# Evidence, Verification and Open Questions

> How every claim in the atlas was checked: the evidence scale, the verification ledger, the corrections made, the open questions and when facts expire.

- Web page: https://www.alesanalytics.com/architecture/evidence
- Markdown: https://www.alesanalytics.com/architecture/evidence.md
- Part of: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md), section "Reference"
- Last verified: 13 October 2026
- Publisher: Ales Analytics

## Why the atlas labels its claims

An architecture reference is only useful if you know which parts of it to trust, and for how long. Some of what's in these pages is stable physics. Some is a provider's documented behaviour, which changes a few times a year. Some is a price or a regulatory date, which can change next week. And some is the atlas's own reasoning, which you should be able to check for yourself. The labels exist so that you can tell them apart.

## The evidence scale

| Label | Meaning |
| --- | --- |
| T1 | **Primary.** Official documentation, a specification, legal text, an official post-incident report or post-event summary, or a peer-reviewed paper |
| T2 | **A faithful mirror or quotation of a primary,** such as a Message Center mirror, or a post-event summary quoted by a third party |
| T3 | **A reputable secondary source,** such as a law firm's analysis or trade press quoting the original |
| T4 | **A vendor or community blog** |
| T5 | **Unverified,** or model knowledge |
| Inference | **Architectural reasoning** from facts |
| Open | **Unresolved:** the sources conflict, or couldn't be checked |

Where T4 or T5 sources disagreed with a primary, the primary won.

## What was checked, and what changed

The first edition was verified on 5 October 2026 and the second on 6 October 2026. This web edition was checked against the primary sources again on 13 October 2026. These are the facts whose status changed, or that a design is most likely to lean on.

| Claim | Status | Source | What follows |
| --- | --- | --- | --- |
| The EU Digital Omnibus on AI is Regulation (EU) 2026/1744 | **T1.** Of 8 July 2026, published in the Official Journal on 24 July, in force on the third day after publication | EUR-Lex | The Annex III date (2 December 2027) and the Annex I date (2 August 2028) rest on law-firm analyses (T3); read the consolidated text before relying on them |
| The Article 50(2) date: 2 December or 2 August 2026? | **Resolved: both, for different systems.** Article 50 applies from 2 August 2026; the marking duty for generative systems already on the market before then has a transitional deadline of 2 December 2026 | Law-firm analyses of the amended text (T3) | Regulated scenarios must record whether a system was placed on the market before or after 2 August 2026 |
| Vertex AI became Gemini Enterprise Agent Platform | **T1.** Google describes the Agent Platform as the evolution of Vertex AI, and says Vertex AI services now ship through it | Google | Endpoint names after the rename remain unverified; treat it as an alias |
| Restricted SharePoint Search is retiring | **T1 for the block, T5 for the end date.** New enablement blocked from 31 July 2026. Microsoft's page, updated 18 August 2026, no longer states the 31 January 2027 retirement date recorded in earlier editions | Microsoft Learn, checked 13 October 2026 | Plan as though RSS could go at any time; replace it with RCD |
| MCP 2026-07-28 is stateless | **T1, and expanded.** Servers must implement `server/discover`; a broken stream loses the in-flight request and clients must re-issue it; list results carry `ttlMs` and `cacheScope`; clients must key credentials by issuer and validate `iss`; Roots, Sampling and Logging deprecated; DCR deprecated for Client ID Metadata Documents; twelve-month minimum deprecation window | modelcontextprotocol.io changelog | Idempotency for side-effecting tools; cache-scope leaks; issuer pinning |
| The MCP release candidate was locked on 21 May 2026 | **Downgraded to T5.** Not re-verified | | Nothing structural depends on it |
| Entra agent identities hold no credentials | **T1, with a correction.** The blueprint holds the credentials, and may hold client secrets and certificates as well as federated credentials; Microsoft advises against secrets in production | Microsoft Learn | "Credential-less agents" is false for the system as a whole; the blueprint credential is the crown jewel |
| Permissions granted to a blueprint reach all its agent identities | **Resolved, T1.** The second edition left this open. Microsoft's current documentation describes *inheritable permissions*: permissions granted on the blueprint principal from a resource app marked as inheritable are received by every agent identity created from it, after administrator consent | Microsoft Learn, checked 13 October 2026 | The blueprint is the blast-radius unit for both credentials and grants; test inheritance in your own tenant |
| Agent on-behalf-of is audience-bound | **New, T1.** A user assertion must have an audience equal to the blueprint's client ID; others are rejected with AADSTS50013; blueprints can't start interactive `/authorize` flows | Microsoft Learn | Supports audience-bound token exchange |
| Purview DLP for Copilot | **T1.** Custom template only; selecting the location disables other locations in that policy; updates take up to four hours | Microsoft Learn | Copilot DLP is a separate policy estate, and drift between estates is a risk |
| Restricted Content Discovery | **T1.** A site-level property affecting only tenant-wide search and Copilot; doesn't change permissions; overuse can degrade performance | Microsoft Learn | Unchanged |
| OWASP Top 10 for Agentic Applications | **T1 for the release** (9 December 2025); individual entries corroborated by five or more secondaries | OWASP GenAI Security Project | Unchanged |
| AWS, October 2025: "IAM updates and global tables affected" | **Corrected, T2.** Global-table customers could reach replicas in other Regions, with prolonged replication lag; the IAM impact was console sign-in failures using IAM users, 11:51 PM to 1:25 AM PDT | AWS post-event summary | The multi-region data plane worked; the regional control and identity path didn't |
| Google, 12 June 2025 | **T1, with detail added.** Service Control is regional with a regional datastore, yet the policy row replicated globally within seconds; remediation is to modularise and fail open | Google Cloud Service Health | Names the "regional compute, global state" anti-pattern |
| Azure Front Door, 29 October 2025 | **T1, deepened.** A configuration sequence across two control-plane versions produced incompatible metadata, which passed protection before an asynchronous task crashed | Microsoft | Configuration needs a skew policy; validators must run the real asynchronous consumer |
| Cloudflare, 18 November 2025 | **T1.** Limit of 200 features against normal use of about 60; failures from 11:20 UTC; core traffic largely normal by 14:30; everything by 17:06 | Cloudflare's postmortem | Unchanged |
| CrowdStrike Channel File 291 | **T2.** 21 fields defined, 20 supplied; an out-of-bounds read; more than 8 million Windows systems | CrowdStrike's root cause analysis, as quoted by the press | Unchanged |
| Kubernetes DRA status in 1.36 | **T1.** Prioritized List and DRA admin access stable; partitionable devices, consumable capacity and device taints beta and on by default | kubernetes.io | Lifecycle: Prioritized List is mature, partitioning is emerging |
| Azure RBAC and deny assignments | **T1, corrected.** RBAC is additive; all deny assignments are currently system-protected, not just most | Microsoft Learn | Azure has no customer-authored organisation-wide deny on permissions; "nobody may do X" is composed |
| Object storage consistency | **T1 for S3** (strong read-after-write for PUT and DELETE in all Regions, per the S3 user guide); T3 for Google Cloud Storage and Azure Blob | AWS | Consistency is no longer the differentiator; authorization and replication are |
| Kubernetes version skew | **T1.** Within one minor for HA API servers; kubelet not newer than the API server and up to three older; no skipped minors | kubernetes.io | Upgrades are sequenced |
| Entra continuous access evaluation | **T1.** Up to 28 hours in CAE sessions, revoked on critical events; about an hour for non-CAE clients; ten-minute minimum configurable lifetime | Microsoft Learn | Freshness moves from expiry to events, where the resource participates |
| FOCUS token columns | **Resolved: none in 1.4.** 1.4 adds two datasets, 47 columns and six attributes; token direction and cache action are proposed for 1.5, with ratification scheduled for 3 December 2026 | FinOps Foundation | Token metering stays a gateway job until at least then |
| AWS GPU prices | **Partly resolved, T1.** Capacity Block rates per accelerator-hour effective 7 October 2026, described as dynamic | AWS pricing | On-demand prices per hour still not verified |
| PagedAttention throughput | **T1, unchanged.** 2 to 4 times at equal latency | Kwon et al., arXiv 2309.06180 | Qualified: holds for decode-heavy, batchable workloads |

## The audit that produced the second edition

The second edition kept the first edition's foundations and fixed four structural problems. Several principles had been stated as absolutes when they are really context-dependent decisions. Time had been a hidden dependency rather than a design variable. Some incident lessons were worded more strongly than the official reports support. And the first edition explained what exists without teaching how to derive consequences. The specific contradictions it resolved:

- **Fail-open.** "Authorization never fails open" sat beside Google's remediation, which made checks fail open. Resolved by the [fail-mode taxonomy](https://www.alesanalytics.com/architecture/failure.md): quota checks may fail open, access checks may not.
- **Freshness against availability.** Any cache is a revocation delay. Resolved by stating the [revocation window](https://www.alesanalytics.com/architecture/identity.md).
- **An incomplete principle list.** "Replication is not backup" wasn't a principle. Now it's P11, and P0 makes the source of truth explicit.
- **"Zones are the cheapest independent domain."** True for physical faults only. Resolved by treating failure domains as vectors.
- **Index classification against ACL trimming.** Trimming changes what a user sees, not what the store holds. Resolved by separating storage and exposure classification.
- **"Agents hold no credentials" against "no long-lived shared secrets".** The blueprint can hold a secret. Resolved by requiring a managed identity's federated credential on the blueprint.
- **Static stability against identity as the first dependency.** A data plane that calls the identity provider isn't statically stable. Resolved by distinguishing local validation, introspection and event-driven revocation.
- **Multi-region and hidden global dependencies.** Strengthened with the corrected AWS facts: fail-static identity.
- **"Configuration is code" against the Front Door lesson.** Added schema versions and a skew policy.
- **"Serving is memory management".** Qualified: at batch; long prefill is compute.
- **Recommendation against principle.** The identity that grants `Sites.Selected` holds `Sites.FullControl.All`, so it joined the Tier-0 set.

A red-team pass then checked the second edition for coherence, hidden dependencies, missing failure domains, over-strong generalisations and oversimplified scenarios, which is where the time source, permission-granting identities, configuration-schema skew, admission webhooks and key rotation came from.

## Still open

**Not re-verified for this edition:** Azure Policy effects and ABAC conditions; the AWS RCP and SCP evaluation order (the first edition's T1 check of 5 October stands); the MCP release-candidate lock date; Microsoft 365 roadmap item MC1234661 on all-locations enforcement (T3); the CrowdStrike root cause analysis itself (quoted by the press, so T2); the text of each individual OWASP agentic entry.

**Open:** endpoint and API names for the Agent Platform after the rename; on-demand GPU prices per hour; the January 2026 Capacity Block increase reported by The Register (p5e.48xlarge from $34.61 to $39.80 an hour, p5en.48xlarge from $36.18 to $41.61), for which no AWS announcement was found, and a reported July increase of about 20% that rests on secondary sources only; the FOCUS 1.5 token properties, still in review.

**Illustrative figures.** The KV-cache sizing and the tokens-per-second figure in the cost calculation use stated, illustrative parameters. They teach how the quantities scale, not how any vendor's hardware performs.

## Freshness

Facts about AI services, Microsoft 365, pricing and regulation should not be relied on after 90 days from verification, which is **4 January 2027**. Facts about how the clouds work underneath should be re-checked after 180 days.

Should you have any questions regarding this page, please contact us at solutions@alesanalytics.com.

## Sources

1. [Regulation (EU) 2026/1744, the Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng). European Union, 2026. The 2026 amendment that moved the high-risk deadlines.
2. [Gemini Enterprise Agent Platform lets you build, govern and optimize your agents](https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/gemini-enterprise-agent-platform/). Google, 2026. Announced at Google Cloud Next on 22 April 2026 as the evolution of Vertex AI, through which Vertex AI services now ship.
3. [Restricted SharePoint Search](https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search). Microsoft, 2026. Retiring: new enablement blocked from 31 July 2026. Described by Microsoft as temporary, and not a security boundary.
4. [Key changes in the 2026-07-28 specification](https://modelcontextprotocol.io/specification/2026-07-28/changelog). Model Context Protocol, 2026. Removes protocol sessions and the initialize handshake, requires server/discover, makes broken streams re-issued as new requests, adds ttlMs and cacheScope, and deprecates Roots, Sampling, Logging and Dynamic Client Registration.
5. [Agent identity blueprints in Microsoft Entra Agent ID](https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint). Microsoft, 2026. Credentials are configured on the blueprint; policy applied to it reaches every agent identity; inheritable permissions flow to agent identities after consent.
6. [Microsoft Purview DLP for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about). Microsoft, 2026. Custom template only; selecting the location disables other locations in the policy; updates take up to four hours to reach Copilot.
7. [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). OWASP GenAI Security Project, 2025. Released 9 December 2025. ASI01 Agent Goal Hijack to ASI10 Rogue Agents.
8. [Summary of the Amazon DynamoDB Service Disruption in the Northern Virginia (US-EAST-1) Region](https://aws.amazon.com/message/101925/). Amazon Web Services, 2025. AWS's post-event summary for 19 and 20 October 2025: a race in DynamoDB's DNS automation left an empty record, with impact in three phases ending at 2:20 PM PDT on 20 October.
9. [Understand Azure deny assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments). Microsoft, 2026. Deny assignments block access even where a role grants it. All deny assignments are currently system-protected.
10. [Kubernetes v1.36 release announcement](https://kubernetes.io/blog/2026/04/22/kubernetes-v1-36-release/). Kubernetes, 2026. Released 22 April 2026. DRA's Prioritized List graduates to stable; partitionable devices and related features remain beta.
11. [FOCUS: the FinOps Open Cost and Usage Specification](https://focus.finops.org/). FinOps Foundation, 2026. Version 1.4, ratified 4 June 2026, adds two datasets, 47 columns and six attributes and no dedicated token columns. Token properties are proposed for 1.5.
12. [Amazon EC2 Capacity Blocks for ML pricing](https://aws.amazon.com/ec2/capacityblocks/pricing/). Amazon Web Services, 2026. Prices per accelerator-hour, described as dynamic. Used here for the rates effective 7 October 2026.
13. [AWS raises GPU prices 15% on a Saturday](https://www.theregister.com/2026/01/05/aws_price_increase/). The Register, 2026. Reports the January 2026 increase: p5e.48xlarge from $34.61 to $39.80 an hour, p5en.48xlarge from $36.18 to $41.61. No AWS announcement was found.
14. [Efficient Memory Management for Large Language Model Serving with PagedAttention](https://arxiv.org/abs/2309.06180). Kwon et al., 2023. Pages the KV cache as an operating system pages memory. Near-zero waste and 2 to 4 times the throughput at equal latency against FasterTransformer and Orca. The design behind vLLM.

## Where to go next

- Previous: [Technology Lifecycle and the Architecture Knowledge Graph](https://www.alesanalytics.com/architecture/lifecycle.md)
- Next: [Claim Verification Standard](https://www.alesanalytics.com/architecture/verification-standard.md)
- Overview and every page: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md)
- The whole site in one file: https://www.alesanalytics.com/llms-full.txt