Architecture Decision Record

AI Executive Office — CXO Assistant Platform · Solution Architecture v1.0 · Azure-native, multi-tenant, sovereign-capable · Data & AI Global Practice · 2026-09

The argument these decisions serve is summarised in the Architecture One-Pager.

Thirty-two decisions that make up this architecture. Everything else on these thirty views is convention, and convention needs no defending. Each record is written to teach as well as to record: it opens with the forcing question and the context that makes it hard, states the decision so it can be checked, then shows the concrete Azure mechanism that realises it. It weighs the credible alternatives — some rejected, some genuinely right for an organisation with different constraints — and states what the choice buys, what it costs, the conditions that would flip it, and the principle that transfers to systems that are not this one. Decisions are grouped into nine areas; use the filter to read one area at a time.

Status of this document. This is a design, not a post-mortem of a running system. No figure in it is a measured production number: targets are engineering commitments to be tested, and volumes are stated assumptions drawn from the requirement. Azure service capabilities, SKU availability and regional service lists change, and several decisions here — most importantly the sovereign-region model availability in ADR-29 — must be re-verified against current Microsoft documentation for the target region before they are relied upon commercially. Where a decision rests on a customer fact not yet confirmed, the record says so rather than assuming in the platform's favour. The sovereign jurisdiction is anonymised throughout: “Meridia” and the region “Meridia Central” are placeholders for the customer’s actual country and Azure region, and “NISA” stands in for its national information-security authority. Substitute the real names, and re-check the real region’s service list, before this document is used commercially.

How to read a record

• Question: The forcing question: why a decision was needed at all.
• Context: The requirement, the scale and the constraint that make it hard.
• Decision: What this architecture does, stated so it can be checked.
• How it works on Azure: The concrete mechanism: which service, configured how.
• Options weighed: Chosen, rejected, deferred, or right elsewhere, with the reason for each.
• Consequences: What the choice buys and what it costs, both kept visible.
• Choose differently when: The conditions that would flip the decision for your system.
• Lesson: The principle that transfers beyond this platform.

Decision map

Foundations: The four commitments everything else is built on, and the ones a reviewer should attack first.

• ADR-01 · The decision record is the system of record, not the conversation
• ADR-02 · The model never touches data; a typed tool plane does
• ADR-03 · Deterministic before generative: the model never produces a number
• ADR-04 · Every claim is bound to evidence, and abstention is a first-class outcome

Experience and access: Where an executive meets the platform, and how a request gets in.

• ADR-05 · Teams is the primary surface; the web app is the deep surface
• ADR-06 · One front door: Front Door for the edge, API Management for the contract
• ADR-07 · Simple questions are synchronous; investigations are durable orchestrations

Orchestration and agents: What plans a turn, what runs it, and where it is hosted.

• ADR-08 · Azure AI Foundry Agent Service for the runtime, with the plan owned in our code
• ADR-09 · Specialist agents are capability packs in one runtime, not separate applications
• ADR-10 · Two model classes, routed — and a budget on every turn
• ADR-11 · Azure Container Apps for hosting, with AKS as a documented exit

Grounding and knowledge: How documents become citable evidence without leaking.

• ADR-12 · Hybrid retrieval with the security filter applied before scoring
• ADR-13 · Permissions and sensitivity are captured at ingestion and carried on the chunk
• ADR-14 · The semantic cache key includes the caller's permission fingerprint

Data and semantics: The analytical foundation, the shared model, and who is allowed to compute a number.

• ADR-15 · Microsoft Fabric as the analytical foundation, with shortcuts instead of copies
• ADR-16 · A canonical model with resolved entities, not query federation
• ADR-17 · One measure definition, owned by finance, shared with Power BI
• ADR-18 · A property graph for cross-domain relationships
• ADR-19 · Forecasts and anomaly scores come from registered models, not prompts
• ADR-20 · Freshness is declared per source and published with every answer

Decision and execution: Turning a recommendation into a governed action, and knowing whether it worked.

• ADR-21 · One execution plane holds every write credential in the estate
• ADR-22 · Options with cost, risk and delay — not a single recommendation
• ADR-23 · The loop closes on the record it opened
• ADR-24 · Proactive detection is deterministic and scheduled

Multi-tenancy: How one product serves many organisations without becoming many products.

• ADR-25 · Isolation is a purchased tier, not an engineering compromise
• ADR-26 · Configuration, not custom code — but the configuration is engineered

Sovereignty and security: Residency, key custody, and the authority chain from person to row.

• ADR-27 · Residency enforced by policy, network and key custody
• ADR-28 · The caller's authority reaches the row; no read-everything identity exists
• ADR-29 · Regional model availability is carried as a contracted risk, not an assumption

Operations and assurance: Releasing safely, degrading honestly, and proving it afterwards.

• ADR-30 · Evaluation is a release gate, and a prompt is a release artefact
• ADR-31 · Evidence is snapshotted, and the writer cannot delete
• ADR-32 · A written degradation contract, and one place the platform fails closed

Technology by capability

What each capability is built from, the credible alternative, and why this one. Every row links to the record that argues it. Origin labels: Azure · platform is a general Azure service; Azure · AI is part of the AI platform; This design means the requirement is met by a pattern the team builds rather than a product it buys.

The decisions, and the alternatives that lost

Foundations

The four commitments everything else is built on, and the ones a reviewer should attack first.

ADR-01 · The decision record is the system of record, not the conversation

Status: Accepted · Shown on views: 06, 13, 19, 30

When an executive approves an intervention through a conversational interface, what exactly has been created?

Context. The brief asks for auditability, closed-loop monitoring, and the ability to reconstruct why a decision was taken. A chat transcript satisfies none of these: it has no state machine, no outcome, no relationship to the KPI the intervention was meant to move, and no way to be reopened. The requirement also asks for a decision intelligence platform rather than a chatbot, and the difference has to be visible somewhere in the data model or it is only a slogan.

Decision. Situation, evidence, options, approval, action and outcome form one durable, append-only entity with an explicit state machine. The conversation is a projection of that entity, not the other way round. Every surface — Teams card, web thread, governance export — renders the same record.

How it works on Azure. Azure SQL Database holds the decision, evidence, action and outcome tables with row-level security by tenant and temporal history on state transitions. Evidence payloads are snapshotted to immutable Blob Storage and referenced by identifier. A decision is never updated in place: state changes are appended, which is what makes the timeline reconstructable four months later.

What it buys

• Audit, closed-loop monitoring and reopening all fall out of one model rather than three subsystems
• The Today view is a query, not an aggregation over chat history
• A decision survives the conversation, the session and the user's departure

What it costs

• A relational store with a real backup and retention obligation, which the analytical estate does not need
• Every surface must write through the decision service rather than talking to the model directly
• More upfront modelling before anything demonstrable exists

Choose differently when. Choose a lighter model when the assistant genuinely only answers questions and never proposes an action — an internal knowledge assistant with no execution path does not need this and should not pay for it.

Lesson. In any assistant that leads to action, the durable artefact is the decision, not the dialogue. Get that wrong and auditability becomes log archaeology.

ADR-02 · The model never touches data; a typed tool plane does

Status: Accepted · Shown on views: 02, 15, 16, 26

How does a language model get access to enterprise data without being given access to enterprise data?

Context. The requirement is explicit that AI must never have unrestricted access and must inherit the user's authorisation context. The tempting shortcut — give the model a database connection and let it write SQL — is fast to demonstrate and impossible to govern: the generated query is unbounded, the identity is the service's rather than the caller's, and nothing about the access is reviewable in advance.

Decision. All data access is through a catalogue of typed tools with declared inputs, outputs and required scopes. The model proposes which tool to call; the tool plane decides whether the caller may, executes the read, and mints an evidence identifier. The orchestrator holds no credential for any store.

How it works on Azure. Tools are published through API Management with a schema per operation and a policy that requires an on-behalf-of assertion. The tool implementation calls the semantic model, AI Search or the graph using the caller's exchanged token, so row-level security and index filters evaluate against the person rather than the service. Managed identity is used only for the platform's own stores, never for tenant business data.

What it buys

• Compromising the orchestrator yields the ability to ask questions as the caller, and nothing more
• Every read is typed, logged and replayable, which is what makes the audit trail meaningful
• Tool latency and failure rate become measurable per source

What it costs

• Every new question class may need a new tool, which is slower than a general query interface
• The tool catalogue becomes a governed artefact with its own change process
• Per-caller queries cache poorly, addressed in ADR-14

Choose differently when. Allow generated queries when the data is genuinely public within the organisation, the store is a disposable replica, and no answer leads to an action. Even then, budget for the query that scans everything.

Lesson. Give a model a capability, never a credential. The narrower the door, the easier it is to prove what came through it.

ADR-03 · Deterministic before generative: the model never produces a number

Status: Accepted · Shown on views: 02, 17, 19

When an executive asks for the cash position, what actually computes the figure?

Context. The requirement warns against asking the LLM to calculate financial KPIs when a deterministic engine can. The deeper problem is asymmetric consequence: a clumsy narrative is embarrassing and recoverable, whereas a wrong figure presented to a board is not. Executives also calibrate on the answers that turn out wrong, so a single fabricated number costs more trust than fifty good answers earn.

Decision. KPI values come from DAX measures in the governed semantic model. Forecasts, anomaly scores and risk scores come from registered ML endpoints with intervals. The language model classifies the question, plans the retrieval, frames the scenario and narrates the result. It never produces a figure, a forecast or a score.

How it works on Azure. The metric service is the only component permitted to query the Power BI semantic model, and it does so with the caller's identity so row-level security applies. Azure ML managed online endpoints serve forecasting and anomaly models as versioned artefacts. The routing table in view 17 is implemented as a classifier plus a dispatch map, and a test asserts that no other code path returns a numeric measure.

What it buys

• Numbers are reproducible, testable against expected values and explainable without reference to a model version
• The dominant cost path is avoided for most questions
• A model upgrade cannot change a reported figure

What it costs

• A question with no corresponding measure cannot be answered until the measure is built
• Measure coverage becomes an onboarding workstream with its own backlog
• The platform will sometimes abstain where a competitor confidently guesses

Choose differently when. Relax this for exploratory analysis clearly labelled as such, on data the user already has, where no figure leaves the session. Never relax it for anything that reaches a decision record.

Lesson. Decide which of your outputs are opinions and which are facts, and route them to different machinery. A system that blurs the two will eventually be wrong in the expensive direction.

ADR-04 · Every claim is bound to evidence, and abstention is a first-class outcome

Status: Accepted · Shown on views: 04, 15, 29

What does the platform do when it cannot support part of an answer?

Context. The brief asks the system to say "I don't have sufficient evidence to answer this reliably" rather than fabricate. That is easy to write and hard to build, because it requires knowing which parts of a generated answer are supported — which means the binding between claim and evidence must be mechanical rather than requested politely in a prompt.

Decision. The composition step returns a claim-to-evidence map alongside the prose. Each claim is verified against the retrieved evidence by an independent check. Unsupported claims are removed and the gap is stated. Where the whole answer fails, the platform abstains in those words. Abstention rate is a monitored metric and is deliberately not driven to zero.

How it works on Azure. Azure AI Content Safety groundedness detection performs the check, versioned independently of the generating model so the checker is not marking its own work. Evidence identifiers are minted by the tool plane at read time and carried through composition. The verdict, the dropped claims and the abstention are all written to the decision record and surface in view 30's evidence pack.

What it buys

• Trust is earned by the answers that are declined as much as by the ones given
• The evidence pack in view 30 becomes producible, because binding already exists
• Grounding rate is a release-blocking signal rather than a sentiment

What it costs

• Added latency on every turn, which is the first thing challenged when the 5-second target is missed
• Answers are shorter and occasionally less satisfying than an ungrounded competitor's
• An additional service in the critical path and in the cost model

Choose differently when. A lower bar is reasonable for an internal brainstorming assistant where the reader is expected to verify. It is not reasonable anywhere an answer can become an approval.

Lesson. "Do not hallucinate" is not a control. A control is a component that can fail the output, run by something other than the thing that produced it.

Experience and access

Where an executive meets the platform, and how a request gets in.

ADR-05 · Teams is the primary surface; the web app is the deep surface

Status: Accepted · Shown on views: 01, 02, 04

Where does an executive actually meet this platform?

Context. Executive adoption is the largest product risk, and the real incumbent is a chief of staff rather than a competing tool. Anything requiring an executive to open a new application, remember a URL and learn a navigation model starts at a disadvantage that accuracy will not recover. Approvals in particular already happen in Teams for most Microsoft-estate customers.

Decision. The morning brief, notifications and approvals are delivered as Adaptive Cards in Teams. Investigation, option comparison, drill-down and the governance centre live in a web application that a card can deep-link into. Mobile shares the web contract rather than having its own.

How it works on Azure. Azure Bot Service fronts the Teams channel; Adaptive Cards carry the brief and the approval action, with the action posting to the same Experience API the web app uses. The web app runs on Container Apps behind Front Door. Single sign-on flows from the Teams identity, so an approval requires no second authentication.

What it buys

• Approvals happen where the executive already is, which is the difference between daily use and abandonment
• One identity, one session, no second sign-in for an approval
• Push and presence come free rather than being built

What it costs

• Two front-end surfaces to maintain and to keep consistent
• A dependency on the customer's Microsoft 365 estate and its policies
• Adaptive Card capability limits constrain what the brief can show

Choose differently when. Lead with the web app where the customer is not a Teams organisation, or where a regulator objects to decision content transiting a collaboration platform — the brief then becomes an email deep-link.

Lesson. For executive software, distribution beats features. The surface that is already open wins arguments that the better interface loses.

ADR-06 · One front door: Front Door for the edge, API Management for the contract

Status: Accepted · Shown on views: 02, 08, 21, 26

What enforces tenant quota, contract and public exposure, and where?

Context. A multi-tenant platform needs per-tenant rate limits and token budgets, one enforced API contract per surface, and no public endpoint on anything behind the perimeter. Building that into the application means every service re-implements it and the sovereign tenants get a different answer from the pooled ones.

Decision. Azure Front Door Premium terminates TLS, provides WAF and DDoS protection, and reaches the platform over Private Link. API Management in internal VNet mode is the only ingress to the application, and is where tenant quota, token budgets and contract validation are enforced.

How it works on Azure. Front Door Premium origins connect by Private Link to an internal-mode APIM. APIM policies validate the Entra token, extract the tenant claim, apply per-tenant rate and token quotas, and forward with claims to Container Apps. No data or AI service has a public endpoint; all are reached through private endpoints with private DNS.

What it buys

• A noisy tenant is throttled before it reaches shared compute or shared model quota
• One contract per surface, versioned, with the policy visible to security review
• No public endpoint anywhere behind the perimeter

What it costs

• APIM Premium is a material fixed cost, which weighs heavily on a small siloed tenant
• Another hop in the latency budget
• Two products to configure before the first request is served

Choose differently when. Drop APIM for a single-tenant deployment with no quota requirement and one client; the policy layer is then genuinely unearned cost.

Lesson. Put multi-tenant fairness controls in infrastructure, not in application code. The tenant you need to throttle is the one whose code path you are least keen to touch.

ADR-07 · Simple questions are synchronous; investigations are durable orchestrations

Status: Accepted · Shown on views: 02, 15, 16

What happens when a question genuinely takes ninety seconds to answer?

Context. The requirement distinguishes a simple KPI question, targeted under five seconds, from a complex investigation where an asynchronous experience is acceptable. Holding an HTTP request open for ninety seconds fails at every proxy, loses all work on a restart, and gives the user a spinner instead of progress.

Decision. Turns needing at most four tool calls run synchronously. Anything larger is promoted to a durable orchestration with checkpoints, progressive disclosure of intermediate findings, and a resumable identifier the executive can leave and return to.

How it works on Azure. Durable Functions runs the investigation as an orchestration with activity checkpoints in its own state store, so a host restart resumes rather than restarts. Findings stream to the client over Server-Sent Events as each stage completes, and the same identifier is addressable later from the Teams card or the web thread.

What it buys

• Long investigations survive a deployment or a host failure
• Progressive disclosure makes ninety seconds feel like work rather than a hang
• The promotion threshold is a tuning knob rather than a rewrite

What it costs

• Two execution paths to build, test and observe
• The client must handle streaming and resumption
• Orchestration state is another store to secure and to reason about for residency

Choose differently when. Stay synchronous throughout if every question in your domain is bounded by a single system call. Go fully asynchronous if none of them are.

Lesson. Choose the interaction model from the work's distribution, not its average. The tail is what the user remembers.

Orchestration and agents

What plans a turn, what runs it, and where it is hosted.

ADR-08 · Azure AI Foundry Agent Service for the runtime, with the plan owned in our code

Status: Accepted · Shown on views: 02, 07, 16

Build the agent runtime, or adopt one?

Context. Agent frameworks are abundant and change quickly. The parts that matter here — tool calling with the caller's identity, threads, tracing, evaluation, and staying inside a private network boundary in a sovereign region — are infrastructure. The part that is genuinely ours is the planning policy: which capability answers which question, under what budget, with what fallback.

Decision. Adopt Azure AI Foundry Agent Service for thread management, tool invocation, tracing and evaluation. Keep the planning policy, the budget enforcement and the tool authorisation in our own orchestrator host, so the platform's distinctive behaviour is not a framework's default.

How it works on Azure. The orchestrator runs on Container Apps using Semantic Kernel for plan composition and calls Foundry Agent Service for agent execution. Tracing follows OpenTelemetry GenAI conventions into Application Insights, and Foundry's evaluation harness is reused for the release gate in ADR-30. All of it sits behind private endpoints in the tenant's network.

What it buys

• Tracing and evaluation exist from day one rather than being retrofitted
• Everything stays inside one network and residency boundary
• The routing policy is testable code we own

What it costs

• A dependency on a fast-moving managed service, including its regional availability
• Framework upgrades become a release concern
• Some capability duplication between the framework and our planner

Choose differently when. Build your own when you need portability across clouds, or when your orchestration is genuinely unusual. Adopt more of the platform when your team is small and your governance needs are ordinary.

Lesson. Buy the plumbing, build the judgement. The framework is not your product; the routing policy might be.

ADR-09 · Specialist agents are capability packs in one runtime, not separate applications

Status: Accepted · Shown on views: 02, 07, 16

Is a finance agent a deployment, or a configuration?

Context. The requirement names ten specialist domains and describes them as modular capabilities rather than independent LLM applications. It also asks for an agent marketplace as a product module. Those two only reconcile if adding a capability is cheap, and it is only cheap if it is not a deployment.

Decision. A specialist agent is a prompt pack plus a tool catalogue plus an evaluation set, versioned with the tenant configuration and loaded into one shared runtime. Agents return structured results to the orchestrator and never call each other.

How it works on Azure. Packs are configuration artefacts in the tenant configuration repository, schema-checked in the pipeline and loaded by the orchestrator host at start-up and on change. The tool catalogue per pack resolves to API Management operations the caller's role permits. Foundry threads keep per-agent context without a per-agent deployment.

What it buys

• A new domain is a configuration change with an evaluation set, not a release
• A tenant can be behind on a pack without being behind on the platform
• One runtime to secure, observe and scale

What it costs

• Packs share a blast radius: a bad shared runtime release affects every domain
• Per-domain resource limits must be enforced in the budget rather than by isolation
• Pack versioning becomes its own governance surface

Choose differently when. Split into services when a domain needs genuinely different scaling, a different compliance boundary, or an independent team release cadence.

Lesson. Modularity is a property of the configuration model, not of the deployment topology. Ten deployments are not ten modules; they are ten things to patch.

ADR-10 · Two model classes, routed — and a budget on every turn

Status: Accepted · Shown on views: 16, 17, 23

Which model answers, and what stops a single question costing a fortune?

Context. Most executive turns are routing and narration over a computed figure. A minority are genuine multi-step investigations. Sending everything to a reasoning model makes the common case slow and expensive, and an agentic system with unbounded fan-out has unpredictable unit economics — which breaks per-tenant pricing before it breaks the latency target.

Decision. A small, fast model performs intent classification, entity resolution and routing. A reasoning model is used only for planning an investigation and for final composition. Every turn carries an explicit budget for tokens, tool calls and wall-clock, set by the orchestrator before any agent runs.

How it works on Azure. Both deployments are Azure OpenAI in the tenant's region, with provisioned throughput sized for the briefing spike and pay-as-you-go overflow. API Management enforces the per-tenant token quota; the orchestrator enforces the per-turn budget and degrades to a narrower answer rather than exceeding it. Cost per interaction is exported to Fabric and alerted on per tenant.

What it buys

• Predictable cost per interaction, which a commercial model can be built on
• The common path is fast because it never touches the expensive model
• A runaway turn degrades gracefully instead of consuming the tenant's quota

What it costs

• Two deployments to manage, evaluate and keep pinned
• The router itself can be wrong, sending a hard question down a cheap path
• Budget exhaustion is a user-visible state that must be explained well

Choose differently when. Use a single model when volume is low enough that operational simplicity beats unit cost, or when routing errors are more damaging than latency.

Lesson. In an agentic system, cost is an architectural property, not an operational surprise. Decide the budget before the first token, or discover it on the invoice.

ADR-11 · Azure Container Apps for hosting, with AKS as a documented exit

Status: Accepted · Shown on views: 08, 21

What runs the application, given a mid-size tenant and a small platform team?

Context. The workload is a handful of stateless HTTP services with a pronounced daily spike around the morning brief and long quiet periods. The platform team runs many tenants and cannot afford per-tenant cluster operations. The requirement lists Container Apps, AKS and App Service as candidates without choosing.

Decision. Azure Container Apps for all application services, with scale rules on concurrent requests. AKS is recorded as the migration target if per-tenant scale, custom networking or a service mesh becomes necessary, and services are kept container-native so that migration is a hosting change rather than a rewrite.

How it works on Azure. One Container Apps environment per tenant runtime, VNet-integrated, with managed identity per app and Dapr left off until something needs it. Scale from three replicas to thirty on concurrency. Durable Functions runs on an Elastic Premium plan for the orchestration workload, which Container Apps does not serve as well.

What it buys

• No Kubernetes operations per tenant, which is what makes twenty tenants affordable
• Scale-to-low between briefings materially reduces the pooled-tier bill
• Deployment is an image reference, which keeps the release pipeline simple

What it costs

• Less control over networking and scheduling than AKS
• Platform limits may eventually bind, hence the recorded exit
• Two hosting models — Container Apps and Functions — to operate

Choose differently when. Start on AKS when you already run it well, when you need a service mesh or custom CNI, or when a single tenant's scale justifies a dedicated cluster.

Lesson. Choose the hosting platform for the team that will operate it at 3 a.m., not for the architecture diagram. Record the exit so the choice stays reversible.

Grounding and knowledge

How documents become citable evidence without leaking.

ADR-12 · Hybrid retrieval with the security filter applied before scoring

Status: Accepted · Shown on views: 14, 26, 27

How is the document estate searched without returning something the caller may not read?

Context. Executive questions mix concepts with exact identifiers — a contract number, a project code, a supplier name. Vector search alone handles identifiers poorly. Separately, the obvious implementation of permissions — retrieve, then filter the results — leaks nothing but silently returns a worse top-k, because the documents the caller may read were crowded out before filtering and never scored.

Decision. Retrieval is hybrid: vector and keyword, fused, then reranked. The caller's group membership is applied as a filter inside the search query, evaluated before scoring, so the top-k is drawn only from documents the caller may read.

How it works on Azure. Azure AI Search with a vector field from text-embedding-3-large alongside a searchable text field, combined by reciprocal rank fusion and reranked by the semantic ranker. Security identifiers captured at ingestion are stored as a filterable field, and every query carries an OData filter built from the caller's Entra group claims. Retrieve fifty, rerank to eight.

What it buys

• Identifier-shaped queries work, which is most of what an executive types
• Permissions cannot be bypassed by an application bug in the result-handling code
• Top-k is honest, so citation quality is measurable

What it costs

• Filter cardinality affects query performance on large indexes
• The security field must be maintained accurately at ingestion, which ADR-13 addresses
• Two retrieval modes and a reranker to tune and evaluate

Choose differently when. Vector-only is fine for a corpus with no access differentiation and no identifiers. Post-filtering is acceptable only when every user can read everything, which is rarely true and never true in government.

Lesson. Authorisation belongs inside the query, not after it. A filter applied to results protects the data and corrupts the ranking.

ADR-13 · Permissions and sensitivity are captured at ingestion and carried on the chunk

Status: Accepted · Shown on views: 14, 26, 30

Where does the index learn who may read a document?

Context. Re-deriving permissions at query time means calling the source system for every candidate document, which is slow and creates a dependency on a system that may be down. Deriving them once and forgetting them means the index becomes wrong the moment a permission changes. Sensitivity labels have the same problem and additionally drive the egress controls.

Decision. Source access-control identifiers and Purview sensitivity labels are captured during ingestion and written as fields on every chunk. They are never re-derived at query time. Documents are superseded rather than deleted, so a citation made four months ago still resolves to the version that was cited.

How it works on Azure. The crawl reads permissions through Microsoft Graph for SharePoint content and the source API elsewhere, writing group identifiers into a filterable collection field on each chunk. Purview classification runs at landing and its label is stored alongside. Re-crawl every four hours; high-sensitivity libraries are crawled more often, and content labelled restricted is re-checked against the source at query time, at a stated latency cost.

What it buys

• Query latency stays flat regardless of corpus size
• Retrieval keeps working when the source system does not
• Sensitivity is available to both the retrieval filter and the egress DLP

What it costs

• A permission drift window of up to one crawl interval, which must be stated to the tenant rather than glossed
• Ingestion becomes more complex and more failure-prone
• Superseding rather than deleting increases storage

Choose differently when. Re-derive at query time when the corpus is small, permissions change constantly, or the exposure window is legally unacceptable — and accept the latency openly.

Lesson. Copying an authorisation decision creates a staleness window. You cannot remove it; you can only measure it, shorten it for the material that matters, and tell people it exists.

ADR-14 · The semantic cache key includes the caller's permission fingerprint

Status: Accepted · Shown on views: 15, 27

How does a per-caller authorisation model coexist with a cache?

Context. ADR-27's rule — every read carries the caller's identity — makes results caller-specific, and caller-specific results cache badly. Caching on the question text alone is the obvious optimisation and is a data breach with a hit rate: two executives asking the same question are entitled to different answers.

Decision. Cached entries are keyed on the normalised question, the tenant, the model and prompt version, the data-freshness stamp, and a hash of the caller's effective permission set. Two callers share a cache entry only when they would have been entitled to identical results.

How it works on Azure. Azure Cache for Redis Enterprise holds the entries. The permission fingerprint is a stable hash of the caller's Entra group claims relevant to the sources involved, recomputed per session. Entries are invalidated on model or prompt version change and on the freshness stamp advancing, so a cached answer can never be stale in a way the answer does not admit.

What it buys

• Real hit rates during the briefing spike, where identical questions cluster
• A permission change naturally invalidates by changing the fingerprint
• Model and prompt version in the key means an upgrade cannot serve stale reasoning

What it costs

• Lower hit rate than a naive cache, and highly variable by tenant
• The fingerprint must be computed correctly or the whole guarantee is void
• Another store inside the residency boundary

Choose differently when. Cache on content alone only where every user has identical entitlements — a public corpus, or a single-role deployment.

Lesson. A cache key is an authorisation statement. Anything the answer depended on belongs in the key, and permissions are the thing most often left out.

Data and semantics

The analytical foundation, the shared model, and who is allowed to compute a number.

ADR-15 · Microsoft Fabric as the analytical foundation, with shortcuts instead of copies

Status: Accepted · Shown on views: 08, 11, 12

What holds the analytical data, given that most customers already have a lake?

Context. Every target customer has an existing warehouse, lake or BI estate. Copying it into the platform doubles the storage bill, creates a second version of the truth, and makes the platform responsible for data it did not produce. The requirement asks for integration with existing lakes and BI, not their replacement.

Decision. Microsoft Fabric provides OneLake, the lakehouse, the warehouse, pipelines and real-time ingestion on one capacity with one security model. The customer's existing lake is mounted as a OneLake shortcut wherever the storage supports it, rather than copied.

How it works on Azure. A Fabric capacity per tenant — dedicated F-SKU for siloed, a workspace on shared capacity for pooled. Medallion layout in OneLake, Data Factory pipelines for batch and change-data ingestion, Eventstream for events, and shortcuts to the customer's ADLS or supported external storage so their gold tables are readable without duplication.

What it buys

• One capacity, one storage layer, one security model, one lineage graph
• The customer's existing investment is read rather than duplicated
• The semantic model sits natively beside the warehouse that feeds it

What it costs

• Capacity sizing is a real per-tenant exercise and a real per-tenant cost floor
• A significant dependency on one product's roadmap
• Shortcut support varies by source storage, so some copies remain unavoidable

Choose differently when. Choose Databricks or a Synapse-style assembly where the customer's team already lives there, or where the engineering workload dominates the reporting workload.

Lesson. Prefer mounting to copying. A second copy of the truth is a second thing to reconcile, and reconciliation is where executive trust is lost.

ADR-16 · A canonical model with resolved entities, not query federation

Status: Accepted · Shown on views: 11, 12, 13

How does the platform answer a question that spans three systems that share no key?

Context. "Which suppliers are affecting projects that are already financially at risk?" requires supplier identity to be the same thing in the ERP, the procurement system and the portfolio tool. It is not: the same supplier is three records with three keys and often three spellings. Query federation joins tables; it does not resolve identity, and no amount of virtualisation supplies a key that does not exist.

Decision. A canonical model with explicit entity resolution for supplier, project, cost centre and contract. Conformed entities retain their source keys so a merge is reversible, and resolution runs as a pipeline stage with a human review queue for low-confidence matches.

How it works on Azure. Silver-layer notebooks in Fabric perform deterministic matching on identifiers and probabilistic matching on names and addresses, writing a crosswalk table with confidence scores. Matches below threshold enter a review queue surfaced in the tenant console. The crosswalk is the one table that is never cached downstream, because a merge is correct on approval and wrong for every consumer until they agree.

What it buys

• Cross-domain questions become answerable, which is the product's central claim
• Reversible merges, because entity resolution is a judgement and judgements get revised
• Match confidence is visible, so an answer can state that identity is uncertain

What it costs

• The hardest and most underestimated workstream in the programme, and it is not an AI problem
• A human review queue means an operational process, not just a pipeline
• A bad merge propagates into every answer until it is corrected

Choose differently when. Federate when the systems already share a reliable enterprise key. Buy MDM when several programmes need resolution and this one would be building it for everyone.

Lesson. Cross-system intelligence is an identity problem wearing an integration costume. Solve identity first, or the joins will be confidently wrong.

ADR-17 · One measure definition, owned by finance, shared with Power BI

Status: Accepted · Shown on views: 11, 12, 17

Who owns the definition of a KPI the platform reports?

Context. The fastest way to destroy executive trust is a figure that differs from the board pack, because it is not obviously wrong — it just makes both numbers suspect. Building a metric layer inside the platform guarantees this happens, since two definitions of gross margin will diverge within a quarter no matter how carefully they start.

Decision. KPI definitions live once, as measures in the governed semantic model, owned by the customer's finance function. The platform reads them; it does not restate them. Where the customer already owns a definition in their BI estate, the platform adopts it rather than writing its own.

How it works on Azure. A Power BI semantic model over the Fabric warehouse holds DAX measures with row-level security. The platform's metric service is the only component that queries it, using the caller's identity. Power BI reports read the same model, so a report and an answer cannot disagree. Measure changes go through the same versioned promotion as any other artefact.

What it buys

• A platform answer and a board pack cannot disagree
• Finance owns the definition, which is both correct and politically necessary
• Row-level security is defined once and inherited by every consumer

What it costs

• A hard dependency on the semantic model's availability and refresh schedule
• Measure coverage becomes an onboarding gate, and gaps are visible as abstentions
• Change control on measures is slower than the platform team would like

Choose differently when. Build your own metric layer when there is no incumbent BI estate to align with, or when the incumbent's definitions are known to be wrong and replacing them is in scope.

Lesson. Never own a second definition of a number someone else already owns. The reconciliation meeting costs more than the integration.

ADR-18 · A property graph for cross-domain relationships

Status: Accepted · Shown on views: 11, 13, 17, 18

What answers a question that is three relationship hops deep?

Context. The flagship question traverses supplier to contract to purchase order to project to budget line, then asks which of those projects are already at financial risk. In a star schema that is a chain of joins that must be written in advance; in a graph it is a traversal that can be composed at query time. Detection also needs to propagate a supplier signal outward to the projects it affects, which is the same traversal in reverse.

Decision. A property graph holds the canonical entities and the relationships between them, rebuilt from the gold layer. It holds relationships and identifiers, never measures — figures always come from the semantic model.

How it works on Azure. Azure Cosmos DB for Apache Gremlin, rebuilt from the Fabric gold layer on each refresh, zone-redundant. Vertices carry canonical identifiers and a small set of attributes used for traversal; every numeric answer is fetched from the semantic model by identifier after the traversal returns. The graph is therefore fully rebuildable and carries no independent recovery objective.

What it buys

• Multi-hop questions are composable at query time rather than pre-written
• Detection can propagate a signal along real relationships
• Fully rebuildable, so it needs no backup story of its own

What it costs

• Another store to secure, size and keep in step with the warehouse
• Gremlin is a skill the team must actually have
• A rebuild lag means the graph can briefly disagree with the warehouse, which must be stated

Choose differently when. Skip the graph when relationships are shallow and stable — two hops over a well-modelled star schema does not need one.

Lesson. Add a graph when the questions are about relationships rather than aggregates. Keep the measures out of it, or you now have two places a number can come from.

ADR-19 · Forecasts and anomaly scores come from registered models, not prompts

Status: Accepted · Shown on views: 17, 18

What produces the forecast behind "what happens if we do nothing?"

Context. The requirement asks for forecasting, anomaly detection, risk scoring and scenario analysis, and explicitly separates LLM reasoning from statistical calculation. A forecast presented to an executive needs an interval, a method that can be described, and reproducibility — a language model asked to project a trend supplies a number with the appearance of all three and none of the substance.

Decision. Forecasting, anomaly detection and risk scoring are registered, versioned models served behind managed endpoints. Every prediction returns an interval and the model version. The language model frames the scenario and explains the result; it never generates the projection.

How it works on Azure. Azure Machine Learning holds the registry and serves managed online endpoints with at least two nodes. Features come from the gold layer's feature store. Model version accompanies every prediction into the decision record, so a forecast shown four months ago can be attributed to the model that made it.

What it buys

• Every projection carries an interval, which is what makes "confidence" a number rather than an adjective
• Model version is auditable alongside the decision that used it
• Statistical quality can be improved without touching the conversational layer

What it costs

• An ML lifecycle to run — training, registration, drift monitoring — alongside the AI lifecycle
• Endpoint cost even at low utilisation
• Cold-start models for a new tenant with no history, which must be declared rather than hidden

Choose differently when. Use simple statistical baselines in the semantic model when the forecast horizon is short and the series is well behaved. Do not use a language model either way.

Lesson. A forecast without an interval is an opinion with a decimal point. If the component cannot express uncertainty, it should not be producing the number.

ADR-20 · Freshness is declared per source and published with every answer

Status: Accepted · Shown on views: 09, 11, 12, 25

What does "current" mean when twelve source systems refresh at twelve different rates?

Context. The requirement notes that not every source needs real-time integration, which is true and incomplete: the consequence is that "what changed since yesterday?" means something different for a source on fifteen-minute change capture than for one on a nightly extract. Silence about that difference is the failure mode that destroys trust fastest, because the answer looks authoritative either way.

Decision. Every source declares a freshness contract at registration. The platform records the actual as-of timestamp per source, publishes it with every answer that used the source, and raises an alert when a source falls behind its contract. Zones are organised by rebuildability, so only the operational estate carries a real recovery objective.

How it works on Azure. Data Factory pipelines write an as-of watermark per source into a freshness register in the gold layer. The tool plane reads it and attaches it to every result, so the composition step can state it. Azure Monitor alerts when a watermark exceeds its contract, and view 25's degradation contract says what the answer does in that case: serve the last good value with the date shown, up to 24 hours, then withhold.

What it buys

• An executive can tell how much weight to put on a figure
• Stale-source incidents are detected by the platform rather than reported by the user
• Ingestion cost is spent where freshness is actually needed

What it costs

• Every answer carries more qualification, which takes design work to keep readable
• A freshness register to maintain per source and per tenant
• Some questions become unanswerable rather than answered approximately

Choose differently when. A single global freshness statement is enough when all sources genuinely refresh together. That is rare outside a single-system deployment.

Lesson. Publish the age of your data. An answer that hides how old it is has substituted confidence for accuracy.

Decision and execution

Turning a recommendation into a governed action, and knowing whether it worked.

ADR-21 · One execution plane holds every write credential in the estate

Status: Accepted · Shown on views: 02, 20, 26

What is actually permitted to change a record in an enterprise system?

Context. The requirement states that AI must never have unrestricted write access. The weaker reading — give the agent a write tool and guard it with a prompt — fails to the first prompt injection through a retrieved document. The strong reading is that the AI identity should hold no write scope at all, so that there is nothing to be talked into using.

Decision. Agents may only create action proposals. A separate execution plane, holding a distinct connector identity per target system, performs the write after a human approval, with an idempotency key and an authority re-check at execution time.

How it works on Azure. Approved proposals go to Azure Service Bus with peek-lock and dead-lettering. Logic Apps Standard workflows claim them and call the target system through its connector, each workflow running under its own user-assigned managed identity scoped to one system and one operation set. The external reference returned by the target system is written back to the decision record. The Azure OpenAI and orchestrator identities have no write role assignment anywhere.

What it buys

• The AI's blast radius on write is exactly zero by construction, not by policy
• A compromise of one connector identity is bounded to one system
• Idempotency and retry are solved once, in one place

What it costs

• Another component in the path from approval to effect
• Connector identities and their scopes are a real ongoing governance burden
• Terminal-unknown outcomes must be reconciled against the target system rather than retried

Choose differently when. Collapse the plane into the application only where writes are to a system you fully own and a compromise is contained anyway. Never collapse it where the model can read untrusted content.

Lesson. The safest way to stop a model misusing a credential is not to give it one. Separate the thing that decides from the thing that acts.

ADR-22 · Options with cost, risk and delay — not a single recommendation

Status: Accepted · Shown on views: 04, 19, 20

What should the platform put in front of an executive at the moment of decision?

Context. The requirement is explicit: the executive should decide with evidence rather than simply receive an AI-generated recommendation. This is a product decision as much as an architectural one. A single recommendation asks for trust the platform has not earned and gives the executive nothing to reason with; three options with their trade-offs give them the thing they are actually paid to do.

Decision. The decision engine produces a situation summary, evidence, root cause, forecast, impact and an option set — each option carrying cost, risk and expected delay — plus a recommended option and its confidence. The executive may approve, reject, request more information, delegate or escalate, and a rejection is recorded as evidence too.

How it works on Azure. The decision service composes the option set from deterministic inputs: cost from the semantic model, risk from the ML risk endpoint, blast radius from the graph, precedent from retrieval. The language model orders and narrates them. Approval thresholds and dual-approval rules are tenant configuration evaluated by the policy engine, not code.

What it buys

• The executive's judgement is supported rather than replaced, which is what gets the platform adopted
• Rejected options are retained, so an audit sees the alternatives too
• Confidence becomes a computed property of the inputs rather than a tone of voice

What it costs

• Generating credible options is much harder than generating a recommendation
• Cost, risk and delay must each come from somewhere defensible
• More screen space and more executive reading time per decision

Choose differently when. A single recommendation is right for high-volume, low-stakes decisions where the cost of reading three options exceeds the cost of being wrong.

Lesson. Decision support means supplying the trade-off, not the conclusion. The conclusion is the part the executive is accountable for.

ADR-23 · The loop closes on the record it opened

Status: Accepted · Shown on views: 19, 20, 23

How does anyone find out whether an intervention worked?

Context. The requirement asks for closed-loop monitoring — decision, action, outcome, KPI monitoring, escalate or recommend next. Most platforms stop at the action, which means the organisation learns nothing and the same intervention is proposed again next quarter with the same result.

Decision. Every executed action schedules an outcome watch on the KPI it was meant to move, over a window set per action class. The verdict — improved, unchanged, worsened or inconclusive — is written to the same decision record, and a failed intervention reopens that decision rather than starting a new one.

How it works on Azure. The decision service schedules the watch on execution. A Fabric job compares the KPI against the forecast that justified the action and writes the verdict. Reopening posts a new Teams card that links to the original record, so the executive sees what changed rather than a fresh, contextless alert.

What it buys

• Recommendation quality becomes measurable rather than asserted
• A failed intervention escalates instead of being quietly forgotten
• Precedent for the option set in ADR-22 accumulates naturally

What it costs

• Attribution is genuinely hard — many things move a KPI in fourteen days
• Slow-moving public-sector outcomes will often return inconclusive
• A scheduling and state-management burden per executed action

Choose differently when. Skip the loop only where actions have no measurable effect on any tracked metric — in which case, ask why the action was recommended.

Lesson. "Inconclusive" must be a permitted verdict. A closed loop that can only report success is not measuring anything.

ADR-24 · Proactive detection is deterministic and scheduled

Status: Accepted · Shown on views: 17, 18, 23

What actually notices that something is going wrong?

Context. The requirement asks the platform to proactively surface exceptions, emerging risks, KPI deterioration and anomalies. The obvious implementation — an agent that continuously monitors the business — is unaffordable at any real data volume, non-deterministic, and impossible to test. The harder truth is that detection is not the difficult part: triage is. A brief with forty exceptions has surfaced none.

Decision. Detection is a scheduled deterministic pipeline: thresholds from tenant configuration, anomaly models, forecast deviation, and graph propagation from one domain's signal to another's entities. Language models narrate a signal a detector has already raised. Triage — materiality scoring, deduplication to one item per root cause, and expiring logged suppressions — decides what reaches the brief.

How it works on Azure. An hourly Fabric job scores gold-layer measures against baselines and calls the Azure ML anomaly endpoint; supply-chain and financial-anomaly classes are additionally event-triggered through Eventstream. Signals below the materiality bar are recorded rather than discarded, so a missed exception can be traced to the threshold that hid it. Suppressions are attributed, expiring records — never silent.

What it buys

• Detection is testable against historical data — you can ask whether it would have caught last year's overrun
• Cost is a function of data volume rather than of model calls
• Suppression is visible and expiring, so it cannot quietly become a repealed control

What it costs

• Detectors must be authored and tuned per tenant, which is onboarding effort
• Novel failure modes nobody wrote a detector for are missed
• Threshold tuning is a recurring operational task, not a one-off

Choose differently when. Use a model-driven exploratory sweep where the failure modes are genuinely unknown and volumes are small enough to afford it — as a supplement to deterministic detection, never as a replacement.

Lesson. Detection is cheap and triage is the product. The measure of a proactive system is what it decided not to tell you.

Multi-tenancy

How one product serves many organisations without becoming many products.

ADR-25 · Isolation is a purchased tier, not an engineering compromise

Status: Accepted · Shown on views: 08, 10, 21

How isolated is one customer from another?

Context. The requirement asks for logical or physical isolation appropriate to each customer's security tier, and names a sovereign public-sector scenario. A single answer cannot serve both a commercial group that wants a low price and a ministry that will not share a database server with anyone. Choosing pooled-only loses the sovereign customers; choosing siloed-only makes the product unaffordable for everyone else.

Decision. Two tiers from one codebase. Pooled tenants share compute with a per-tenant search index, row-level security, per-tenant encryption keys and a per-tenant Fabric workspace. Siloed tenants get a dedicated subscription deployed from the same templates. Sovereign public-sector tenants are siloed by default. Changing tier is re-running the onboarding pipeline against a new subscription.

How it works on Azure. A shared control plane holds the tenant registry — tier, region, key references, configuration version — and never tenant business data. Bicep templates parameterised by tier deploy either a workspace in shared capacity or a full dedicated subscription. Pooled data separation is Azure SQL row-level security plus per-tenant customer-managed keys; siloed is a separate database, capacity and key vault.

What it buys

• One product, one release, two shapes — so tenant twelve costs materially less than tenant two
• Sovereign requirements are met without special-casing the code
• The control plane can be operated by one team without access to any tenant's data

What it costs

• Every feature must be tested in both shapes, which roughly doubles the release matrix
• The pooled tier's shared index is a real leak path requiring automated proof, not review
• Two cost models and two capacity-planning exercises

Choose differently when. Pooled-only is right for a purely commercial product with no regulated customers. Siloed-only is right when every customer is regulated and the price supports it.

Lesson. Make isolation a product tier with a price, not an engineering promise. Then the customer chooses the trade-off, and the architecture stops pretending it can avoid one.

ADR-26 · Configuration, not custom code — but the configuration is engineered

Status: Accepted · Shown on views: 05, 10, 22

What changes when a new customer wants a different KPI, threshold or approval limit?

Context. The requirement lists eleven things each tenant must be able to configure. "Configuration, not custom code" is the right principle and is routinely undermined in practice, because the configuration is stored as untyped rows in a database, edited live through an admin screen, unversioned, unreviewed and impossible to roll back. That is custom code with worse tooling.

Decision. Tenant configuration — KPI packs, hierarchy, agent packs, data sources, policies, approval thresholds, workflows, dashboards, risk models, terminology and prompts — is a set of versioned, schema-checked artefacts in a repository, promoted through the same rings as code. Industry packs for government, banking, energy and conglomerate are the reusable starting points.

How it works on Azure. One branch per tenant in a configuration repository. The pipeline validates against a JSON schema and rejects unknown keys, so a typo fails the build rather than silently disabling a threshold. Azure Deployment Environments applies configuration alongside the image. The tenant console writes through the same pipeline, so a customer's Tuesday change is still versioned and reversible.

What it buys

• A misconfiguration is diffable, attributable and revertible
• Industry packs make each successive tenant cheaper, which is the commercial thesis
• The same promotion path for code and configuration means one release process

What it costs

• Slower than editing a row, and customers will notice
• A schema to maintain, version and migrate as the product evolves
• The tenant console must write through the pipeline, which is more work than writing to a table

Choose differently when. Direct database configuration is fine for genuinely cosmetic settings with no blast radius. Anything that can change what an executive is told, or what may be approved, belongs in the pipeline.

Lesson. If configuration can break production, it deserves the same rigour as code. "It is only config" is how outages are introduced by people who thought they were being careful.

Sovereignty and security

Residency, key custody, and the authority chain from person to row.

ADR-27 · Residency enforced by policy, network and key custody

Status: Accepted · Shown on views: 21, 26, 28

What makes a data-residency claim true rather than merely stated?

Context. Public-sector customers in the target jurisdiction require data residency and sovereign hosting with nationally mandated information-assurance controls. A contractual assurance is not a control: it cannot stop a developer creating a resource in the wrong region, and it cannot stop a compromised service sending data somewhere else. The claim has to be enforced by something that fails closed.

Decision. Residency is enforced at three layers. Azure Policy at the management-group level denies resource creation outside the permitted region. All PaaS services are reachable only through private endpoints, and the single egress path is an Azure Firewall with an FQDN allow-list. The customer holds the encryption key in a managed HSM, so revocation makes the data unreadable.

How it works on Azure. A management group per sovereignty class carries deny-effect policies on location and on public network access. Hub-and-spoke networking with private endpoints and private DNS for every data and AI service; Azure Firewall Premium is the only route out, with an explicit allow-list. Key Vault Managed HSM holds customer-managed keys for the lake, the decision store, the search index and the evidence store. Customer Lockbox governs vendor support access, and PIM removes standing administrative privilege.

What it buys

• A residency claim that can be demonstrated to an auditor rather than asserted
• Key revocation is a real customer-held control
• A misconfiguration cannot deploy out of region, because the platform refuses

What it costs

• Private networking makes development and diagnosis materially harder
• Customer-managed keys introduce a customer-caused outage mode that must be understood on both sides
• Policy exceptions become a governed process with expiry dates

Choose differently when. Lighter controls are proportionate for a commercial tenant with no residency obligation — and the tier model in ADR-25 is what lets them have that without a second product.

Lesson. A sovereignty claim is only as strong as the control that fails closed when someone tries to break it. Everything else is a sentence in a contract.

ADR-28 · The caller's authority reaches the row; no read-everything identity exists

Status: Accepted · Shown on views: 26, 27

Whose permissions apply when an agent reads a table?

Context. The requirement is explicit that the AI must inherit the user's authorisation context, and contrasts it with the pattern where a privileged identity reads freely and the application filters afterwards. The second pattern is far easier to build and turns every application bug into a data breach, because the only thing between one executive and another's data is a correct WHERE clause in code nobody reviews as a security control.

Decision. The caller's identity is exchanged on behalf of and carried into every downstream read. Row-level security in the semantic model and group filters in the search index are evaluated as the caller. No service identity exists that can read all tenant business data.

How it works on Azure. Entra ID on-behalf-of exchange at the Experience API produces a downstream token with the user's scopes. The tool plane passes it to the semantic model, where row-level security applies, and builds the search filter from the caller's group claims. Managed identities are used only for the platform's own operational stores. Conditional Access, device compliance and MFA gate the original sign-in.

What it buys

• Authorisation correctness is inherited from systems that already got it right
• No privileged identity exists to be stolen
• The security story is one sentence a CISO can check

What it costs

• Caching becomes hard, which ADR-14 addresses at the cost of hit rate
• Scheduled work has no user to act as and needs its own constrained pattern
• A source that cannot express permissions constrains what the platform can offer over it

Choose differently when. A service identity is acceptable where all data is uniformly accessible to all users of the platform. In an executive context spanning HR, finance and procurement, it never is.

Lesson. Inherit authorisation; do not re-implement it. The second implementation is the one that will be wrong, and nobody will notice until it matters.

ADR-29 · Regional model availability is carried as a contracted risk, not an assumption

Status: Accepted · Shown on views: 21, 28

What happens if the models this design assumes are not available in the sovereign region?

Context. The design places inference in country, which is what makes the sovereignty argument work. AI service and model availability varies by Azure region, changes over time, and is outside the programme's control. Quietly assuming availability is the most likely way for this architecture to be invalidated after signature, and it is precisely the kind of assumption that architecture documents bury.

Decision. Regional model and service availability is treated as an explicit, named risk with three pre-agreed fallbacks, verified against the region's current service list before contract and re-verified at each major release. The choice of fallback belongs to the customer and is recorded in the contract rather than decided by the platform team.

How it works on Azure. The tenant registry records the permitted inference region per tenant, and the orchestrator routes model calls accordingly, so a fallback is a configuration change rather than a redeployment. Azure Policy still denies data-at-rest outside the permitted region regardless of where inference runs, which keeps the residency claim intact under fallback two.

What it buys

• The largest external dependency is visible to the sponsor before commitment rather than after
• Routing per tenant means a fallback does not require re-architecture
• Data residency survives fallback two, because storage location is enforced separately from inference location

What it costs

• A commercial conversation that is easier to postpone than to have
• Fallback two weakens the strongest version of the sovereignty claim and must be described accurately
• Re-verification is recurring work at every major release

Choose differently when. Where the target region's AI service list is mature and stable, this becomes a routine dependency check rather than a headline risk — but it remains a check.

Lesson. Name the dependency that could invalidate your design, and price its alternatives before signature. An architecture document that hides its biggest assumption is marketing.

Operations and assurance

Releasing safely, degrading honestly, and proving it afterwards.

ADR-30 · Evaluation is a release gate, and a prompt is a release artefact

Status: Accepted · Shown on views: 22, 24

What stops a prompt change quietly degrading every tenant's answers?

Context. A prompt change can break accuracy as thoroughly as a code change and is far easier to make casually, often by someone improving a phrase. Model upgrades have the same property and arrive on the vendor's schedule rather than ours. Without a gate, quality regression is discovered by an executive, which is the most expensive possible detection mechanism.

Decision. Prompts are versioned artefacts released with the container image and rolled back with it. Every release runs a golden-question suite, scoring retrieval and generation separately, with a no-regression rule. Tenants may pin a model version and opt in to upgrades on their own schedule. Production failures are mined back into the suite.

How it works on Azure. The prompt registry is versioned configuration. Azure AI Foundry's evaluation harness runs the suite in the pipeline against a staging deployment; retrieval metrics and generation metrics are gated separately so a regression has a stage. Ring deployment sends the change to one pilot tenant before all tenants, and view 23's grounding-rate signal is watched for twenty-four hours afterwards.

What it buys

• A regression has a stage and an owner rather than a shrug
• A tenant's own questions become the acceptance criteria, which is also a good sales artefact
• Model deprecation becomes a scheduled migration instead of an emergency

What it costs

• Evaluation runs cost real money on every release and will be the first target of a cost exercise
• Golden sets rot and must be actively maintained from production failures
• Release cadence slows, which the team will feel before the customer feels the benefit

Choose differently when. Lighter evaluation is proportionate for an internal assistant where a wrong answer costs a few minutes. It is not proportionate anywhere an answer becomes an approval.

Lesson. Anything that changes the output is a release artefact. If it can be edited in production without a gate, it will be, on a Friday.

ADR-31 · Evidence is snapshotted, and the writer cannot delete

Status: Accepted · Shown on views: 06, 11, 30

What does an auditor see when they ask what the approver saw?

Context. Re-running the query that produced a figure gives today's number. Four months later the underlying data has been restated, a mapping has been corrected, or a period has closed — so a decision that was correct at the time looks negligent. Separately, an audit trail that the application can delete from is not an audit trail; it is a log.

Decision. Evidence is a snapshot taken at the moment of the answer and stored immutably, never re-derived. The identity that writes the audit trail has no delete permission, and immutability is enforced by the storage service rather than by application logic. Options that were shown and rejected are retained.

How it works on Azure. Evidence payloads are written to Azure Blob Storage under a time-based immutability policy with legal hold, and referenced from the decision record by identifier. A per-tenant, per-day hash chain covers the record set. The writing identity holds a write-only role assignment; deletion requires a separate, PIM-elevated identity that cannot write. Access events flow to Sentinel, so reading a decision record is itself audited.

What it buys

• A decision can be judged on what was known at the time, which is the only fair basis
• An application compromise cannot rewrite history
• The evidence pack in view 30 is a mechanical export rather than a reconstruction

What it costs

• Storage grows with every answer, and ten-year retention makes that a real, ongoing cost
• Immutability means mistakes are permanent, including accidentally captured sensitive content
• A separate deletion identity is operational friction, deliberately

Choose differently when. Storing the query alone is acceptable where the underlying data is genuinely immutable — an append-only event log, for instance. Very little enterprise finance data qualifies.

Lesson. An audit answers "what did they know then?", not "what is true now?". Systems that re-query at audit time are answering the wrong question confidently.

ADR-32 · A written degradation contract, and one place the platform fails closed

Status: Accepted · Shown on views: 23, 25

What does an executive get at 07:10 when a dependency is down?

Context. The requirement asks for graceful degradation when an enterprise system is unavailable. That is only real if it is written down per dependency and per capability, agreed with the tenant and exercised — otherwise it resolves to a 500 during the morning brief, which is when the platform's reputation is actually set.

Decision. A degradation matrix states, per dependency and per capability, what still works, what degrades and what stops. Every degraded state names itself in the answer. The platform fails open with a stated caveat everywhere except one case: if the decision cannot be recorded, it refuses to act rather than acting unrecorded.

How it works on Azure. Health of each dependency is evaluated by the tool plane before composition, and the resulting capability state is attached to the answer. Cached KPI values are served up to twenty-four hours with the as-of date shown, then withheld. Approvals queue in Service Bus when the execution plane is unavailable and are re-authorised on return. Degradation states are exercised in a quarterly game day per tenant tier.

What it buys

• Degradation is a designed behaviour with an owner rather than an emergent one
• The tenant knows in advance what an outage looks like, which is a contractual conversation had calmly
• The one fail-closed case is defensible precisely because it is the only one

What it costs

• Every capability needs a degraded path built and tested, which is real engineering
• Game days cost time per tenant tier
• More states in the user interface to design and explain

Choose differently when. Fail closed more broadly where a partial answer carries regulatory consequence — clinical or safety-critical contexts, for instance, where a caveat is not sufficient protection.

Lesson. Decide where you fail open and where you fail closed, write it down, and test it. A system without a degradation contract has one anyway; it just has not been reviewed.

The Azure services used, in one table

Every Azure service on these thirty views, what it is, and what it is doing here. The last column names what was considered instead, so the table doubles as a shortlist for anyone adapting this design to a different estate.