In this chapter
5.1 Principles must constrain a real decision
“Secure, scalable and modern” does not help resolve a conflict. A principle should state a rule, its rationale, the decisions it changes and the procedure for an exception. It should survive replacement of a framework, database or supplier. For the example, approval authority, traceable information and recoverable operation take precedence over adding distributed components. That does not prohibit distribution. It requires a reason and the operating capacity to support it.
| Principle | Rationale | Consequence | Exception record |
|---|---|---|---|
| Purpose before technology | Capabilities outlive products | Select components against approved requirements | Business need, alternatives and review point |
| One authority per fact | Conflicting copies undermine decisions | Every projection identifies its source and cut-off | Reconciliation and conflict policy |
| Explicit responsibility | Shared infrastructure can hide ownership | Every critical service has an accountable owner | Named temporary delegate and expiry |
| Recoverability by evidence | Backup configuration does not prove restoration | Exercise recovery against agreed objectives | Risk acceptance and remediation owner |
5.2 Turn qualities into scenarios
A quality scenario identifies the actor, stimulus, operating condition, expected response and measure. “Fast approval” should distinguish software response from the human approval interval. Improving API latency cannot solve a policy queue awaiting an absent approver.
| Scenario | Candidate response | Verification |
|---|---|---|
| Two actors approve the same version | At most one permitted transition commits | Concurrent sessions with known initial state |
| Response is lost after acceptance | Same command identifier retrieves the original outcome | Interrupt the client response and retry |
| Worker is unavailable | Committed approval remains valid; work is recoverable | Pause, restart and inspect pending work |
| Service must be restored | Candidate RPO 24 h and RTO 4 h, subject to approval | Timed isolated restore and reconciliation |
The numbers above are design assumptions for the fictional case. They become commitments only after impact analysis, cost discussion and demonstrated feasibility.
5.3 Security and continuity can conflict
Requiring online authority preserves consistency but may interrupt a branch during a network failure. Allowing offline approvals may preserve local activity while creating conflicts the institution cannot resolve. Document that tension explicitly. A cache is a technical mechanism; the authority policy is a business decision. Similarly, keeping all data forever can aid investigation while violating retention requirements. Choose the minimum evidence needed for the approved purpose, with controlled access and an authorized retention rule.
5.4 Principle review
The architecture review records where a principle was applied, where it conflicts with another objective and who approves an exception. Review exceptions when their trigger occurs rather than letting temporary workarounds silently become permanent standards. The chapter is accepted when stakeholders can use the principles to explain a selected option and reject an unsuitable one. If every possible solution “complies,” the principles are not specific enough.