28 Reference Architecture Scenarios

1. Internal AI assistant

• Components and flows. I: OIDC sign-in to the app, which calls a model gateway with the user's claims. D: ACL-filtered retrieval, then the model, then a cited answer. N: an identity-aware proxy, a private application, private endpoints.
• Boundaries and controls. User to app: Conditional Access and a compliant device. App to model provider: no training on prompts, region pinned. DLP on output.
• Failure and cost. The identity provider, the model API and index freshness. Cost is dominated by retrieved context, not by the answer.
• Alternative. Microsoft 365 Copilot. This shape wins when you need one gateway to centralise policy and metering across sources.
• Notice. Late verification of the top results at the source, and a revocation window set per data class. See worked example 1.

2. Private RAG platform

• Components and flows. Ingest into a raw zone, then a chunked zone, then indexes partitioned by class, with a workload identity per tenant.
• Boundaries and controls. A partition per class, a key per tenant, and deletion events that reach the index.
• Failure and cost. Changing the embedding model means a re-embedding migration. Vector storage grows quietly.
• Alternative. The provider's managed search. This shape shares freshness, ACL handling and provenance across every application that uses it.
• Notice. Keep storage classification (the maximum of the inputs) separate from exposure classification (per request, after trimming).

3. Agent platform

• Components and flows. An agent runtime, an MCP tool registry, a policy decision point, approvals, Entra Agent ID or workload identities, a memory store and an evaluation harness.
• Boundaries and controls. Every tool is a boundary. Side effects need approval. Each of ASI01 to ASI10 is mapped to a control.
• Failure and cost. Loops (ASI08) need circuit breakers. Multi-step tasks multiply tokens.
• Alternative. A workflow engine, or AgentCore, Foundry or the Agent Platform. Whatever you choose, keep authorization outside the model.
• Notice. The blueprint credential is Tier-0. Side-effecting tools must be idempotent. Irreversible actions fail to manual.

4. AI over Microsoft 365

• Components and flows. Delegated Graph access, or the semantic index, feeding Copilot. Output carries the strictest label among its sources.
• Boundaries and controls. Permission remediation first. DLP on the Copilot location. Restricted Content Discovery where needed.
• Failure and cost. Oversharing. The four-hour DLP lag. Per-user licensing against per-token cost.
• Alternative. A custom RAG platform using Sites.Selected. Either way, the permission state is the architecture.
• Notice. Copilot DLP is a separate policy estate. The identity that grants Selected scopes is Tier-0. Replace RSS with RCD now: it is closed to new enablement and retiring.

5. AI over SAP and ERP

• Components and flows. Reads go through CDC into a curated data product and a semantic layer. Writes go through a tool to the ERP API, with the user mapped.
• Boundaries and controls. ERP roles mapped to data-platform roles; row-level security in the warehouse; approved writes only.
• Failure and cost. Replication lag. API limits.
• Alternative. The vendor's own AI. Whichever you choose, reuse the ERP's authorization or reproduce it and test the reproduction.
• Notice. Write tools must be idempotent.

6. AI over documents

• Components and flows. Upload into quarantine (malware scanning, injection heuristics), then layout parsing, then the index, with citations to the page.
• Boundaries and controls. Nothing is indexed before quarantine. Retention in the index matches retention at the source.
• Failure and cost. OCR drift. Per-page OCR cost. Long-context cost.
• Alternative. Long context alone, which works only for small collections.
• Notice. Ingestion is a security boundary.

7. AI over databases

• Components and flows. A semantic layer, then text-to-SQL, then a validator (read-only, with cost limits), then a database with row-level security.
• Boundaries and controls. No DDL or DML. Caps on rows and cost.
• Failure and cost. Joins that are silently wrong. Scan cost.
• Alternative. Metrics APIs exposed as tools. The semantic layer is what constrains the model.
• Notice. The semantic layer and the read-only validator do the work; the model doesn't.

8. Multi-model gateway

• Components and flows. A multi-region gateway, policy mapping models to data classes, a vault, metering.
• Boundaries and controls. Allow-lists, redaction, bulkheads.
• Failure and cost. A provider outage or a regulatory withdrawal triggers an equivalent fallback. The gateway is Tier-1.
• Alternative. Each provider's own gateway. This shape gives you a single choke point for authorization, cost and resilience.
• Notice. Every check has its own fail mode, and a fallback is a route that must pass the same evaluation and residency checks.

9. Self-hosted open-weight models

• Components and flows. Kubernetes with DRA and a quota queue, a PagedAttention-class serving engine, a signed model registry, no egress.
• Boundaries and controls. Weight provenance. Licence terms, such as the Llama 4 clause on multimodal use in the EU. No prefix cache shared across tenants.
• Failure and cost. GPU exhaustion, Xid errors and out-of-memory, KV utilisation, time to first token.
• Alternative. Managed open-weight endpoints. Self-hosting trades serving operations for control.
• Notice. Size on KV memory (see the numbers). DRA's core is stable and its partitioning features are beta.

10. Hybrid AI

• Components and flows. A classifier routes high-class requests to an on-premises model, and low-class requests to the cloud with redaction.
• Boundaries and controls. Default deny to the cloud when the class is unknown.
• Failure and cost. Misclassification. Running two estates.
• Alternative. Everything on-premises. Compute goes where the data is allowed to go.
• Notice. The default for an unclassified request decides whether this design meets its requirement.

11. On-premises AI

• Components and flows. Local GPUs, a serving engine, a vector database, an identity provider, telemetry.
• Boundaries and controls. No external processing zone at all.
• Failure and cost. Hardware lead times, a single site, fixed capacity, which means admission control.
• Alternative. A sovereign cloud, which also removes external processing.
• Notice. With fixed capacity, the queueing curve is the design. See utilisation and latency.

12. Cloud AI

• Components and flows. Provider models, search, agents and private endpoints.
• Boundaries and controls. The provider's IAM.
• Failure and cost. Regional availability, quotas, deprecations.
• Alternative. Add a gateway. Going cloud-native gets the most out of managed services, and ties you to the provider's agent and evaluation tooling.
• Notice. Track renames and deprecations as lifecycle events.

13. Multi-cloud AI

• Components and flows. A gateway, cross-cloud workload identity federation, and cost normalised to FOCUS.
• Boundaries and controls. No static keys anywhere.
• Failure and cost. Separate control planes help only if the fallback has been tested. Egress.
• Alternative. A single cloud. You're trading model diversity against identity complexity.
• Notice. List everything that gets duplicated: IAM, networking, KMS, logging, landing zones, runbooks.

14. Strict data residency

• Components and flows. In-region deployments with no global routing; in-region indexes and logs; a sovereign cloud such as AWS European Sovereign Cloud; customer-managed keys.
• Boundaries and controls. Data at rest, data in processing and support access treated separately. Cross-region inference disabled.
• Failure and cost. Disaster recovery must stay inside the jurisdiction.
• Alternative. On-premises. Residency binds every hop, including telemetry.
• Notice. Telemetry is derived data. A fallback can't leave the jurisdiction.

15. Highly regulated AI

• Components and flows. An inventory, a risk register, evaluation evidence, immutable logs, human review, change control.
• Boundaries and controls. Every model, prompt and index change controlled, with evidence.
• Failure and cost. A gap in the evidence is a compliance failure.
• Alternative. None really: regulation turns into traceability. Under the EU AI Act as amended by Regulation (EU) 2026/1744, the Annex III high-risk obligations apply from 2 December 2027.
• Notice. Article 50 applies from 2 August 2026, and the machine-readable marking duty in Article 50(2), for generative systems already on the market before that date, has a transitional deadline of 2 December 2026. Evidence must distinguish systems placed on the market before and after 2 August 2026.

16. Highly available application

• Components and flows. Compute across availability zones, a zone-redundant load balancer and cache, a database with a synchronous replica.
• Failure and cost. A zonal loss is absorbed. Pre-scale for static stability: 1.5 times at three zones, 2 times at two.
• Alternative. Multi-region.
• Notice. Corrected: zones are the cheapest independent domain for physical faults only. They share the region's control plane, configuration and identity.

17. Multi-region application

• Components and flows. Active-passive, with asynchronous replication and DNS or a global load balancer, or active-active with conflict semantics or a global database.
• Failure and cost. Hidden global dependencies. DNS TTL bounds how fast you can fail over.
• Alternative. None: regions are independent only if their dependencies are.
• Notice. Corrected fact: in the October 2025 AWS incident, global-table replicas in other regions stayed reachable with prolonged replication lag, while sign-in through a regional IAM path failed. Design for fail-static identity. See worked example 2.

18. Hybrid enterprise

• Components and flows. One identity provider, non-overlapping IP ranges, hybrid DNS, dual links, unified policy, a central SIEM, IaC.
• Boundaries and controls. Tiered administration.
• Failure and cost. A single link or a single DNS forwarder as a point of failure.
• Alternative. None: consistency of identity, naming and policy matters more than location.
• Notice. Give the IPv6 path the same policy as the IPv4 one.

19. Data platform

• Components and flows. CDC into a lake on an open table format, query engines, a catalogue with lineage, row-level security and masking, and data products served to AI.
• Boundaries and controls. Data moves zone by zone, and reaches external processing only through data products.
• Failure and cost. Freshness and completeness SLOs.
• Alternative. A warehouse-centric design, or a data mesh. Open formats keep the decision reversible.
• Notice. Tombstones and lineage carry deletion.

20. Event-driven integration

• Components and flows. A broker, a schema registry, the outbox pattern, idempotent consumers, a dead-letter queue.
• Boundaries and controls. Authorization at the message level.
• Failure and cost. Poison messages, lag, duplicates.
• Alternative. Synchronous APIs. With events, outages become delays.
• Notice. Exactly-once effect comes from idempotency, not from the broker.

21. Disaster recovery

• Components and flows. Immutable backups under separate credentials, IaC rebuild, runbooks, break-glass for DR, DNS failover.
• Boundaries and controls. The backup identity plane is isolated.
• Failure and cost. Untested restores. Keys in the compromised account. No GPU capacity in the DR region.
• Alternative. Tiers from restore-only through pilot light and warm standby to active-active. Recovery exists only if it has been exercised.
• Notice. Build the restore dependency graph, and keep the keys separate.

22. Secure API platform

• Components and flows. A gateway with OAuth and OIDC, mutual TLS for partners, a WAF, rate limits, schema validation and an API catalogue.
• Boundaries and controls. Fine-grained authorization inside each service, which is what stops broken object-level authorization (BOLA).
• Failure and cost. Metrics per consumer.
• Alternative. A service mesh alone.
• Notice. The gateway is coarse; the service is fine. A gateway can't check object-level access.

23. Enterprise search

• Components and flows. Connectors that capture ACLs, identity mapping and security trimming.
• Boundaries and controls. Completeness of the identity mapping.
• Failure and cost. Over- or under-exposure; throttling.
• Alternative. None: this is the same architecture as RAG retrieval, so build it once and share it.
• Notice. A vector database and a search index are the same capability, a derived retrieval index.

24. SaaS integration

• Components and flows. An iPaaS, SCIM, webhooks into a queue, a vault, rate-limit handling.
• Boundaries and controls. An identity per connector.
• Failure and cost. API deprecations. Lost webhooks, which need reconciliation.
• Alternative. Point-to-point integration. External control planes need buffering.
• Notice. Assume webhooks get lost, and reconcile on a schedule.

25. Kubernetes platform

• Components and flows. A managed control plane, GPU pools, a CNI with network policy, the Gateway API, workload identity, admission policy, GitOps and a signed registry.
• Boundaries and controls. Isolation by namespace or tenant.
• Failure and cost. Upgrades, API deprecations, CoreDNS saturation. The cluster is the blast radius.
• Alternative. VMs. Kubernetes gives a consistent substrate in exchange for platform operations.
• Notice. Plan the skew path, and set webhook failure policies deliberately.

26. Developer platform

• Components and flows. A portal, templates, CI/CD with SLSA provenance, ephemeral environments, policy as code, cost per team.
• Boundaries and controls. Signed artefacts.
• Failure and cost. Templates drifting from what teams actually run.
• Alternative. None: a platform encodes decisions as defaults.
• Notice. The CI identity is Tier-0.

27. Observability platform

• Components and flows. OpenTelemetry, a pipeline that samples and redacts, backends, an SLO service, a store for AI traces.
• Boundaries and controls. Redaction before storage.
• Failure and cost. Ingest and cardinality cost. It needs a failure domain of its own.
• Alternative. None: telemetry that shares fate goes blind when you need it.
• Notice. Independent paging, residency of telemetry, and access control on logs.

28. Zero-trust application

• Components and flows. An identity-aware proxy, device posture, a per-request PDP, mTLS service identities, micro-segmentation, following NIST SP 800-207.
• Boundaries and controls. Every request.
• Failure and cost. The PDP and the identity provider are Tier-0. Cached decisions with bounded staleness.
• Alternative. A VPN. Zero trust moves the perimeter to each request.
• Notice. Corrected: "bounded staleness" means a stated revocation window, ideally shortened by CAE-style events.