Automating Enterprise Architecture Execution

This chapter builds on the foundations laid in Chapters 1 to 6 and brings together two ideas that are often conflated but should not be. One concerns how architects structure intent so that it can survive translation into design and delivery. The other concerns how autonomous systems execute work safely, repeatedly, and under control. They are different problems that needs to be tackled separately and the execution mode where they meet is what this chapter calls dark factory.

What the chapter covers

12 sections, in order.

7.1 The problem is no longer documentation, it is motion
7.2 The architect plans, the agent executes
7.3 Composition: the full operating model
7.4 Public implementations reveal the execution pattern
7.5 The architecture of dark-factory execution
7.6 RX Pharma: controlled autonomous realization in a regulated domain
7.7 What changes for the architect
7.8 Risks, limits, and trade-offs
7.9 Architecture must become explicit before execution can go dark
7.10 What should be built first
7.11 Synthesis
7.12 Sources

Figures, tables and listings

4 figures · 2 code listings

Reproduced in full, in the order they appear in the published chapter. The reasoning that connects them is in the book.

Figure 7.1: The architect’s process produces governed artifacts that seed the agent’s loop.

Figure 7.1: The architect’s process produces governed artifacts that seed the agent’s loop.

apiVersion: ea.codex/v1
kind: ArchitecturePackage
id: AP-0147
name: "Affiliate Safety Intake Rollout"
domain: "Pharmacovigilance"
brief:
  intent:
    outcome: "Deploy a governed safety-intake capability for new affiliates without local solution sprawl"
    value: "Reduce rollout lead time while preserving a canonical safety-case process"
  capabilityScope:
    - AdverseEventIntake
    - SafetyCaseNormalization
    - HumanMedicalReview
    - RegulatorySubmissionPreparation
  decisionObligations:
    - choose affiliate variant within governed family
    - bind regulatory reporting variant to local authority
    - select identity integration pattern
map:
  familyBinding:
    productLine: SafetyIntakeSPL
    variant: EU-MidsizeAffiliate
    permittedVariationPoints:
      - localLanguageInterface
      - affiliateReviewWorkflow
    forbiddenVariationPoints:
      - caseStateMachine
      - auditEventSchema
  designDecisions:
    - id: DD-SIP-012
      topic: caseRoutingModel
      option: centralOrchestration
      rationale: preserves cross-affiliate case semantics
act:
  codexAssets:
    - template: "affiliate-intake-service"
    - policy:   "gxp-audit-retention.rego"
    - pipeline: "safety-intake-ci.yaml"
doubleCheck:
  evidence:
    - conformance: "architectural-conformance-run-2097.json"
    - validation: "scenario-pack-results-2097.json"
    - approval:   "qa-signoff-2097.sig"

Figure 7.2: Architecture package for Affiliate Safety Intake Rollout (AP-0147).

Figure 7.3: The dark factory operating model.

Figure 7.3: The dark factory operating model.

apiVersion: ea.codex/v1
kind: ScenarioPack
metadata:
  id: SCN-RXP-TEMP-EXCURSION-V4
  name: rxp-temperature-excursion-case-intake
  title: RX Pharma Temperature-Excursion Case Intake Scenarios
  status: approved
  version: "4.0"
  domain: pharmacovigilance
spec:
  scope:
    appliesTo: capability
    capabilityRef: clinical-supply-deviation-management
    changeScope: temperature-excursion-case-intake
  scenarios:
    - id: VIS-001
      title: create excursion case from warehouse event
      category: happy-path
      severity: blocking
      given: >
        shipment delivered with sensor_reading=11.8C,
        product_threshold=8.0C, lot_status=quarantined_pending_review
      when: temperature_excursion_detected event arrives
      then: >
        case record is created, audit_events[0].type == "case_opened",
        case.disposition == "pending_human_review"
    - id: HLD-011
      title: malformed sensor batch with missing timezone metadata
      category: holdout
      severity: blocking
      given: sensor batch with one or more readings missing timezone metadata
      when: temperature_excursion_detected event is processed
      then: handler rejects the batch and produces a structured error event
      rationale: detects brittle handling of partial integration inputs
    - id: HLD-015
      title: agent attempts autonomous disposition
      category: holdout
      severity: blocking
      given: agent-driven flow with disposition responsibility
      when: agent issues a final disposition without human review
      then: action is blocked and audit log records forbidden_autonomy_event
      rationale: enforces non-delegable clinical judgment boundary
  convergenceCriteria:
    metric: severity-weighted-pass-rate
    passThreshold: ">= 1.0 on blocking scenarios"
    blockingFailureMode: any-blocking-fail-blocks-merge
  approvalConditions:
    - all-visible-scenarios-pass
    - no-holdout-failures
    - policy-check: gxp-audit-retention.rego must pass
    - named-qc-role-signature-required
    - no-forbidden-autonomy-events-in-realization

Figure 7.4: Scenario pack for RX Pharma temperature-excursion case intake (SCN-RXP-TEMP-EXCURSION-V4).

Figure 7.5: Maturity path for dark factory implementation.

Figure 7.6: Dark Factory.

The rest of this chapter

The published chapter runs the argument through all 12 sections above. This page reproduces its structure and every exhibit; the analysis is in the book.