" } ], [ { "label": "Summarise, cite", "kind": "app" } ] ] }, { "title": "Options and recommendation", "cells": [ [ { "label": "Cost of each option", "kind": "store" } ], [ { "label": "Risk score", "kind": "app" } ], [ { "label": "Blast radius", "kind": "store" } ], [ { "label": "Precedent", "kind": "store" } ], [ { "label": "Compose option set", "kind": "app", "sub": "never the number" } ] ] } ], "note": "Read the last column. The language model never produces a figure, a forecast or a risk score — it routes, frames and narrates what a deterministic component computed.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "18-proactive-detection-pipeline", "title": "Proactive Intelligence — Signal to Situation", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Signals", "nodes": [ { "id": "d-kpi", "label": "KPI refresh", "kind": "store", "sub": "gold, hourly" }, { "id": "d-evt", "label": "Business events", "kind": "queue", "sub": "Kafka" }, { "id": "d-doc", "label": "New documents", "kind": "store", "sub": "crawl delta" }, { "id": "d-ext", "label": "External feeds", "kind": "external", "sub": "market · weather" } ] }, { "title": "Baselines", "nodes": [ { "id": "d-hist", "label": "History", "kind": "store", "sub": "same period last year" }, { "id": "d-plan", "label": "Plan and budget", "kind": "store", "sub": "committed" }, { "id": "d-peer", "label": "Peer cohort", "kind": "store", "sub": "same BU class" } ] }, { "title": "Detectors", "nodes": [ { "id": "d-thr", "label": "Threshold", "kind": "app", "sub": "tenant config" }, { "id": "d-anom", "label": "Anomaly model", "kind": "app", "sub": "KServe", "icon": "fa5_chart_area" }, { "id": "d-drift", "label": "Forecast deviation", "kind": "app", "sub": "actual vs predicted", "icon": "fa5_chart_line" }, { "id": "d-graph", "label": "Graph propagation", "kind": "app", "sub": "supplier → project", "icon": "fa5_project_diagram" } ] }, { "title": "Triage", "nodes": [ { "id": "d-score", "label": "Materiality score", "kind": "decision", "sub": "value × confidence", "icon": "fa5_balance_scale" }, { "id": "d-dedup", "label": "Deduplicate", "kind": "app", "sub": "one per root cause" }, { "id": "d-supp", "label": "Suppression", "kind": "security", "sub": "logged · expiring" }, { "id": "d-quiet", "label": "Below the bar", "kind": "risk", "sub": "recorded, not shown" } ] }, { "title": "Situation", "nodes": [ { "id": "d-sit", "label": "Situation record", "kind": "store", "sub": "durable, not a message", "icon": "fa5_exclamation_circle" }, { "id": "d-rc", "label": "Root-cause pass", "kind": "app", "sub": "agents + graph", "icon": "fa5_microscope" }, { "id": "d-imp", "label": "Impact and forecast", "kind": "app", "sub": "deterministic" }, { "id": "d-opt", "label": "Option set", "kind": "app", "sub": "cost · risk · delay" } ] }, { "title": "Brief", "nodes": [ { "id": "d-rank", "label": "Rank for this CXO", "kind": "app", "sub": "role + portfolio" }, { "id": "d-card", "label": "Mattermost brief", "kind": "integration", "sub": "07:10 local", "icon": "fa5_comments" }, { "id": "d-home", "label": "Executive home", "kind": "app", "sub": "Today view", "icon": "fa5_desktop" } ] } ], "edges": [ { "from": "d-score", "to": "d-quiet", "label": "below threshold", "kind": "error" }, { "from": "d-card", "to": "d-sit", "label": "opens the record", "route": "gutter" } ], "note": "Detection is deterministic and runs on a schedule. No model is asked to watch the business; models narrate a signal that a detector already raised.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "19-decision-loop", "title": "The Closed Loop — See, Understand, Predict, Decide, Act, Monitor", "layout": "cycle", "canvas": { "width": 1360 }, "centre": { "label": "Decision record", "icon": "fa5_gavel" }, "rx": 430, "ry": 220, "nodes": [ { "id": "y-see", "label": "See", "kind": "app", "sub": "detector raises a situation", "icon": "fa5_eye" }, { "id": "y-und", "label": "Understand", "kind": "app", "sub": "evidence and root cause" }, { "id": "y-pre", "label": "Predict", "kind": "app", "sub": "impact if nothing changes" }, { "id": "y-dec", "label": "Decide", "kind": "decision", "sub": "human picks an option" }, { "id": "y-act", "label": "Act", "kind": "integration", "sub": "governed execution" }, { "id": "y-mon", "label": "Monitor", "kind": "platform", "sub": "did the KPI move?", "icon": "fa5_heartbeat" } ], "ringLabels": [ "situation id", "evidence bound", "impact quantified", "approval recorded", "external reference", "verdict, or reopen" ], "note": "The loop closes on the same record it opened. An intervention that did not work reopens the decision rather than starting a new one.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "20-governed-execution-sequence", "title": "Governed Execution — Approval to Verified Outcome", "layout": "sequence", "canvas": { "width": 1680 }, "lifelines": [ { "id": "x-cxo", "label": "CXO", "kind": "actor" }, { "id": "x-dec", "label": "Decision service", "kind": "app", "icon": "fa5_balance_scale" }, { "id": "x-pol", "label": "Policy engine", "kind": "security", "icon": "fa5_user_lock" }, { "id": "x-q", "label": "Action queue", "kind": "queue", "icon": "temporal" }, { "id": "x-exec", "label": "Execution plane", "kind": "integration", "icon": "fa5_paper_plane" }, { "id": "x-erp", "label": "Procurement", "kind": "external", "icon": "fa5_server" }, { "id": "x-mon", "label": "Outcome monitor", "kind": "platform", "icon": "fa5_heartbeat" } ], "messages": [ { "from": "x-cxo", "to": "x-dec", "label": "approve option 2", "kind": "call" }, { "from": "x-dec", "to": "x-pol", "label": "who may approve this value?", "kind": "call" }, { "from": "x-pol", "to": "x-dec", "label": "within limit · dual approval not required", "kind": "return" }, { "from": "x-dec", "to": "x-dec", "label": "write approval to the record", "kind": "self" }, { "from": "x-dec", "to": "x-q", "label": "action proposal + idempotency key", "kind": "async" }, { "from": "x-q", "to": "x-exec", "label": "claim (lease)", "kind": "call" }, { "from": "x-exec", "to": "x-pol", "label": "re-check at execution time", "kind": "call" }, { "from": "x-pol", "to": "x-exec", "label": "still authorised", "kind": "return" }, { "from": "x-exec", "to": "x-erp", "label": "create purchase request", "kind": "call" }, { "from": "x-erp", "to": "x-exec", "label": "external reference PR-4471", "kind": "return" }, { "from": "x-exec", "to": "x-dec", "label": "executed · reference recorded", "kind": "call" }, { "from": "x-dec", "to": "x-mon", "label": "watch KPI for 14 days", "kind": "async" }, { "from": "x-mon", "to": "x-mon", "label": "compare against forecast", "kind": "self" }, { "from": "x-mon", "to": "x-dec", "label": "no improvement", "kind": "error" }, { "from": "x-dec", "to": "x-cxo", "label": "reopened, with what changed", "kind": "return" } ], "note": "The AI identity holds no write scope anywhere. The execution plane is the only component with a write credential, it uses a distinct connector identity per system, and it re-checks authority before it writes.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "21-deployment-topology", "title": "Deployment Topology — Sites and Failure Domains", "layout": "nested", "canvas": { "width": 1780 }, "boxes": [ { "title": "Primary data centre — in country", "kind": "onprem", "dir": "col", "children": [ { "title": "Application tier — spread over 3 fault domains", "kind": "boundary", "nodes": [ { "id": "p-afd", "label": "HAProxy cluster", "kind": "integration", "sub": "VRRP · active pair" }, { "id": "p-apim", "label": "Kong Gateway", "kind": "integration", "sub": "3 nodes" }, { "id": "p-aca", "label": "Kubernetes", "kind": "app", "sub": "3–30 pods" }, { "id": "p-func", "label": "Temporal", "kind": "app", "sub": "3 nodes · 3 domains" } ] }, { "title": "AI tier", "kind": "boundary", "nodes": [ { "id": "p-aoai", "label": "vLLM on GPU nodes", "kind": "app", "sub": "8 × H100 · MIG" }, { "id": "p-srch", "label": "OpenSearch", "kind": "store", "sub": "3 data · 3 shards" }, { "id": "p-aml", "label": "KServe endpoints", "kind": "app", "sub": "2 nodes minimum", "icon": "fa5_chart_line" } ] }, { "title": "Data tier", "kind": "boundary", "nodes": [ { "id": "p-sql", "label": "PostgreSQL", "kind": "store", "sub": "Patroni · 3 nodes" }, { "id": "p-fab", "label": "Trino + Spark", "kind": "store", "sub": "MinIO erasure coded" }, { "id": "p-cos", "label": "Neo4j", "kind": "store", "sub": "3 nodes" }, { "id": "p-redis", "label": "Redis cluster", "kind": "store", "sub": "3 nodes" }, { "id": "p-blob", "label": "Evidence store", "kind": "store", "sub": "object lock", "icon": "fa5_archive" } ] }, { "title": "Hub network", "kind": "trust", "nodes": [ { "id": "p-fw", "label": "Egress firewall", "kind": "security", "sub": "egress control", "icon": "fa5_shield_alt" }, { "id": "p-pdns", "label": "Internal DNS", "kind": "platform", "sub": "split horizon", "icon": "fa5_sitemap" }, { "id": "p-bast", "label": "Bastion", "kind": "security", "sub": "no public admin", "icon": "fa5_user_lock" }, { "id": "p-er", "label": "MPLS link", "kind": "integration", "sub": "to the enterprise", "icon": "fa5_network_wired" } ] } ] }, { "title": "Secondary site — only where the tenant's tier permits it", "kind": "onprem", "nodes": [ { "id": "s-sql", "label": "PostgreSQL standby", "kind": "store", "sub": "RPO 5 min" }, { "id": "s-blob", "label": "Evidence replica", "kind": "store", "sub": "second site" }, { "id": "s-iac", "label": "Redeploy from Git", "kind": "app", "sub": "RTO 4 h · cold" }, { "id": "s-none", "label": "Sovereign tenants: no second site", "kind": "risk", "sub": "RTO is a restore, in country" } ] } ], "outside": [ { "id": "p-onprem", "label": "Enterprise network", "kind": "external", "sub": "MPLS link", "icon": "fa5_network_wired" }, { "id": "p-m365", "label": "Mail and calendar", "kind": "external", "sub": "on-site servers", "icon": "fa5_envelope" }, { "id": "p-risk", "label": "GPU supply is the binding constraint", "kind": "risk", "sub": "size and order before contract" } ], "edges": [ { "from": "p-er", "to": "p-onprem", "label": "private", "route": "gutter" }, { "from": "p-sql", "to": "s-sql", "label": "log shipping", "kind": "async" } ], "note": "Availability is bought inside one site, across racks and power feeds. A second site is a tier option, because for a sovereign tenant a second building may be a contract question rather than a resilience feature.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "22-cicd-and-tenant-config", "title": "Delivery — Two Pipelines, Code and Tenant Configuration", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Source", "nodes": [ { "id": "v-code", "label": "Product repo", "kind": "app", "sub": "app · Terraform" }, { "id": "v-prompt", "label": "Prompt packs", "kind": "store", "sub": "versioned", "icon": "fa5_file_alt" }, { "id": "v-cfg", "label": "Tenant config repo", "kind": "store", "sub": "one branch per tenant", "icon": "fa5_code_branch" }, { "id": "v-pack", "label": "Industry packs", "kind": "store", "sub": "gov · bank · energy", "icon": "fa5_boxes" } ] }, { "title": "Build", "nodes": [ { "id": "v-img", "label": "Container build", "kind": "app", "sub": "signed · SBOM" }, { "id": "v-iac", "label": "Terraform plan", "kind": "app", "sub": "plan reviewed" }, { "id": "v-schema", "label": "Config schema check", "kind": "app", "sub": "reject unknown keys" } ] }, { "title": "Quality gates", "nodes": [ { "id": "v-unit", "label": "Unit and contract", "kind": "decision" }, { "id": "v-scan", "label": "Scan", "kind": "security", "sub": "code · image · IaC", "icon": "fa5_bug" }, { "id": "v-eval", "label": "Golden-question eval", "kind": "decision", "sub": "accuracy · grounding", "icon": "fa5_clipboard_check" }, { "id": "v-red", "label": "Red-team suite", "kind": "security", "sub": "injection · leakage", "icon": "fa5_user_secret" }, { "id": "v-iso", "label": "Tenant isolation test", "kind": "security", "sub": "cross-tenant probes", "icon": "fa5_user_lock" } ] }, { "title": "Environments", "nodes": [ { "id": "v-dev", "label": "Dev", "kind": "app", "sub": "synthetic data" }, { "id": "v-stg", "label": "Staging", "kind": "app", "sub": "synthetic tenant", "icon": "fa5_vial" }, { "id": "v-r1", "label": "Ring 1", "kind": "app", "sub": "one pilot tenant" }, { "id": "v-r2", "label": "Ring 2", "kind": "app", "sub": "all tenants" } ] }, { "title": "Release control", "nodes": [ { "id": "v-flag", "label": "Feature flags", "kind": "platform", "sub": "per tenant" }, { "id": "v-pin", "label": "Model pinning", "kind": "platform", "sub": "tenant opts in to upgrades" }, { "id": "v-cab", "label": "Tenant change window", "kind": "decision", "sub": "sovereign tenants" } ] }, { "title": "After release", "nodes": [ { "id": "v-watch", "label": "Watch the eval metrics", "kind": "platform", "sub": "24 h" }, { "id": "v-roll", "label": "Roll back", "kind": "integration", "sub": "image + prompt together" } ] } ], "edges": [ { "from": "v-eval", "to": "v-roll", "label": "regression blocks", "kind": "error", "route": "gutter" }, { "from": "v-watch", "to": "v-roll", "label": "grounding drop", "kind": "error" } ], "note": "A prompt is a release artefact and moves through the same gates as code. Tenant configuration travels on its own faster pipeline, but it is still schema-checked, versioned and reversible.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "23-observability", "title": "Observability — Signals, and Who Gets Woken Up", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Emitted", "nodes": [ { "id": "b-trace", "label": "Turn trace", "kind": "app", "sub": "OpenTelemetry GenAI" }, { "id": "b-tool", "label": "Tool call log", "kind": "app", "sub": "latency · failure" }, { "id": "b-tok", "label": "Tokens and cost", "kind": "app", "sub": "per tenant, per turn" }, { "id": "b-qual", "label": "Answer quality", "kind": "app", "sub": "grounded · abstained" }, { "id": "b-infra", "label": "Platform metrics", "kind": "platform", "sub": "cluster · GPU" }, { "id": "b-fresh", "label": "Data freshness", "kind": "platform", "sub": "per source" } ] }, { "title": "Collected", "nodes": [ { "id": "b-ai", "label": "OpenTelemetry", "kind": "platform", "sub": "distributed trace" }, { "id": "b-fdy", "label": "Langfuse", "kind": "platform", "sub": "agent spans" }, { "id": "b-mon", "label": "Prometheus", "kind": "platform", "sub": "metrics · alerts" } ] }, { "title": "Stored", "nodes": [ { "id": "b-law", "label": "Loki + Tempo", "kind": "store", "sub": "90 d hot" }, { "id": "b-arch", "label": "Archive", "kind": "store", "sub": "2 y · object store" }, { "id": "b-cost", "label": "GPU-hour export", "kind": "store", "sub": "to the lake" } ] }, { "title": "Watched", "nodes": [ { "id": "b-slo", "label": "SLO burn", "kind": "decision", "sub": "p95 answer latency" }, { "id": "b-grd", "label": "Grounding regression", "kind": "decision", "sub": "rolling 24 h" }, { "id": "b-fail", "label": "Tool failure rate", "kind": "decision", "sub": "per source" }, { "id": "b-spend", "label": "Tenant spend", "kind": "decision", "sub": "budget per tenant" }, { "id": "b-stale", "label": "Stale source", "kind": "decision", "sub": "past contract" } ] }, { "title": "Acted on", "nodes": [ { "id": "b-page", "label": "Page the SRE", "kind": "integration", "sub": "platform only" }, { "id": "b-throt", "label": "Throttle a tenant", "kind": "integration", "sub": "protect the rest" }, { "id": "b-badge", "label": "Show staleness", "kind": "app", "sub": "in the answer" }, { "id": "b-evl", "label": "Re-run evaluations", "kind": "app", "sub": "before blaming data" } ] }, { "title": "Reported", "nodes": [ { "id": "b-tenant", "label": "Tenant health report", "kind": "app", "sub": "monthly" }, { "id": "b-adopt", "label": "Adoption and value", "kind": "app", "sub": "acceptance rate" } ] } ], "edges": [ { "from": "b-stale", "to": "b-badge", "label": "never silently" } ], "note": "Recommendation acceptance is a platform metric, not a business one: if executives stop acting on what the platform surfaces, that is an outage of the product even when every service is green. Rejected answers feed the golden set in view 24.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "24-ai-evaluation-lifecycle", "title": "Model and Prompt Lifecycle — the Loop That Keeps Answers Honest", "layout": "cycle", "canvas": { "width": 1400 }, "centre": { "label": "Prompt and model registry" }, "rx": 445, "ry": 225, "nodes": [ { "id": "e-gold", "label": "Curate", "kind": "store", "sub": "golden questions per tenant" }, { "id": "e-off", "label": "Evaluate offline", "kind": "app", "sub": "accuracy · grounding · refusal" }, { "id": "e-gate", "label": "Gate", "kind": "decision", "sub": "no regression, no release" }, { "id": "e-can", "label": "Canary", "kind": "app", "sub": "one tenant, one ring" }, { "id": "e-obs", "label": "Observe", "kind": "platform", "sub": "live grounding and feedback" }, { "id": "e-mine", "label": "Mine failures", "kind": "app", "sub": "abstentions and thumbs-down" } ], "ringLabels": [ "versioned set", "scores per class", "promote or stop", "real questions", "failure classes", "new golden cases" ], "note": "Every model or prompt change re-enters at Curate. A tenant may pin a version and opt in to upgrades on its own schedule.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "25-degradation-matrix", "title": "Degradation Contract — What Still Works When Something Fails", "layout": "grid", "canvas": { "width": 1780 }, "laneHeaderWidth": 215, "columns": [ "KPI answer", "Investigation", "Document search", "Approve and execute", "Morning brief" ], "rows": [ { "title": "Model serving unavailable", "cells": [ [ { "label": "Works", "kind": "opportunity", "sub": "measure, no prose" } ], [ { "label": "Queued", "kind": "journey" } ], [ { "label": "Keyword only", "kind": "journey" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Numbers only", "kind": "journey" } ] ] }, { "title": "Search cluster unavailable", "cells": [ [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "No citations", "kind": "journey", "sub": "states the gap" } ], [ { "label": "Down", "kind": "risk" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Works", "kind": "opportunity" } ] ] }, { "title": "Query engine saturated", "cells": [ [ { "label": "Cached, aged", "kind": "journey", "sub": "as-of shown" } ], [ { "label": "Degraded", "kind": "journey" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Delayed", "kind": "journey" } ] ] }, { "title": "A source system is down", "cells": [ [ { "label": "Last good, flagged", "kind": "journey" } ], [ { "label": "Partial, named", "kind": "journey", "sub": "which domain is blind" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Blocked for that system", "kind": "risk" } ], [ { "label": "Coverage stated", "kind": "journey" } ] ] }, { "title": "Execution plane down", "cells": [ [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Approvals held, queued", "kind": "journey", "sub": "never lost" } ], [ { "label": "Works", "kind": "opportunity" } ] ] }, { "title": "Decision store unavailable", "cells": [ [ { "label": "Read-only answers", "kind": "journey" } ], [ { "label": "Not recorded", "kind": "risk", "sub": "so refused" } ], [ { "label": "Works", "kind": "opportunity" } ], [ { "label": "Refused", "kind": "risk", "sub": "no record, no action" } ], [ { "label": "Refused", "kind": "risk" } ] ] } ], "note": "Read the bottom row. If the decision cannot be recorded, the platform refuses to act rather than acting unrecorded — the one place it is designed to fail closed.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "26-security-zones", "title": "Security Zones — Where an Attacker Arrives, and What Stops Them", "layout": "zones", "canvas": { "width": 1780 }, "zones": [ { "title": "Internet — untrusted", "kind": "trust", "nodes": [ { "id": "n-cxo", "label": "Executive device", "kind": "actor", "sub": "MDM compliant" }, { "id": "n-att", "label": "Attacker", "kind": "risk", "sub": "credential · injection" }, { "id": "n-m365", "label": "Chat and mail", "kind": "external", "sub": "Mattermost · SMTP", "icon": "fa5_comments" } ] }, { "title": "Perimeter — public ingress ends here", "kind": "trust", "nodes": [ { "id": "n-afd", "label": "HAProxy + WAF", "kind": "integration", "sub": "OWASP CRS · limits", "icon": "haproxy" }, { "id": "n-ddos", "label": "Perimeter firewall", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "n-entra", "label": "Keycloak", "kind": "security", "sub": "MFA · device policy" } ] }, { "title": "Application — cluster-internal, no route from outside", "kind": "trust", "nodes": [ { "id": "n-apim", "label": "Kong internal", "kind": "integration", "sub": "no public route" }, { "id": "n-api", "label": "Experience API", "kind": "app", "sub": "workload identity", "icon": "fa5_code" }, { "id": "n-orch", "label": "Orchestrator", "kind": "app", "sub": "no data credential", "icon": "agent" }, { "id": "n-tool", "label": "Tool plane", "kind": "integration", "sub": "MCP · the only door", "icon": "fa5_plug" } ] }, { "title": "AI and data — mesh-internal, keys in the HSM", "kind": "trust", "nodes": [ { "id": "n-aoai", "label": "vLLM serving", "kind": "app", "sub": "no egress" }, { "id": "n-srch", "label": "OpenSearch", "kind": "store", "sub": "ACL fields" }, { "id": "n-sql", "label": "Decision store", "kind": "store", "sub": "encrypted · Vault key", "icon": "fa5_gavel" }, { "id": "n-fab", "label": "Trino + MinIO", "kind": "store", "sub": "catalogue RBAC" }, { "id": "n-kv", "label": "Vault + HSM", "kind": "security", "sub": "per-tenant key" } ] }, { "title": "Execution and egress — the only outbound path", "kind": "trust", "nodes": [ { "id": "n-la", "label": "Execution plane", "kind": "integration", "sub": "write scopes only", "icon": "fa5_paper_plane" }, { "id": "n-fw", "label": "Egress firewall", "kind": "security", "sub": "FQDN allow-list", "icon": "fa5_shield_alt" }, { "id": "n-erp", "label": "Enterprise systems", "kind": "external", "sub": "over the MPLS link", "icon": "fa5_server" } ] }, { "title": "Management — separate identities, no standing access", "kind": "trust", "nodes": [ { "id": "n-pim", "label": "JIT admin access", "kind": "security", "sub": "approval + time box", "icon": "fa5_user_clock" }, { "id": "n-bast", "label": "Bastion", "kind": "security", "icon": "fa5_user_lock" }, { "id": "n-sent", "label": "OpenSearch SIEM", "kind": "security", "sub": "SIEM · UEBA" }, { "id": "n-def", "label": "Falco + Trivy", "kind": "security", "sub": "runtime · posture", "icon": "fa5_shield_virus" } ] } ], "edges": [ { "from": "n-cxo", "to": "n-afd", "label": "TLS 1.3", "kind": "sync" }, { "from": "n-att", "to": "n-afd", "label": "blocked at the edge", "kind": "error" }, { "from": "n-afd", "to": "n-apim", "label": "mTLS mesh", "icon": "istio" }, { "from": "n-orch", "to": "n-tool", "label": "typed call only" }, { "from": "n-tool", "to": "n-srch", "label": "caller identity" }, { "from": "n-la", "to": "n-fw", "label": "allow-listed FQDN" }, { "from": "n-fw", "to": "n-erp", "label": "private" } ], "note": "The orchestrator holds no credential for any store. Compromising it yields the ability to ask questions as the caller, and nothing more.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "27-identity-and-authorization", "title": "Identity — The Caller's Authority, Carried All the Way Down", "layout": "sequence", "canvas": { "width": 1720 }, "lifelines": [ { "id": "u-cxo", "label": "CXO", "kind": "actor" }, { "id": "u-app", "label": "Client app", "kind": "app", "icon": "fa5_desktop" }, { "id": "u-entra", "label": "Keycloak", "kind": "security" }, { "id": "u-apim", "label": "Kong", "kind": "integration" }, { "id": "u-api", "label": "Experience API", "kind": "app", "icon": "fa5_code" }, { "id": "u-tool", "label": "MCP tool plane", "kind": "integration", "icon": "fa5_plug" }, { "id": "u-sem", "label": "Semantic model", "kind": "store", "icon": "fa5_calculator" }, { "id": "u-srch", "label": "OpenSearch", "kind": "store" } ], "messages": [ { "from": "u-cxo", "to": "u-app", "label": "opens the brief", "kind": "call" }, { "from": "u-app", "to": "u-entra", "label": "sign in", "kind": "call" }, { "from": "u-entra", "to": "u-entra", "label": "MFA · device compliance · location", "kind": "self" }, { "from": "u-entra", "to": "u-app", "label": "access token + roles + tenant", "kind": "return" }, { "from": "u-app", "to": "u-apim", "label": "bearer token", "kind": "call" }, { "from": "u-apim", "to": "u-apim", "label": "validate · tenant quota", "kind": "self" }, { "from": "u-apim", "to": "u-api", "label": "forwarded with claims", "kind": "call" }, { "from": "u-api", "to": "u-entra", "label": "RFC 8693 token exchange", "kind": "call" }, { "from": "u-entra", "to": "u-api", "label": "downstream token, user's scopes", "kind": "return" }, { "from": "u-api", "to": "u-tool", "label": "tool call + user assertion", "kind": "call" }, { "from": "u-tool", "to": "u-tool", "label": "is this tool allowed for this role?", "kind": "self" }, { "from": "u-tool", "to": "u-sem", "label": "query as the user", "kind": "call" }, { "from": "u-sem", "to": "u-tool", "label": "rows the user may see (RLS)", "kind": "return" }, { "from": "u-tool", "to": "u-srch", "label": "query + group filter", "kind": "call" }, { "from": "u-srch", "to": "u-tool", "label": "documents the user may read", "kind": "return" }, { "from": "u-tool", "to": "u-api", "label": "result + evidence id", "kind": "return" } ], "note": "There is no service account that can read everything. If the CXO cannot see a figure in the source system, no agent, cache or index can surface it to them here.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "28-sovereignty-and-residency", "title": "Sovereignty — What Stays In Country, and What Is Allowed Out", "layout": "nested", "canvas": { "width": 1760 }, "boxes": [ { "title": "In country — the enterprise data centre, customer-held keys", "kind": "trust", "dir": "col", "children": [ { "title": "Data at rest", "kind": "boundary", "nodes": [ { "id": "g-lake", "label": "Object store", "kind": "store", "sub": "encrypted · Vault key", "icon": "minio" }, { "id": "g-sql", "label": "Decision store", "kind": "store", "sub": "encrypted · Vault key", "icon": "fa5_gavel" }, { "id": "g-idx", "label": "Search index", "kind": "store", "sub": "encrypted · Vault key" }, { "id": "g-blob", "label": "Evidence", "kind": "store", "sub": "immutable + CMK" }, { "id": "g-log", "label": "Logs", "kind": "store", "sub": "in-site cluster" } ] }, { "title": "Processing", "kind": "boundary", "nodes": [ { "id": "g-inf", "label": "Model inference", "kind": "app", "sub": "on-site GPUs" }, { "id": "g-emb", "label": "Embedding", "kind": "app", "sub": "on-site" }, { "id": "g-ml", "label": "ML training", "kind": "app", "sub": "on-site compute" }, { "id": "g-app", "label": "Application compute", "kind": "app", "sub": "on-site", "icon": "fa5_server" } ] }, { "title": "Key and identity control", "kind": "boundary", "nodes": [ { "id": "g-hsm", "label": "Vault + HSM", "kind": "security", "sub": "customer holds the key" }, { "id": "g-lock", "label": "Break-glass approval", "kind": "security", "sub": "vendor access logged", "icon": "fa5_key" }, { "id": "g-pim", "label": "JIT access", "kind": "security", "sub": "no standing admin", "icon": "fa5_user_clock" } ] } ] }, { "title": "Allowed out — explicitly, and only these", "kind": "boundary", "nodes": [ { "id": "g-tel", "label": "Vendor support bundles", "kind": "platform", "sub": "no customer content", "icon": "fa5_file_alt" }, { "id": "g-thr", "label": "Threat intelligence", "kind": "security", "sub": "signatures in", "icon": "fa5_shield_alt" }, { "id": "g-pkg", "label": "Mirrored package feeds", "kind": "integration", "sub": "build time only", "icon": "fa5_boxes" } ] }, { "title": "Never leaves the boundary", "kind": "trust", "nodes": [ { "id": "g-n1", "label": "Prompts and completions", "kind": "risk" }, { "id": "g-n2", "label": "Retrieved passages", "kind": "risk" }, { "id": "g-n3", "label": "Business data and KPIs", "kind": "risk" }, { "id": "g-n4", "label": "Decision and audit records", "kind": "risk" } ] } ], "outside": [ { "id": "g-nia", "label": "Control framework mapping", "kind": "external", "sub": "evidence per control", "icon": "fa5_clipboard_check" }, { "id": "g-gap", "label": "GPU supply is the open risk", "kind": "risk", "sub": "size and order before signing" } ], "edges": [ { "from": "g-hsm", "to": "g-sql", "label": "revoke = unreadable" }, { "from": "g-tel", "to": "g-nia", "label": "declared", "kind": "batch", "route": "gutter" } ], "note": "Residency is a physical property here — the estate has no cloud plane at all. Admission control refuses any workload without a residency label, and the firewall denies every egress that is not on the list.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "29-ai-governance-and-guardrails", "title": "AI Governance — Every Control on the Path of a Turn", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Input", "nodes": [ { "id": "w-shield", "label": "Prompt shield", "kind": "security", "sub": "jailbreak detection" }, { "id": "w-pii", "label": "PII detection", "kind": "security", "sub": "Presidio" }, { "id": "w-scope", "label": "Scope check", "kind": "security", "sub": "role · tenant" } ] }, { "title": "Retrieval", "nodes": [ { "id": "w-acl", "label": "ACL trimming", "kind": "security", "sub": "before scoring" }, { "id": "w-label", "label": "Sensitivity labels", "kind": "security", "sub": "labels honoured" }, { "id": "w-doc", "label": "Content is data", "kind": "security", "sub": "never instruction" } ] }, { "title": "Generation", "nodes": [ { "id": "w-pin", "label": "Pinned model", "kind": "platform", "sub": "version recorded" }, { "id": "w-tmpl", "label": "Pinned prompt", "kind": "platform", "sub": "from the registry" }, { "id": "w-tool", "label": "Tool allow-list", "kind": "security", "sub": "no write tools" } ] }, { "title": "Output", "nodes": [ { "id": "w-bind", "label": "Claim binding", "kind": "app", "sub": "evidence id per claim" }, { "id": "w-grd", "label": "Groundedness", "kind": "security", "sub": "NLI verifier" }, { "id": "w-prot", "label": "Protected material", "kind": "security" }, { "id": "w-dlp", "label": "Egress DLP", "kind": "security", "sub": "label-aware" } ] }, { "title": "Fail safe", "nodes": [ { "id": "w-abs", "label": "Abstain", "kind": "risk", "sub": "\"not enough evidence\"", "icon": "fa5_hand_paper" }, { "id": "w-part", "label": "Answer partially", "kind": "journey", "sub": "and say which part" }, { "id": "w-esc", "label": "Escalate to a human", "kind": "actor", "sub": "analyst queue" } ] }, { "title": "Record", "nodes": [ { "id": "w-trace", "label": "Full turn trace", "kind": "platform", "sub": "prompt · tools · model" }, { "id": "w-fb", "label": "Feedback", "kind": "app", "sub": "accepted · rejected" }, { "id": "w-eval", "label": "Into the golden set", "kind": "store", "sub": "next release" } ] } ], "edges": [ { "from": "w-grd", "to": "w-abs", "label": "unsupported", "kind": "error" } ], "note": "Abstention is a first-class outcome with its own metric. Partial visibility answers partially and names the gap; a platform that never abstains is not more accurate, only less honest.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } }, { "id": "30-audit-and-lineage", "title": "Audit and Lineage — Reconstructing a Decision Four Months Later", "layout": "flow", "canvas": { "width": 1800 }, "chain": true, "align": "top", "stages": [ { "title": "Captured at ask", "nodes": [ { "id": "a-who", "label": "Caller", "kind": "security", "sub": "subject · roles" }, { "id": "a-q", "label": "Question", "kind": "store", "sub": "verbatim" }, { "id": "a-ctx", "label": "Tenant and config", "kind": "store", "sub": "config version" } ] }, { "title": "Captured at execution", "nodes": [ { "id": "a-plan", "label": "Plan", "kind": "store", "sub": "agents selected", "icon": "fa5_clipboard_list" }, { "id": "a-tools", "label": "Every tool call", "kind": "store", "sub": "args · latency · result hash" }, { "id": "a-model", "label": "Model and prompt", "kind": "store", "sub": "both versions" }, { "id": "a-cost", "label": "Tokens and cost", "kind": "store" } ] }, { "title": "Evidence", "nodes": [ { "id": "a-snap", "label": "Value snapshot", "kind": "store", "sub": "as-of, not re-run", "icon": "fa5_camera" }, { "id": "a-pass", "label": "Passages cited", "kind": "store", "sub": "document version" }, { "id": "a-lin", "label": "OpenLineage", "kind": "platform", "sub": "source → measure" } ] }, { "title": "Decision record", "nodes": [ { "id": "a-sit", "label": "Situation", "kind": "store", "icon": "fa5_exclamation_circle" }, { "id": "a-opt", "label": "Options shown", "kind": "store", "sub": "including rejected" }, { "id": "a-app", "label": "Approval", "kind": "store", "sub": "who · when · limit" }, { "id": "a-act", "label": "Action + external ref", "kind": "store" }, { "id": "a-out", "label": "Outcome verdict", "kind": "store" } ] }, { "title": "Custody", "nodes": [ { "id": "a-chain", "label": "Hash chain", "kind": "security", "sub": "per tenant, per day", "icon": "fa5_link" }, { "id": "a-worm", "label": "Immutable storage", "kind": "store", "sub": "legal hold · 10 y", "icon": "fa5_lock" }, { "id": "a-sep", "label": "Writer cannot delete", "kind": "security", "sub": "separate identity" } ] }, { "title": "Produced on demand", "nodes": [ { "id": "a-pack", "label": "Evidence pack", "kind": "app", "sub": "signed export", "icon": "fa5_file_contract" }, { "id": "a-siem", "label": "To the SIEM", "kind": "security", "sub": "access events" }, { "id": "a-reg", "label": "Regulator view", "kind": "external", "sub": "read-only" } ] } ], "edges": [ { "from": "a-snap", "to": "a-opt", "label": "what they actually saw", "route": "gutter" } ], "note": "The evidence is a snapshot, not a query to re-run. Re-running gives today's number, which is the wrong answer to \"what did the approver see?\".", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-09" } } ]