Appendix B: Templates and Tools
This appendix is the directory of reusable templates and tools for the practice of the transformed security architect in the repository that accompanies The Transformed Security Architect. Each artefact is designed to be copied into an organisation's own repositories and maintained under version control. The chapters that introduce each artefact are listed so that readers can find the rationale behind the design. Each artefact appears in full in the chapter that introduces it, as a worked example or practical guide; those also collected in Appendix A are linked there.
The governance templates of AI Governance, Appendix C, the platform and security templates of AI Platform and Security, Appendix B, the defensive artefacts of AI Red Team and the threat-register artefacts of AI Threat remain the reference for those subjects and are not repeated here.
Templates by activity
| Activity | Artefact | Where to find it | Introduced in |
|---|---|---|---|
| The role | Role charter: mandate, accountabilities, decision rights and limits (ROLE-*) |
Appendix A | Chapter 4 |
| The craft | Architecture Decision Record template, with the AI Decision Record fields | Chapter 5 | Chapter 5 |
| The craft | Threat-model manifest generated from the architecture repository | Chapter 6 | Chapter 6 |
| The craft | Containment profile and permission manifest | Appendix A | Chapter 7 |
| The craft | Delegated-authority record for an agent acting on a person's behalf | Chapter 8 | Chapter 8 |
| The craft | Control catalogue entry mapped to obligations (CTRL-*) |
Appendix A | Chapter 9 |
| The craft | Evidence manifest | Chapter 9 | Chapter 9 |
| The craft | Patch-velocity service level and stop-path test | Chapter 10 | Chapter 10 |
| The craft | Recoverability test and chaos-experiment record | Chapter 11 | Chapter 11 |
| The AI team | Prompt and skill record for the architect's own AI use | Chapter 12 | Chapter 12 |
| The AI team | Mandate manifest for an architecture agent team (MND-*) |
Appendix A | Chapter 13 |
| The AI team | Review checklist for AI proposals and review record | Appendix A | Chapter 14 |
| The AI team | Practice plan with exercises without AI | Chapter 15 | Chapter 15 |
| Organisation | Responsibility matrix for the role map | Chapter 16 | Chapter 16 |
| Organisation | Decision-tier definition and exception record (EXC-NNNN) |
Chapter 17 | Chapter 17 |
| Organisation | Article-to-control mapping for the AI Act, NIS 2, DORA and the CRA | Chapter 18 | Chapter 18 |
| Organisation | Management report on architecture metrics | Chapter 19 | Chapter 19 |
| Organisation | Security requirements as code for procurement, with exit plan | Chapter 20 | Chapter 20 |
| Competence | Competence framework (domains, levels, evidence) | Appendix A | Chapter 21 |
| Competence | Individual competence record (CMP-*) |
Chapter 21 | Chapter 21 |
| Competence | Hiring profile and interview exercise | Chapter 22 | Chapter 22 |
| Future | Horizon register for the role | Chapter 23 | Chapter 23 |
| Experience | Anti-pattern record with shift violated and remedy | Chapter 24 | Chapter 24 |
| Experience | 24-month plan for the transformation of the role | Chapter 26 | Chapter 26 |
Repository tools
| Tool | Purpose |
|---|---|
scripts/toc_definition.py |
Holds the table of contents and regenerates book_index.json, the MkDocs navigation and the chapter list in BOOK_REQUIREMENTS.md |
scripts/generate_outlines.py |
Regenerates the chapter briefs in BOOK_BLUEPRINT.md and outline files for chapters not yet written |
scripts/format_citations.py |
Derives citation labels from the bibliography |
scripts/renumber_sources.py |
Keeps the bibliography numbered 1..N without gaps or uncited entries |
scripts/check_mermaid_diagrams.py |
Renders and validates the diagrams |