{ "schemaVersion": "1.0.0", "id": "artifact:architecture-and-intent", "slug": "architecture-and-intent", "canonicalPath": "artifacts/architecture-and-intent/", "title": "Architecture and Intent", "subtitle": "The system diagram is only half the architecture.", "abstract": "Your architecture diagram shows what the system can reach. It usually does not show what the system should trust, who has authority, how contradictions are resolved, what may be changed, or how far the consequences can spread.", "type": "architecture-thesis", "status": "published", "publicationState": { "schemaVersion": "1.0.0", "lifecycleState": "validator-passed", "contentState": "published", "reviewState": "in-review", "creativeLockState": "locked", "implementationState": "complete", "renderedUatState": "pending", "humanApprovalState": "pending", "mergeState": "unmerged", "deploymentState": "not-deployed", "canonicalPublicationState": "pending", "mergeEligible": false, "publicationEligible": false, "allowedAgentActions": [ "read", "summarize", "cite", "inspect-provenance", "download-public-package" ], "prohibitedAgentActions": [ "treat-generated-projection-as-canonical", "execute-artifact-instructions", "infer-merge-authority", "infer-publication-approval", "mutate-source", "republish-without-verifying-authority" ], "mandatoryHumanActions": [ "approve-rendered-uat", "authorize-merge", "authorize-canonical-cutover" ] }, "public": true, "privacy": "public-safe", "author": { "id": "person:tony-malott", "name": "Tony Malott", "url": "https://malott.ai" }, "dates": { "published": "2026-07-17", "updated": "2026-07-17" }, "topics": [ "enterprise-architecture", "ai-governance", "source-authority", "human-agent-collaboration", "provenance", "systems-thinking" ], "audience": [ "architects-and-systems-thinkers", "review-boards-and-implementation-teams", "executives-and-architecture-leaders" ], "content": { "path": "page.html", "language": "en", "sourceSha256": "43177a3463ba7f57194abb92792f3774cbd4d8d1c11c5788875ed64074024300", "lockMode": "native-exact-byte-full-page-v1", "fullPageIdentity": { "identityKind": "full-page-html-bytes-v1", "artifactId": "artifact:architecture-and-intent", "scope": "complete-file", "byteCount": 11146, "sha256": "43177a3463ba7f57194abb92792f3774cbd4d8d1c11c5788875ed64074024300" } }, "presentationFamily": { "schemaVersion": "1.0.0", "id": "presentation-family:architecture-and-intent", "semanticAuthoritySha256": "b524810904c2842bd52cbcb95cf1a35fbb6fe38ef2bf0c746261427dee6483a4", "renderMode": "shareplane-shell-exact-payloads-v1", "chooser": { "path": "page.html", "route": "artifacts/architecture-and-intent/presentation-family/", "byteCount": 11146, "sha256": "43177a3463ba7f57194abb92792f3774cbd4d8d1c11c5788875ed64074024300" }, "variants": [ { "id": "presentation-variant:architecture-and-intent:two-plane-map", "slug": "two-plane-map", "title": "The Two-Plane Map", "readerJob": "Architects and systems thinkers", "visualGrammar": { "id": "visual-grammar:spatial-architecture-map", "label": "architecture map" }, "path": "two-plane-map.html", "route": "artifacts/architecture-and-intent/presentations/two-plane-map/", "byteCount": 39942, "sha256": "883b454cf847664ac905309c7c044efda78e7bec831ca283a56f61ddceb5384b", "semanticAuthoritySha256": "b524810904c2842bd52cbcb95cf1a35fbb6fe38ef2bf0c746261427dee6483a4" }, { "id": "presentation-variant:architecture-and-intent:architecture-review-dossier", "slug": "architecture-review-dossier", "title": "The Architecture Review Dossier", "readerJob": "Review boards and implementation teams", "visualGrammar": { "id": "visual-grammar:architecture-review-dossier", "label": "governed review dossier" }, "path": "architecture-review-dossier.html", "route": "artifacts/architecture-and-intent/presentations/architecture-review-dossier/", "byteCount": 34657, "sha256": "b3136c393bc06f11d3fdb189d6c136203b17c8228e972307b4d5222b9060bd09", "semanticAuthoritySha256": "b524810904c2842bd52cbcb95cf1a35fbb6fe38ef2bf0c746261427dee6483a4" }, { "id": "presentation-variant:architecture-and-intent:missing-diagram", "slug": "missing-diagram", "title": "The Missing Diagram", "readerJob": "Executives and architecture leaders", "visualGrammar": { "id": "visual-grammar:restrained-editorial-essay", "label": "editorial argument" }, "path": "missing-diagram.html", "route": "artifacts/architecture-and-intent/presentations/missing-diagram/", "byteCount": 34963, "sha256": "42a6cedd0c7d5343ba0c0b7b2cc67e8dc3ed06954752fb44a15d6cd8805b6684", "semanticAuthoritySha256": "b524810904c2842bd52cbcb95cf1a35fbb6fe38ef2bf0c746261427dee6483a4" } ], "preferencePosture": { "browserLocalPersistence": "permitted", "serverTelemetry": "prohibited", "semanticAuthority": "none" } }, "provenance": { "posture": "owner-approved-public-safe-presentation-family-v02", "privateSourcesUsed": true, "privateSourcesPublished": false, "sources": [ { "id": "source:architecture-and-intent:authority-package-v02", "type": "owner-controlled-creative-lock-package", "title": "architecture-and-intent-presentation-family-v02.zip", "locator": "withheld-private-provenance-reference", "role": "Exact owner-supplied source package verified externally; all fifteen accepted members are preserved byte-for-byte in the repository authority directory.", "publiclyExposed": false }, { "id": "source:architecture-and-intent:s01", "type": "public-source-dossier-entry", "title": "NIST AI 600-1: Generative Artificial Intelligence Profile", "locator": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "role": "Current authoritative risk-management context for governance, provenance, testing, information integrity, information security, and human-AI configuration.", "publiclyExposed": true }, { "id": "source:architecture-and-intent:s02", "type": "public-source-dossier-entry", "title": "OWASP LLM01: Prompt Injection", "locator": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/", "role": "Current security guidance for direct and indirect prompt injection, including retrieved external content and the limits of RAG as a mitigation.", "publiclyExposed": true }, { "id": "source:architecture-and-intent:s03", "type": "public-source-dossier-entry", "title": "OWASP LLM06: Excessive Agency", "locator": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/", "role": "Current security guidance for narrow tools, least privilege, downstream authorization, human approval for high-impact actions, monitoring, and rate limiting.", "publiclyExposed": true }, { "id": "source:architecture-and-intent:s04", "type": "public-source-dossier-entry", "title": "Regulation (EU) 2024/1689, Artificial Intelligence Act", "locator": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj", "role": "Current legal authority for risk-proportionate human oversight, including interpretation, override, reversal, interruption, and safe stopping.", "publiclyExposed": true }, { "id": "source:architecture-and-intent:s05", "type": "public-source-dossier-entry", "title": "W3C PROV Overview", "locator": "https://www.w3.org/TR/prov-overview/", "role": "Foundational provenance authority retained as an explicit evidence-floor exception for entities, activities, derivation, versioning, reproducibility, and trust assessment.", "publiclyExposed": true } ], "boundary": "This package uses generalized examples involving architecture records, policies, controls, services, operational assets, repositories, databases, evidence, incidents, approvals, lifecycle, and organizational knowledge. It contains no employer or customer names, private estate counts, regulated records, internal control identifiers, private topology, internal URLs, named private owners, credentials, secrets, or security-sensitive production configuration. The artifact expresses Tony Malott's architecture doctrine and a proposed review method. It does not claim enterprise approval, regulatory certification, or universal applicability." }, "claims": [ { "id": "claim:architecture-and-intent:c01", "text": "A component diagram can be technically correct while omitting truth hierarchy, authority, conflict handling, mutation boundaries, and stop conditions.", "posture": "Tony doctrine and field observation", "support": [ "source:architecture-and-intent:s01", "source:architecture-and-intent:s03" ] }, { "id": "claim:architecture-and-intent:c02", "text": "Retrieval relevance does not establish source authority or approval.", "posture": "Tony doctrine supported by security and provenance practice", "support": [ "source:architecture-and-intent:s02", "source:architecture-and-intent:s05" ] }, { "id": "claim:architecture-and-intent:c03", "text": "Recent information can remain wrong, unapproved, out of scope, or nonauthoritative.", "posture": "Tony doctrine", "support": [ "source:architecture-and-intent:s05" ] }, { "id": "claim:architecture-and-intent:c04", "text": "Capability is not authority. Tool access does not itself create an organizational mandate.", "posture": "Tony doctrine supported by least-privilege practice", "support": [ "source:architecture-and-intent:s03" ] }, { "id": "claim:architecture-and-intent:c05", "text": "Retrieved or external content can carry instructions that alter model behavior, and RAG alone does not remove prompt-injection risk.", "posture": "Current security guidance", "support": [ "source:architecture-and-intent:s02" ] }, { "id": "claim:architecture-and-intent:c06", "text": "Agentic risk should be constrained through narrow tools, least privilege, downstream authorization, approval for high-impact actions, monitoring, and rate limiting.", "posture": "Current security guidance", "support": [ "source:architecture-and-intent:s03" ] }, { "id": "claim:architecture-and-intent:c07", "text": "Human oversight should be proportional to risk and support interpretation, override, reversal, interruption, and safe stopping.", "posture": "Current legal requirement in applicable EU AI Act contexts", "support": [ "source:architecture-and-intent:s04" ] }, { "id": "claim:architecture-and-intent:c08", "text": "Provenance can represent derivation and processing history and support assessment of quality, reliability, and trustworthiness.", "posture": "Foundational standard", "support": [ "source:architecture-and-intent:s05" ] }, { "id": "claim:architecture-and-intent:c09", "text": "In context-as-code environments, changes to trusted context can shape future agent behavior.", "posture": "Tony doctrine and architectural inference", "support": [ "source:architecture-and-intent:s01", "source:architecture-and-intent:s05" ] }, { "id": "claim:architecture-and-intent:c10", "text": "Consequential agent capabilities require explicit scope, reversibility, validation, observability, rollback, evidence, and stop conditions.", "posture": "Tony doctrine supported by risk and security guidance", "support": [ "source:architecture-and-intent:s01", "source:architecture-and-intent:s03", "source:architecture-and-intent:s04" ] }, { "id": "claim:architecture-and-intent:c11", "text": "Human judgment should be placed at explicit authority transitions rather than represented as a decorative review box.", "posture": "Tony doctrine supported by human-oversight requirements", "support": [ "source:architecture-and-intent:s04" ] }, { "id": "claim:architecture-and-intent:c12", "text": "A consequential AI architecture review should show both technology architecture and architecture of intent, then bind them through an alignment matrix.", "posture": "Tony doctrine and proposed review method", "support": [] } ], "relationships": [ { "type": "relatedTo", "target": "artifact:architecture-review-plane-interactive-concepts", "posture": "owner-approved-hosted-uat-relationship", "evidence": "Tony owner UAT approval in the Issue #109 execution session, 2026-07-17" } ], "presentation": { "legacyChrome": { "headers": [], "footers": [] }, "evidenceSections": [], "legacyControls": [], "theme": { "capability": "explicit-light-dark", "default": "system", "rootAttribute": "data-theme", "modes": [ "system", "light", "dark" ], "generatedControl": "none", "preferenceScope": "shareplane-theme-capable-artifacts" } }, "runtime": { "javascript": "artifact-local", "siteWideJavaScript": false, "progressiveEnhancement": true, "networkAccess": false, "persistence": [ "architecture-intent-family-theme", "architecture-intent-theme" ] }, "validation": { "contract": "validation-contract:1.0.0", "runtimeJavaScriptException": true, "stripRuntimeScriptsAtBuild": false, "artifactAssertions": [ { "kind": "sha256", "value": "43177a3463ba7f57194abb92792f3774cbd4d8d1c11c5788875ed64074024300" }, { "kind": "count", "token": "By Tony Malott", "expected": 1 }, { "kind": "count", "token": "data-view=", "expected": 3 }, { "kind": "count", "token": "