AI Executive Office — CXO Assistant Platform  ·  View 11 of 30  ·  4 · Data

Data Architecture — Zones by Rebuildability

Which stores are a cache with a rebuild script, and which one is the thing a regulator reads.

Editable source SVG draw.io All views
Analytical estate — every zone below is rebuildable from the one above it Bronze — landed as received, never edited Source extracts Delta · 90 d CDC feeds append-only Document originals hash on land Event archive replayable Silver — conformed to the canonical model Conformed entities canonical keys Resolved master supplier · project Document chunks ACL carried through Time series KPI history Gold — serving, and only serving Canonical warehouse star schema Semantic model one KPI definition Search index vector + ACL fields Entity graph cross-domain joins Feature store model inputs Operational estate — the platform's own system of record, rebuildable from nothing Decision store RPO 5 min · GZRS Action proposals state machine Audit and lineage WORM · 10 y Evidence snapshots immutable blob Tenant config versioned · in Git Source systems truth for the business Lose the decision store and the audit trail is gone the only zone with a real RPO extract as-of snapshot Data Architecture — Zones by Ownership and Rebuildability Data store External / third party Risk / gap batch synchronous Gold is a cache with a rebuild script. The operational estate is not: it is what the regulator reads, so it carries the backup, the retention and the RPO. v 1.0 · owner Data & AI Global Practice · date 2026-09

The organising idea

  • The analytical estate is zoned by what can be rebuilt: gold is derived from silver, silver from bronze, bronze from the source. None of it carries a real recovery objective, because losing it costs time rather than truth
  • The operational estate can be rebuilt from nothing. Decisions, approvals, evidence snapshots and the audit trail exist only here, so this is where the backup, the retention policy and the RPO live
  • Splitting the two is what lets the analytical side be sized for cost and the operational side for durability

Numbers

  • Decision store: RPO 5 minutes, geo-zone-redundant, point-in-time restore 35 days
  • Evidence and audit: immutable storage with legal hold, 10-year retention
  • Bronze: 90-day rolling retention; gold: rebuildable in under 6 hours from bronze

Assumptions

  • Document originals are hashed at landing but not copied out of the source repository where the source supports stable versioned reads. Where it does not, the platform keeps a copy and inherits its classification
◀  Multi-Tenancy and Isolation All views Data Flow — Source to Answer  ▶
Solution Architecture v1.0 · Azure-native, multi-tenant, sovereign-capable · Data & AI Global Practice · 2026-0911-data-architecture-zones