The Transformed Security Architect - Book Structure

This document describes the logical structure of The Transformed Security Architect, Book 6 of The Architecture as Code Series. The book is organised into six parts with 27 numbered chapters, moving from the role in question through the craft, the architect's AI team, the role in the organisation and competence and career to experience and conclusions, followed by the glossary, two appendices, the references and a note about the author. Four shifts run through every chapter: Shift 1, from documents to code; Shift 2, from gatekeeper to boundary designer; Shift 3, from periodic to continuous, at machine speed; and Shift 4, from sole author to conductor of an AI team. The book builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat, recorded in SERIES_FOUNDATIONS.md.

Table of contents

Part I: The Role in Question (Chapters 1–4)

What the security architect did before the transformation, the four shifts that change the role, and the transformed role defined as a role charter with mandate, accountabilities and decision rights

Part II: The Craft (Chapters 5–11)

The craft of the transformed role: security architecture as code, threat modelling, boundaries and containment, identity for non-human actors, the control catalogue and evidence, design at machine speed, and resilience and recovery (mainly Shifts 1 to 3)

Part III: The Architect's AI Team (Chapters 12–15)

The architect's own use of AI, an AI agent team under a written mandate, verifying what AI proposes, and keeping the craft (Shift 4, resting on Shifts 1 and 2)

Part IV: The Role in the Organisation (Chapters 16–20)

The role map, design authority and decision forums, regulation as the architect's constraint, communicating architecture, and the role in public authorities and multinationals (mainly Shift 2, with Shifts 1 and 3 in regulation, reporting and procurement)

Part V: Competence and Career (Chapters 21–23)

A competence framework for the transformed security architect, learning paths, certification, hiring and upskilling, and the future of the role

Part VI: Experience and Conclusions (Chapters 24–27)

Case studies and anti-patterns, a year in the role at the two organisations (December 2026 to November 2027), each organisation's answer to the commission of Chapter 1 with a 24-month plan, and the book's conclusions with the status of the open questions Q1 to Q12

Appendices and Reference

Glossary, Appendix A (code examples: role, control and mandate artefacts), Appendix B (templates and tools), references and about the author

Chapter structure

Part I: The Role in Question

The part is introduced by part_i_the_role_in_question.md.

Chapter	File	Title	Description
1	01_introduction.md	Introduction: The Security Architect Transformed	State the thesis, introduce the four shifts in brief and the two organisations, and set out how the book is read
2	02_the_role_before.md	What the Security Architect Did: The Role Before the Transformation	Describe the inherited role and its methods, what was valuable in it and what did not scale
3	03_four_shifts.md	Four Shifts: Code, Boundaries, Machine Speed and the AI Team	Define the four shifts with the evidence from Books 1–5 and the external literature, how they depend on one another and how each fails when taken too far; the frame chapter
4	04_role_charter.md	The Transformed Role Defined: Mandate, Accountabilities and Decision Rights	Define the transformed role as a role charter under version control: mandate, accountabilities, decision rights and limits

Part II: The Craft

The part is introduced by part_ii_the_craft.md.

Chapter	File	Title	Description
5	05_security_architecture_as_code.md	Security Architecture as Code: From Documents to Executable Design	Express security architecture as models, policies and controls in code, with the pull request as the unit of architectural change
6	06_threat_modelling.md	Threat Modelling Transformed: Continuous, Generated and AI-Assisted	Move threat modelling from workshops to versioned models generated from the architecture repository, with AI assistance verified
7	07_boundaries_and_containment.md	Designing Boundaries: Zero Trust and Containment for People, Agents and Machines	Design boundaries that hold whatever anyone intends: zero trust, policy decision points outside the model, containment and stop paths
8	08_identity_for_non_human_actors.md	Identity Architecture for Non-Human Actors: Workloads, Agents and Delegated Authority	Design identity for workloads and agents, delegated authority and approvals that resist synthetic media
9	09_controls_evidence_assurance.md	The Control Catalogue, Evidence and Assurance as the Architect's Artefacts	Make the control catalogue, evidence and assurance the architect's own versioned artefacts
10	10_machine_speed_design.md	Architecting at Machine Speed: Patch Velocity, Detection and the Stop Path by Design	Treat patch velocity, detection, containment and the stop path as measured design properties
11	11_resilience_by_design.md	Resilience and Recovery by Design: The Architect's Share of Recoverability	Design recoverability, rehearse it and verify it with security chaos engineering

Part III: The Architect's AI Team

The part is introduced by part_iii_the_architects_ai_team.md.

Chapter	File	Title	Description
12	12_architects_own_ai_use.md	The Architect's Own Use of AI: Drafting, Research and Review in Modes 1 to 3	Show what the architect does with assistants and agentic work tools, and what the evidence says about the results
13	13_ai_agent_team.md	An AI Agent Team for Security Architecture: Skills, Mandates and Containment	Build an AI agent team for security architecture under a mandate manifest and containment that does not depend on intent
14	14_verifying_ai_proposals.md	Verifying What AI Proposes: Review for Soundness When the Reviewer Depends on the AI	Review AI proposals for soundness when the reviewer depends on the AI
15	15_keeping_the_craft.md	Keeping the Craft: Deskilling, Judgement and the Architect Who Still Can	Keep the craft against deskilling through deliberate practice, mentoring and exercises without AI

Part IV: The Role in the Organisation

The part is introduced by part_iv_the_role_in_the_organisation.md.

Chapter	File	Title	Description
16	16_role_map.md	The Role Map: CISO, Enterprise Architect, AI Architect, Platform and Product Teams	Place the security architect among the CISO, enterprise and AI architects, platform and product teams
17	17_decision_forums.md	Design Authority, Decision Forums and Gates Instead of Meetings	Replace meetings with tiered decisions, a design authority, pipeline gates and expiring exceptions
18	18_regulation_as_constraint.md	Regulation as Constraint: AI Act, NIS 2, DORA, CRA and the Architect's Accountability	Turn the AI Act, NIS 2, DORA and the CRA into engineering constraints and controls, and clarify personal accountability
19	19_communicating_architecture.md	Communicating Security Architecture: Boards, Supervisors, Auditors and Engineers	Communicate one architecture to boards, supervisors, auditors, engineers and suppliers through views generated from the same model, catalogue and evidence
20	20_public_sector_and_multinational.md	Public Authorities and Multinationals: Sovereignty, Procurement and Many Legal Regimes	Practise the role where architecture is procured rather than built, and across many legal regimes

Part V: Competence and Career

The part is introduced by part_v_competence_and_career.md.

Chapter	File	Title	Description
21	21_competence_framework.md	Competences of the Transformed Security Architect: A Framework	Define the competences of the transformed security architect as a framework in code, mapped to ECSF, SFIA and NICE
22	22_learning_and_hiring.md	Learning Paths, Certification, Hiring and Upskilling	Set out learning paths, certification, hiring profiles and upskilling
23	23_future_of_the_role.md	The Future of the Role: Will There Be a Security Architect in 2036?	Keep a horizon register for the role and weigh scenarios for 2036, with the author's judgement labelled

Part VI: Experience and Conclusions

The part is introduced by part_vi_experience_and_conclusions.md.

Chapter	File	Title	Description
24	24_case_studies_and_anti_patterns.md	Case Studies and Anti-Patterns	Present two composite cases, one observable incident reconstruction and five anti-patterns, each anti-pattern with the shift it violates and its remedy, and a diagnostic for a practice to run on itself
25	25_a_year_in_the_role.md	A Year in the Role: The Transformed Architect at Nordvik Region and Hansa Mutual	Follow the security architects of both organisations through a year, quarter by quarter, with the artefacts produced
26	26_conclusions_for_nordvik_and_hansa.md	Nordvik Region and Hansa Mutual: Conclusions for Two Organisations	Answer the regional director's commission (AIDR-0500) and the executive board's request (AIDR-0550), compare the two artefact sets and set a prioritised 24-month plan for each
27	27_conclusion.md	Conclusions: The Transformed Security Architect	Restate and qualify the thesis, reflect on each part, state how firm the conclusions are, settle or leave open Q1 to Q12, set out what to do first, next and later, and show how the series makes one argument

Appendices and Reference

The appendices are introduced by part_appendices.md.

Item	File	Title	Description
Glossary	28_glossary.md	Glossary	Defines the vocabulary of the transformed role: the four shifts, the architect's artefacts, boundaries and identity, machine-speed design, the AI team, competence frameworks and European regulation.
Appendix A	29_appendix_a_code_examples.md	Appendix A: Code Examples: Role, Control and Mandate Artefacts	Fuller versions of the artefacts introduced in the chapters: the role charter, a control catalogue excerpt, a containment profile, a mandate manifest, the competence framework and a review record.
Appendix B	appendix_templates_and_tools.md	Appendix B: Templates and Tools	A directory of the templates and tools the chapters provide, with the chapter that introduces each.
References	30_references.md	References and Sources	Canonical bibliography
About the Author	31_about_the_author.md	About the Author	Background and perspective

Companion files

File	Purpose
BOOK_BLUEPRINT.md	Premise, thesis, audience, the brief of every chapter, the foundations it builds on, the shifts it concerns and its status
SERIES_FOUNDATIONS.md	The conclusions of Books 1–5 that this book builds on, with the tables of contents of the earlier volumes for cross-references
EXAMPLE_ORGANISATIONS.md	Canonical profiles of Nordvik Region and Hansa Mutual, including their security architecture profiles
CHAPTER_AUTHORING_GUIDE.md, STYLE_GUIDE.md, AUTHOR_PERSONA.md	Rules for structure, language and voice

Canonical ordering

scripts/toc_definition.py holds the table of contents and regenerates docs/book_index.json, the mkdocs.yml navigation and the chapter list in BOOK_REQUIREMENTS.md. docs/book_index.json and mkdocs.yml must agree; tests/test_book_index.py enforces that they do.