Product · Architecture & Change Impact
Don't regenerate the whole package. Reassess the delta.
CertiField models the authorization boundary as structured facts rather than as a picture, publishes each state as an immutable content-hashed version, and computes what a change actually affected — so reassessment has a scope instead of a start date.
- Trust zones
- Components
- Connections
- Data flows
- Interconnections (CA-3 · SA-9)
- Immutable versions
- Ref
- P-41
- Kind
- Model
- Authoritative
- structured facts
- Reference only
- uploaded diagrams
The diagram is not the boundary. The facts are.
A Visio export cannot tell you whether a connection crosses the authorization boundary. CertiField models zones, components, connections, data flows and interconnections as structured records, and derives boundary crossing rather than storing it as something a person typed and might have got wrong.
Three dimensions are modeled independently and never inferred from one another: what is inside the authorization boundary, what trust posture something holds, and who is administratively responsible for it. Conflating those is how a component ends up inside a boundary because somebody else patches it.
Uploaded diagrams are kept as reference artifacts. They are never parsed to derive a fact, because a drawing that disagrees with the record is a drawing, not a change.
- Trust zones that nest, carrying authorization disposition
- Components typed by role and linked to real inventory
- Connections with boundary crossing derived, not declared
- Data flows validated hop by hop from producer to consumer
- Interconnections as the CA-3 and SA-9 record, with agreement expiry surfaced
- Documented exceptions that have no effect until they are approved
- Ref
- P-42
- Kind
- Version
- Immutable
- no update or delete exists
- Identity
- SHA-256 content hash
Publish a version. It never changes again.
Publishing validates the graph, canonicalizes it to a stable byte representation and hashes it. That hash is the version's identity. There is no API to edit or delete a published version — not as a policy, but as an absence enforced by test.
Publish an identical state and CertiField tells you nothing changed rather than creating a meaningless version. Publish a real change and you get a new version, a new hash, and a diff against the last one.
- changed
- 4 components · 1 connection · 1 data flow
- reassess
-
- AC-4
- SC-7
- SC-8
- CA-3
- CA-9
- SC-13
- preserved
- 289 controls unchanged — evidence, determinations and assessment history retained
Assessments stay bound to the architecture version they were performed against. Publishing a new version never moves that binding.
- Ref
- P-43
- Kind
- Impact
- Derived
- affected control scope
What changed, and what it means for the controls.
The diff is the easy part. The useful part is the second question: given what moved, which controls are now in scope for reassessment, and which are not?
Changed architecture?
The affected control scope is derived from the diff, so reassessment is bounded by evidence rather than by caution.
Unchanged controls?
Their evidence, determinations and assessment history are preserved. Nothing is discarded because something else moved.
Stale assessments?
Advisory rules surface assessments performed against an older version. They flag; they never invalidate on their own.
Documentation?
The SSP architecture sections regenerate from the published snapshot, so the document follows the record rather than lagging it.
Stop reconstructing the authorization story every time the system changes.
- Ref
- P-44
- Kind
- Workspace
- Drawing
- authored, revisioned
- Facts
- never derived from the drawing
Draw it, without letting the drawing become the truth.
The diagram workspace is a real editor with tabs, revisions and comment pins — an overview drawing, lens views that show the same entities from another angle, and decomposition views that expand a single component or zone. The entities stay shared across every tab, because there is one authorization boundary and fragmenting it per drawing would break the snapshot, the exports and every derived fact.
What the workspace does not do is let a drawing quietly change a fact. Facts change through the save paths or through an accepted proposal, and nowhere else.
- Ref
- P-45
- Kind
- Intake
- Rule
- no importer writes a fact
- Applied
- in topological order
Assisted intake, without assisted mistakes.
CSV, draw.io files and text extraction all produce proposals, never architecture facts. Proposed items reference each other by temporary key before any row exists, the graph is cycle-checked at submission, and atomic groups are indivisible — selecting one member selects the group, because half a group is exactly the corruption atomicity exists to prevent.
An update whose target row changed since the proposal was made is refused as stale rather than overwriting a later human edit. Model output is schema-validated against a closed taxonomy: an unrecognized zone type or component role is discarded, never coerced into the nearest match. And the model is structurally unable to assert a boundary disposition, an encryption state, or a data classification — those are human calls.
Next step