Solid = built
Reconciled with deployed evidence.
ARCHITECTURE AS REVIEW INSTRUMENT
The picture that found the gaps.
The infrastructure existed and the prose was thorough. One verified drawing made five missing decisions visible in an afternoon.
01 · ABSENCE HAS A SHAPE
Prose describes what exists. A diagram exposes what is missing.
The first review raised work around the web edge, threat detection and posture, centralized logs, account topology, and data resilience. These were review findings—not claims of five proven vulnerabilities.
Dashed = planned
Visible, labeled, and tied to owned work.
02 · SEMANTICS MATTER
An arrow pointed invitation email toward the wrong actor.
The implementation could still behave correctly while the picture taught the wrong trust story. Direction, ownership, and boundary placement are security meaning—not decoration.
03 · REVIEW AGAIN
The merged diagram found three more contradictions.
Boundary
Production notes appeared inside development.
Order
Tiers contradicted the real traffic sequence.
Ownership
Backup storage sat inside the audit core.
Decision
The visual discrepancy became relocation work.
04 · THE LOOP
Generate. Reconcile. Mark uncertainty. Review. Assign. Regenerate.
Diffable Diagrams and Graphviz source made change reviewable; the rendered picture made the system reviewable. Neither was accepted without comparison to reality.
FIELD CHECK
Before approving an architecture drawing.
- Do trust boundaries match deployed reality?
- Are built and planned controls unmistakable?
- Are arrow direction and actor ownership correct?
- Are logging, detection, posture, and recovery distinct?
- Does every planned control have an owner?
PRIMARY SOURCES
Capabilities named in the review.
AWS WAF · Amazon GuardDuty · AWS Security Hub · Diagrams · Graphviz
Educational, conceptual, and dated. No account IDs, domains, bucket names, or private topology are shown.
The picture that found the gaps.
A narrated visual review of absence, misleading semantics, and honest built-versus-planned notation.