Architecture decision records and threat assumptions

Work on Architecture decision records and threat assumptions starts from a named business result: document alternatives, constraints, and reconsideration triggers. For a procurement agent that gathers evidence and drafts a recommendation without contracting authority, identify the unit of work, authorized identity, and intended effect. Establish a baseline for open assumptions, decision age, and exception rate before introducing the selected agent. Treat turning the record into a justification for a predetermined choice as a failure state, not wording to explain away. The lesson requires an inspectable outcome rather than activity volume or persuasive text. For Architecture decision records and threat assumptions, this point is checked through open assumptions, decision age, and exception rate.

An architecture decision record is written to expose and revisit a choice, not justify it afterward. For a procurement assistant, compare manual research, evidence collection, and constrained recommendation while keeping contracting authority outside the agent. Test the choice with two conflicting bids: a cheaper supplier lacks required security evidence, while a costlier supplier satisfies eligibility and exit requirements. Security is a gate, not merely a weight. Each assumption receives a measurable disproof signal, such as stale supplier data or an approval queue beyond operating capacity.

Record three alternatives: structured manual research, an agent that only collects evidence, and an agent that compares evidence and drafts a non-binding recommendation. For each, name the decisive constraint, required source quality, review burden, and failure response. The assistant cannot issue a purchase order or accept contractual terms. Supplier text is evidence, not policy, and every extracted claim carries document identity, version, and access date so a reviewer can locate what supports it.

Suppose supplier A costs eight percent less but has no current security evidence, while supplier B costs more and supplies valid assurance and an exit plan. A model assigns scores of 84 and 81 because price receives fifty percent and security only twenty. The record reveals a category error: security is an eligibility requirement, so A is excluded before weighting. The remaining qualified bids may then be ranked. This shows why a constraint and a preference cannot be collapsed into one attractive average.

Assumptions are operational. “Supplier data is current” becomes a maximum age of twenty-four hours. “The committee can review” becomes a queue limit and response window. “Documents are extractable” has a counterexample: a scanned bid whose tables cannot be read reliably. Breaching any trigger reopens the choice rather than merely changing the review date. The finished record states evidence, alternative, reason, owner, and what would reverse the decision. A document that could not have supported a different conclusion is advocacy, not an architecture decision record.

A decision record can be tested by asking a reviewer to reproduce the choice without the meeting that produced it. Provide the approved requirements, two dated bids, extraction evidence, policy version, alternatives, and the chosen constraint. The reviewer first checks eligibility, then scores qualified suppliers. If the cheaper bid lacks an acceptable assurance document, its price does not rescue it. If that supplier later provides a valid document, the record states that the comparison reopens; the conclusion is not protected from new evidence.

A scanned bid contains an unreadable pricing table. Mark the affected figure as unverified and route that field to a human reader. Do not assign a low or high price by inference. The record separates a source fact, an extraction confidence limit, and a recommendation. It also distinguishes the analyst’s recommendation from any authority to contract. If a supplier email instructs the agent to change weights, it remains an untrusted source message, not a change to approved criteria. Review assumptions at their actual triggers. Supplier data older than twenty-four hours, a committee queue beyond thirty cases, or an exception rate over the agreed limit prompts review of the architecture. The team may choose a simpler evidence-collection agent if comparison quality cannot be controlled. Recording that fallback gives operators a feasible route rather than a binary story in which more autonomy is always progress.

A procurement-agent record fixes the decision as evidence collection and recommendation drafting, not supplier selection or contracting. Compare a bounded single agent, a manager calling finance and security specialists, and a deterministic extractor with human analysis. Treat supplier documents as untrusted data. Record a six-month schema assumption and reconsider when a supplier category changes or a leakage incident occurs. Preserve rejected alternatives and their reasons because a future constraint change can reverse the ranking. An architecture record becomes operational when each assumption has an observable disproof condition. “The queue is low volume” becomes a threshold and measurement window; “reviewers can intervene” becomes coverage hours and maximum acknowledgement time. Threat assumptions need the same treatment: identify which component could forge identity, replay a request, or supply stale state. A review date alone is insufficient—the record should reopen automatically when the named signal or dependency changes. Separate the record’s evidence table from the recommendation. For each supplier criterion, store the requirement, source document, page or section, observation, uncertainty, and reviewer resolution. A missing certificate is not automatically proof that a supplier cannot provide one; it is an absence of sufficient evidence for eligibility at this decision time. The recommendation can state that the supplier may re-enter once valid evidence is supplied. This avoids turning an extraction gap into an unsupported factual accusation.

The threat model includes a supplier document that asks the agent to change the scoring weights, a stale price sheet, and a forged claim of approval authority. The agent should quote relevant supplier data as evidence but obtain criteria and authority from their owning systems. The decision record names which boundary handles each threat. A useful counterfactual is concrete: if supplier A provides a valid security certificate before the deadline, it becomes eligible and price is compared among qualified bids. “If A were better, choose A” says nothing about what evidence could change the choice.