Why the atlas labels its claims
An architecture reference is only useful if you know which parts of it to trust, and for how long. Some of what's in these pages is stable physics. Some is a provider's documented behaviour, which changes a few times a year. Some is a price or a regulatory date, which can change next week. And some is the atlas's own reasoning, which you should be able to check for yourself. The labels exist so that you can tell them apart.
The evidence scale
| Label | Meaning |
|---|---|
| T1 | Primary. Official documentation, a specification, legal text, an official post-incident report or post-event summary, or a peer-reviewed paper |
| T2 | A faithful mirror or quotation of a primary, such as a Message Center mirror, or a post-event summary quoted by a third party |
| T3 | A reputable secondary source, such as a law firm's analysis or trade press quoting the original |
| T4 | A vendor or community blog |
| T5 | Unverified, or model knowledge |
| Inference | Architectural reasoning from facts |
| Open | Unresolved: the sources conflict, or couldn't be checked |
Where T4 or T5 sources disagreed with a primary, the primary won.
What was checked, and what changed
The first edition was verified on 5 October 2026 and the second on 6 October 2026. This web edition was checked against the primary sources again on 13 October 2026. These are the facts whose status changed, or that a design is most likely to lean on.
| Claim | Status | Source | What follows |
|---|---|---|---|
| The EU Digital Omnibus on AI is Regulation (EU) 2026/1744 | T1. Of 8 July 2026, published in the Official Journal on 24 July, in force on the third day after publication | EUR-Lex | The Annex III date (2 December 2027) and the Annex I date (2 August 2028) rest on law-firm analyses (T3); read the consolidated text before relying on them |
| The Article 50(2) date: 2 December or 2 August 2026? | Resolved: both, for different systems. Article 50 applies from 2 August 2026; the marking duty for generative systems already on the market before then has a transitional deadline of 2 December 2026 | Law-firm analyses of the amended text (T3) | Regulated scenarios must record whether a system was placed on the market before or after 2 August 2026 |
| Vertex AI became Gemini Enterprise Agent Platform | T1. Google describes the Agent Platform as the evolution of Vertex AI, and says Vertex AI services now ship through it | Endpoint names after the rename remain unverified; treat it as an alias | |
| Restricted SharePoint Search is retiring | T1 for the block, T5 for the end date. New enablement blocked from 31 July 2026. Microsoft's page, updated 18 August 2026, no longer states the 31 January 2027 retirement date recorded in earlier editions | Microsoft Learn, checked 13 October 2026 | Plan as though RSS could go at any time; replace it with RCD |
| MCP 2026-07-28 is stateless | T1, and expanded. Servers must implement server/discover; a broken stream loses the in-flight request and clients must re-issue it; list results carry ttlMs and cacheScope; clients must key credentials by issuer and validate iss; Roots, Sampling and Logging deprecated; DCR deprecated for Client ID Metadata Documents; twelve-month minimum deprecation window | modelcontextprotocol.io changelog | Idempotency for side-effecting tools; cache-scope leaks; issuer pinning |
| The MCP release candidate was locked on 21 May 2026 | Downgraded to T5. Not re-verified | Nothing structural depends on it | |
| Entra agent identities hold no credentials | T1, with a correction. The blueprint holds the credentials, and may hold client secrets and certificates as well as federated credentials; Microsoft advises against secrets in production | Microsoft Learn | "Credential-less agents" is false for the system as a whole; the blueprint credential is the crown jewel |
| Permissions granted to a blueprint reach all its agent identities | Resolved, T1. The second edition left this open. Microsoft's current documentation describes inheritable permissions: permissions granted on the blueprint principal from a resource app marked as inheritable are received by every agent identity created from it, after administrator consent | Microsoft Learn, checked 13 October 2026 | The blueprint is the blast-radius unit for both credentials and grants; test inheritance in your own tenant |
| Agent on-behalf-of is audience-bound | New, T1. A user assertion must have an audience equal to the blueprint's client ID; others are rejected with AADSTS50013; blueprints can't start interactive /authorize flows | Microsoft Learn | Supports audience-bound token exchange |
| Purview DLP for Copilot | T1. Custom template only; selecting the location disables other locations in that policy; updates take up to four hours | Microsoft Learn | Copilot DLP is a separate policy estate, and drift between estates is a risk |
| Restricted Content Discovery | T1. A site-level property affecting only tenant-wide search and Copilot; doesn't change permissions; overuse can degrade performance | Microsoft Learn | Unchanged |
| OWASP Top 10 for Agentic Applications | T1 for the release (9 December 2025); individual entries corroborated by five or more secondaries | OWASP GenAI Security Project | Unchanged |
| AWS, October 2025: "IAM updates and global tables affected" | Corrected, T2. Global-table customers could reach replicas in other Regions, with prolonged replication lag; the IAM impact was console sign-in failures using IAM users, 11:51 PM to 1:25 AM PDT | AWS post-event summary | The multi-region data plane worked; the regional control and identity path didn't |
| Google, 12 June 2025 | T1, with detail added. Service Control is regional with a regional datastore, yet the policy row replicated globally within seconds; remediation is to modularise and fail open | Google Cloud Service Health | Names the "regional compute, global state" anti-pattern |
| Azure Front Door, 29 October 2025 | T1, deepened. A configuration sequence across two control-plane versions produced incompatible metadata, which passed protection before an asynchronous task crashed | Microsoft | Configuration needs a skew policy; validators must run the real asynchronous consumer |
| Cloudflare, 18 November 2025 | T1. Limit of 200 features against normal use of about 60; failures from 11:20 UTC; core traffic largely normal by 14:30; everything by 17:06 | Cloudflare's postmortem | Unchanged |
| CrowdStrike Channel File 291 | T2. 21 fields defined, 20 supplied; an out-of-bounds read; more than 8 million Windows systems | CrowdStrike's root cause analysis, as quoted by the press | Unchanged |
| Kubernetes DRA status in 1.36 | T1. Prioritized List and DRA admin access stable; partitionable devices, consumable capacity and device taints beta and on by default | kubernetes.io | Lifecycle: Prioritized List is mature, partitioning is emerging |
| Azure RBAC and deny assignments | T1, corrected. RBAC is additive; all deny assignments are currently system-protected, not just most | Microsoft Learn | Azure has no customer-authored organisation-wide deny on permissions; "nobody may do X" is composed |
| Object storage consistency | T1 for S3 (strong read-after-write for PUT and DELETE in all Regions, per the S3 user guide); T3 for Google Cloud Storage and Azure Blob | AWS | Consistency is no longer the differentiator; authorization and replication are |
| Kubernetes version skew | T1. Within one minor for HA API servers; kubelet not newer than the API server and up to three older; no skipped minors | kubernetes.io | Upgrades are sequenced |
| Entra continuous access evaluation | T1. Up to 28 hours in CAE sessions, revoked on critical events; about an hour for non-CAE clients; ten-minute minimum configurable lifetime | Microsoft Learn | Freshness moves from expiry to events, where the resource participates |
| FOCUS token columns | Resolved: none in 1.4. 1.4 adds two datasets, 47 columns and six attributes; token direction and cache action are proposed for 1.5, with ratification scheduled for 3 December 2026 | FinOps Foundation | Token metering stays a gateway job until at least then |
| AWS GPU prices | Partly resolved, T1. Capacity Block rates per accelerator-hour effective 7 October 2026, described as dynamic | AWS pricing | On-demand prices per hour still not verified |
| PagedAttention throughput | T1, unchanged. 2 to 4 times at equal latency | Kwon et al., arXiv 2309.06180 | Qualified: holds for decode-heavy, batchable workloads |
The audit that produced the second edition
The second edition kept the first edition's foundations and fixed four structural problems. Several principles had been stated as absolutes when they are really context-dependent decisions. Time had been a hidden dependency rather than a design variable. Some incident lessons were worded more strongly than the official reports support. And the first edition explained what exists without teaching how to derive consequences. The specific contradictions it resolved:
- Fail-open. "Authorization never fails open" sat beside Google's remediation, which made checks fail open. Resolved by the fail-mode taxonomy: quota checks may fail open, access checks may not.
- Freshness against availability. Any cache is a revocation delay. Resolved by stating the revocation window.
- An incomplete principle list. "Replication is not backup" wasn't a principle. Now it's P11, and P0 makes the source of truth explicit.
- "Zones are the cheapest independent domain." True for physical faults only. Resolved by treating failure domains as vectors.
- Index classification against ACL trimming. Trimming changes what a user sees, not what the store holds. Resolved by separating storage and exposure classification.
- "Agents hold no credentials" against "no long-lived shared secrets". The blueprint can hold a secret. Resolved by requiring a managed identity's federated credential on the blueprint.
- Static stability against identity as the first dependency. A data plane that calls the identity provider isn't statically stable. Resolved by distinguishing local validation, introspection and event-driven revocation.
- Multi-region and hidden global dependencies. Strengthened with the corrected AWS facts: fail-static identity.
- "Configuration is code" against the Front Door lesson. Added schema versions and a skew policy.
- "Serving is memory management". Qualified: at batch; long prefill is compute.
- Recommendation against principle. The identity that grants
Sites.SelectedholdsSites.FullControl.All, so it joined the Tier-0 set.
A red-team pass then checked the second edition for coherence, hidden dependencies, missing failure domains, over-strong generalisations and oversimplified scenarios, which is where the time source, permission-granting identities, configuration-schema skew, admission webhooks and key rotation came from.
Still open
Not re-verified for this edition: Azure Policy effects and ABAC conditions; the AWS RCP and SCP evaluation order (the first edition's T1 check of 5 October stands); the MCP release-candidate lock date; Microsoft 365 roadmap item MC1234661 on all-locations enforcement (T3); the CrowdStrike root cause analysis itself (quoted by the press, so T2); the text of each individual OWASP agentic entry.
Open: endpoint and API names for the Agent Platform after the rename; on-demand GPU prices per hour; the January 2026 Capacity Block increase reported by The Register (p5e.48xlarge from $34.61 to $39.80 an hour, p5en.48xlarge from $36.18 to $41.61), for which no AWS announcement was found, and a reported July increase of about 20% that rests on secondary sources only; the FOCUS 1.5 token properties, still in review.
Illustrative figures. The KV-cache sizing and the tokens-per-second figure in the cost calculation use stated, illustrative parameters. They teach how the quantities scale, not how any vendor's hardware performs.
Freshness
Facts about AI services, Microsoft 365, pricing and regulation should not be relied on after 90 days from verification, which is 4 January 2027. Facts about how the clouds work underneath should be re-checked after 180 days.