\cleardoublepage \part{The Craft} \setbookpart{The Craft}

Part II: The Craft

The transformed role is defined first by its craft: what the security architect designs, in what form, and how the design is verified. This part treats that craft chapter by chapter, from the architecture model to recovery. It is mainly about Shift 1, from documents to code; Shift 2, from gatekeeper to boundary designer; and Shift 3, from periodic to continuous, at machine speed, and every chapter names the shifts it concerns. Shift 4, from sole author to conductor of an AI team, enters where AI proposes candidate threats that a named architect decides (Chapter 6) and where an evidence-collection agent refreshes evidence within tight limits (Chapter 9).

The common thread is that the architect's main product is no longer a document that someone may read but a boundary, a policy, a control or a test that a pipeline enforces and that produces its own evidence. The chapters build on the platform, containment and defence conclusions of the earlier volumes and turn them into the architect's working practice.

Chapters in this part:

• Chapter 5, Security Architecture as Code, expresses models, policies and controls in code, with the pull request as the unit of architectural change.
• Chapter 6, Threat Modelling Transformed, moves threat models into the architecture repository, generated, versioned and verified when AI assists.
• Chapter 7, Designing Boundaries, treats zero trust, policy decision points outside the model, containment and stop paths as the architect's main product.
• Chapter 8, Identity Architecture for Non-Human Actors, designs identity for workloads and agents and delegated authority.
• Chapter 9, The Control Catalogue, Evidence and Assurance, makes controls and evidence the architect's own artefacts.
• Chapter 10, Architecting at Machine Speed, treats patch velocity, detection and the stop path as measured design properties.
• Chapter 11, Resilience and Recovery by Design, designs recoverability and verifies it continuously.

What you will learn in this part:

• How to express security architecture as versioned, testable artefacts instead of review documents
• How to design boundaries and identities that hold whatever a person or an agent intends
• How to make controls produce evidence as a by-product, mapped once to several European obligations
• How to design for machine speed, time a stop path in a drill, and verify recoverability with security chaos engineering

Each chapter includes practical guides and worked examples at Nordvik Region and Hansa Mutual.