← Back to interactive architecture

Integration Catalog

24 logical capabilities across 10 categories — pattern first, security and operating profile always, products last (and only as options).

Catalog principle

Logical capabilities first; representative products are OPTIONS with selection criteria, never selections (A-08).

Each entry defines a logical capability the architecture requires, the pattern that realizes it, its security and operating profile, the criteria an organization should score products against, honest trade-offs, and — last — representative products. The catalog does not claim to be exhaustive, and no listed product is an endorsement or a requirement.

Integration-style decision tree

Question (in order)If yes →
1 · Is this a human/partner-facing request needing an immediate answer?Synchronous API via the gateway (contract-first, C-APP-01). Compose at the BFF for channels.
2 · Is it a business fact other systems should learn about (order placed, profile changed)?Publish to the event backbone with a registry-governed schema. Facts are replayable history (ADR-07).
3 · Is it work to be done (generate invoice, send batch) that should load-level?Command on a work queue with competing consumers and a DLQ. Queues are not history.
4 · Is it SaaS↔SaaS or SaaS↔core field synchronization with standard connectors?iPaaS flow with error store + replay. Custom code only for differentiating logic.
5 · Is the counterpart an external trading partner on document standards?B2B gateway (EDI/AS2) with canonical mapping to internal events; onboarding via RB-08.
6 · Is it inherently a file (bank file, bulk export, partner batch)?MFT with checksums, encryption, manifests, window monitoring — never ad-hoc scripts (C-INT-04).
7 · Is it analytical data movement?CDC/batch into the lakehouse raw zone via RB-09 — never app-to-warehouse dual writes.

Anti-pattern guard (S49, S57): if a design needs point-to-point connections between more than two systems, or a "temporary" direct database link across ownership boundaries, it goes to API/integration governance before build — that is how the last ESB happened.

Delivery-semantics standards

ConcernStandard (enforced via golden paths + review)
IdempotencyEvery mutating API takes an idempotency key; every consumer dedupes on event/command id. At-least-once is assumed everywhere; exactly-once is treated as a per-sink property (idempotent merge), not a platform promise (C-INT-03).
OrderingPer-key ordering on streams (partition by aggregate id); cross-key ordering is never assumed. Queues guarantee no ordering — designs requiring it must not use them.
Producer atomicityOutbox pattern: state change + pending event in one transaction, relayed to the broker. No dual writes.
RetriesBounded, exponential backoff with jitter; only idempotent operations retried; retry budgets visible in dashboards.
Dead lettersEvery consumer has a DLQ with owner alerting; entry to production requires a passed poison-message drill (RB-10).
ReplayStreams retain per data class; replay procedures documented and rehearsed; consumers must tolerate replays (dedup + idempotent effects).
ReconciliationFinancial and partner flows carry independent count+amount reconciliation with business-owner alerting (C-INT-05); missed-webhook recovery via scheduled report pulls.

Identity and Access

Enterprise IdP / workforce identity Identity and Access

Business use case
Single sign-on, MFA and conditional access for all workforce apps; SCIM provisioning from HRIS.
Logical pattern
Central IdP federating to apps (OIDC/SAML); IGA drives lifecycle
Protocols
OIDC, OAuth 2.x, SAML 2.0, SCIM 2.0
Identity & access
Phishing-resistant MFA; conditional access; device-trust signals
Data handling
Identity attributes only; minimize claims in tokens
Availability & scaling
Vendor-managed HA; regional failover per vendor
Observability
Sign-in logs to SIEM; risky-sign-in analytics
Security controls
C-ID-01, C-ID-05, C-OPS-03
Operating owner
Security engineering
Selection criteria
Protocol coverage, conditional-access depth, SCIM ecosystem, PAM/IGA integration, cost per user
Trade-offs
Deep ecosystem integration vs vendor coupling of security posture
Representative options
Microsoft Entra ID, Okta, Ping Identity options, not selections (A-08)
Avoid when
Avoid running two workforce IdPs in steady state - consolidation debt compounds

Customer & partner identity (CIAM) Identity and Access

Business use case
Registration, login, MFA, consent and partner federation for external users at consumer scale.
Logical pattern
Dedicated CIAM tenant issuing tokens for channels/APIs; brokered partner federation
Protocols
OIDC, OAuth 2.x, SAML (partner federation)
Identity & access
Risk-based MFA; bot mitigation on auth endpoints; consent records
Data handling
PII: registration data + consent - restricted classification
Availability & scaling
Consumer-scale burst handling; vendor SLA review
Observability
Auth funnel metrics; credential-stuffing detections to SIEM
Security controls
C-ID-02, C-APP-05, C-NET-01
Operating owner
Digital identity team
Selection criteria
Scale/burst pricing, customization of journeys, consent management, residency options
Trade-offs
Build-vs-buy: custom auth is a liability; SaaS CIAM constrains UX edge cases
Representative options
Auth0, Okta CIC, Microsoft Entra External ID, Ping options, not selections (A-08)
Avoid when
Avoid embedding user stores inside individual applications

Privileged access & secrets Identity and Access

Business use case
JIT admin elevation, vaulted credentials, session recording; central secret store with dynamic credentials.
Logical pattern
PAM broker for human privilege; vault issuing short-lived secrets to workloads
Protocols
Native protocols via broker, Vault APIs, KMS APIs
Identity & access
JIT + approval workflows; break-glass with alerting
Data handling
Secrets/keys: restricted; audit every access
Availability & scaling
HA pairs / managed service; DR for vault is tier-1
Observability
Access/session logs to SIEM; anomaly detection on secret reads
Security controls
C-ID-03, C-ID-04, C-DP-02
Operating owner
Security engineering
Selection criteria
Session recording quality, JIT ergonomics (or admins bypass), dynamic-secret engine coverage
Trade-offs
Operational friction vs standing-privilege risk
Representative options
CyberArk, Delinea, HashiCorp Vault, cloud-native secret/key services options, not selections (A-08)
Avoid when
Avoid vault sprawl (one per team) - central service with delegated namespaces

API and Integration

API gateway & management API and Integration

Business use case
Mediated ingress for all API traffic; API products with lifecycle, portal, subscriptions and analytics.
Logical pattern
Edge gateway (PEP) + management plane + developer portal
Protocols
HTTPS/REST, GraphQL (federation optional), gRPC (internal), Webhooks
Identity & access
OAuth2/OIDC validation, mTLS upstream, per-client plans
Data handling
Payload inspection at edge; no payload retention beyond logging policy
Availability & scaling
Horizontally scaled managed tier; multi-AZ
Observability
Per-API RED metrics; anomaly detection on abuse patterns
Security controls
C-APP-01, C-APP-03, C-NET-01, C-INT-01
Operating owner
Integration platform team
Selection criteria
Policy expressiveness, developer-portal quality, hybrid deployment options, price per call vs per gateway-unit
Trade-offs
Full-lifecycle suites vs lean gateways + separate portal; heavier suites risk shelfware
Representative options
Kong, Apigee, Azure API Management, AWS API Gateway options, not selections (A-08)
Avoid when
Avoid multiple gateway products for the same traffic class without a boundary rationale

iPaaS / integration orchestration API and Integration

Business use case
Connector-based SaaS sync (CRM/ERP/HRIS) and orchestrated integrations without custom services.
Logical pattern
Managed connectors + flow orchestration; error stores with replay
Protocols
Vendor connectors, REST, SFTP, Webhooks
Identity & access
Per-connection service principals; least-privilege connector scopes
Data handling
Field-level mapping under version control; PII flows documented
Availability & scaling
Vendor-managed scaling; throughput limits per connector
Observability
Flow run history; failed-record stores with alerting
Security controls
C-INT-05, C-ID-04, C-OPS-03
Operating owner
Integration platform team
Selection criteria
Connector coverage for YOUR SaaS estate, error-handling depth, DevOps support (versioning/promotion), egress pricing
Trade-offs
Speed of delivery vs opaque logic accumulating outside code review - governance needed
Representative options
MuleSoft, Boomi, Workato, Informatica options, not selections (A-08)
Avoid when
Avoid using iPaaS for latency-critical transactional paths or as a de-facto ESB rebuild

B2B gateway / EDI / MFT API and Integration

Business use case
Trading-partner document exchange (EDI), partner onboarding, managed file transfer with non-repudiation.
Logical pattern
B2B gateway canonicalizes EDI<->events; MFT for file classes; partner identity per agreement
Protocols
AS2, SFTP, EDI X12/EDIFACT, REST (modern partners)
Identity & access
Per-partner certs/keys; rotation via onboarding runbook
Data handling
Document archives with retention per agreement class
Availability & scaling
Window-based SLAs; queue-backed absorption of partner bursts
Observability
Ack (997/CONTRL) tracking; missed-window alerts
Security controls
C-INT-04, C-INT-05, C-OPS-03
Operating owner
Partner integration team
Selection criteria
Partner-community size, standards coverage, onboarding tooling, hosted vs self-managed
Trade-offs
Hosted B2B networks simplify ops but embed per-document pricing
Representative options
IBM Sterling, OpenText/Cleo-class platforms, Azure Logic Apps B2B, managed MFT platforms options, not selections (A-08)
Avoid when
Avoid bespoke per-partner scripts - the onboarding runbook must be the only path

Messaging and Streaming

Event streaming backbone Messaging and Streaming

Business use case
Durable domain-event distribution: order/customer/partner events; replay; stream processing feed.
Logical pattern
Partitioned log with consumer groups; schema registry adjacent; DLQ conventions
Protocols
Kafka protocol / equivalent, AMQP (bridge cases)
Identity & access
Broker ACLs bound to workload identities; TLS/mTLS
Data handling
Event payloads minimized (ids + facts, not blobs); PII fields tagged in schemas
Availability & scaling
Multi-AZ replication; partition scaling model documented
Observability
Consumer lag, DLQ depth, schema-failure alerts
Security controls
C-INT-01, C-INT-02, C-INT-03
Operating owner
Integration platform team
Selection criteria
Managed vs self-run economics at your scale, ecosystem (connectors/stream processing), governance tooling
Trade-offs
Operational depth of self-managed clusters vs per-throughput managed pricing
Representative options
Apache Kafka, Confluent Cloud, cloud-native event streams, Apache Pulsar options, not selections (A-08)
Avoid when
Avoid event streaming when a simple queue meets the need (see queue entry) - complexity tax is real

Message queues / work distribution Messaging and Streaming

Business use case
Command-style workloads: invoice generation, notification fan-out smoothing, job distribution with per-message ack.
Logical pattern
Competing consumers on durable queues; DLQ per queue; no replay-by-design
Protocols
AMQP, cloud-native queue APIs
Identity & access
Queue-level ACLs via workload identity
Data handling
Transient payloads; retention days not months
Availability & scaling
Load-leveling by design; consumer autoscaling on depth
Observability
Queue depth, age-of-oldest, DLQ alerts
Security controls
C-INT-02, C-INT-03
Operating owner
Integration platform team
Selection criteria
Delivery guarantees, ordering needs, ecosystem SDK quality
Trade-offs
Queues are simpler than streams; choose by data-vs-work semantics, not fashion
Representative options
RabbitMQ, cloud-native queues (SQS/Service Bus-class) options, not selections (A-08)
Avoid when
Avoid queues as system-of-record event history - that's the stream's job

Data and Analytics

Lakehouse / analytics estate Data and Analytics

Business use case
Unified analytical storage with zones, table format, SQL serving, ML data access.
Logical pattern
Zoned lakehouse (raw/validated/curated/serving) with catalog + quality gates
Protocols
Object storage APIs, open table formats, JDBC/ODBC/SQL
Identity & access
Zone-scoped access via catalog policy; column masking by classification
Data handling
Classification tags mandatory; residency placement per overlay
Availability & scaling
Elastic compute pools; storage-compute separation
Observability
Pipeline run health, freshness SLOs, cost per query domain
Security controls
C-DP-01, C-DP-02, C-DP-03
Operating owner
Data platform team
Selection criteria
Open-format commitment (exit cost), governance depth, workload mix (BI vs ML) fit, unit economics
Trade-offs
Single-estate simplicity vs best-of-breed serving performance (ADR-08 triggers)
Representative options
Databricks, Snowflake, Microsoft Fabric, BigQuery options, not selections (A-08)
Avoid when
Avoid a second warehouse estate 'temporarily' - dual estates calcify

Ingestion: CDC / batch / ELT Data and Analytics

Business use case
Non-invasive replication of operational and SaaS data into the lakehouse raw zone.
Logical pattern
Log-based CDC + scheduled API extracts; manifest-tracked file loads
Protocols
CDC log protocols, vendor bulk APIs, SFTP landing
Identity & access
Read-scoped credentials; source-onboarding runbook approval
Data handling
As-landed with capture metadata; PII tagged on entry
Availability & scaling
Connector autoscale; backfill procedures documented
Observability
Lag metrics; schema-change alerts
Security controls
C-DP-01, C-INT-03
Operating owner
Data platform team
Selection criteria
Source coverage (your DB engines + SaaS), schema-evolution handling, ops burden
Trade-offs
Managed ELT convenience vs per-row pricing at volume
Representative options
Debezium, Fivetran, Airbyte, native cloud DMS-class services options, not selections (A-08)
Avoid when
Avoid dual-writing from applications to analytics - CDC exists to prevent it

Catalog, lineage, MDM & quality Data and Analytics

Business use case
Governance control plane: registration, classification, lineage, golden records, quality monitoring.
Logical pattern
Catalog with policy hooks; MDM match/merge; rule+anomaly quality checks
Protocols
REST APIs, native scanners/connectors
Identity & access
Catalog roles mapped to governance council structure
Data handling
Metadata only (but metadata is sensitive too - access-controlled)
Availability & scaling
Vendor-managed; scanner scheduling
Observability
Coverage metrics: % assets classified, lineage completeness
Security controls
C-DP-01, C-GOV-03
Operating owner
Data governance + platform
Selection criteria
Auto-harvest depth for your stack, policy-enforcement integrations, workflow UX for domain owners
Trade-offs
Heavy suites vs focused tools; adoption beats features
Representative options
Collibra, Microsoft Purview, Alation, dbt (transform-lineage), Informatica MDM-class options, not selections (A-08)
Avoid when
Avoid cataloging as an afterthought project - wire it into onboarding runbooks

BI & semantic layer Data and Analytics

Business use case
Governed dashboards and self-service analytics on curated data products.
Logical pattern
Semantic model layer + certified datasets; row/column policies from classification
Protocols
SQL, vendor APIs
Identity & access
SSO via workforce IdP; dataset permissions from catalog
Data handling
Aggregations preferred; restricted columns masked
Availability & scaling
Vendor-managed scaling; extract vs live-query strategy
Observability
Usage analytics; stale-dashboard cleanup
Security controls
C-DP-03, C-ID-01
Operating owner
Data platform + domain analysts
Selection criteria
Semantic-layer strength (metric consistency), TCO per creator/viewer, lakehouse-native query support
Trade-offs
Central semantic governance vs self-service speed
Representative options
Power BI, Tableau, Looker options, not selections (A-08)
Avoid when
Avoid metric definitions living in individual dashboards

AI

AI gateway / model access AI

Business use case
Single control point for LLM/embedding calls: allowlists, quotas, logging, fallback, cost metering.
Logical pattern
Gateway proxying providers; virtual keys per consumer; inline guardrails
Protocols
Provider REST APIs, OpenAI-compatible API surface
Identity & access
Per-consumer authN/Z; provider keys vaulted centrally
Data handling
Prompt/response logging with redaction; retention per AI policy
Availability & scaling
Stateless horizontal scaling; provider-failover routing
Observability
Token/cost metering; latency + error dashboards; eval hooks
Security controls
C-AI-01, C-AI-02, C-AI-06
Operating owner
AI platform team
Selection criteria
Provider coverage, guardrail extensibility, self-host option, metering granularity
Trade-offs
Emerging market: expect churn; keep the gateway swappable behind your own client SDK
Representative options
LiteLLM-class gateways, cloud provider AI gateways, API-management AI policies options, not selections (A-08)
Avoid when
Avoid letting teams call providers directly 'temporarily' - the exception becomes the architecture

Vector storage & retrieval AI

Business use case
Embedding index for RAG with metadata filtering and namespace isolation.
Logical pattern
Vector DB or lakehouse/pg extension with entitlement-filter metadata
Protocols
Vendor/native APIs, SQL + vector extensions
Identity & access
Namespace/tenant isolation; query-time entitlement filters
Data handling
Chunk provenance + classification metadata mandatory
Availability & scaling
Index sharding; rebuild pipelines for re-embedding
Observability
Recall/latency dashboards; index-freshness alerts
Security controls
C-AI-03, C-DP-01, C-DP-02
Operating owner
AI platform team
Selection criteria
Scale (vectors count), filter expressiveness, ops model, cost per million vectors
Trade-offs
Dedicated vector DB performance vs one-less-system (pgvector/lakehouse-native)
Representative options
pgvector, dedicated vector DBs (Pinecone/Weaviate/Milvus-class), lakehouse-native vector options, not selections (A-08)
Avoid when
Avoid a dedicated vector DB before scale demands it - start with what you operate already

ML platform / MLOps & evals AI

Business use case
Training, experiment tracking, model registry, promotion gates, LLM evaluation harnesses.
Logical pattern
Registry-centered promotion with eval gates; scheduled re-evaluation
Protocols
Vendor/native APIs, MLflow-compatible
Identity & access
Role-scoped registry actions; promotion approvals recorded
Data handling
Training data versioned from curated zone; no raw PII without masking exception
Availability & scaling
Elastic training compute; GPU quota governance
Observability
Eval score trends; drift monitors; lineage model->data
Security controls
C-AI-06, C-DP-03, C-SC-02
Operating owner
AI platform team
Selection criteria
Registry + eval integration depth, lakehouse coupling, cost of managed studios
Trade-offs
Integrated cloud studios vs portable OSS stack
Representative options
MLflow, cloud ML studios (SageMaker/Azure ML/Vertex-class), Databricks ML options, not selections (A-08)
Avoid when
Avoid promoting models without recorded evals - registry without gates is a folder

Development and Platform Engineering

Container platform Development and Platform Engineering

Business use case
Managed Kubernetes for domain services, BFFs, integration and AI runtime workloads.
Logical pattern
Managed control plane; multi-AZ node pools; admission-controlled; GitOps-deployed
Protocols
OCI images, Kubernetes APIs
Identity & access
Workload identity federation; namespace RBAC per team
Data handling
No PV secrets; CSI secret injection
Availability & scaling
Cluster autoscaler + HPA; capacity per RB-18
Observability
Cluster + workload golden signals; cost per namespace
Security controls
C-CLD-03, C-SC-02, C-NET-02
Operating owner
Platform engineering
Selection criteria
Managed-service maturity on your provider, node economics, team skills (ADR-04 criteria)
Trade-offs
K8s power vs cognitive load - PaaS escape valve exists deliberately
Representative options
EKS/AKS/GKE-class managed Kubernetes, Red Hat OpenShift options, not selections (A-08)
Avoid when
Avoid K8s for a handful of simple apps - use PaaS (ADR-04)

CI/CD, GitOps & registry Development and Platform Engineering

Business use case
Pipeline templates with security gates, signed artifacts, GitOps delivery, IaC modules.
Logical pattern
Golden-path pipelines; GitOps controllers reconcile; registry verifies provenance
Protocols
Git, OCI, provider APIs
Identity & access
OIDC-federated pipeline identities (no long-lived cloud keys)
Data handling
Build metadata + SBOM retained per release
Availability & scaling
Runner autoscaling; queue-time SLOs
Observability
DORA metrics; pipeline failure analytics
Security controls
C-SC-01, C-SC-02, C-SC-03, C-CLD-02
Operating owner
Platform engineering
Selection criteria
Existing SCM gravity, runner economics, GitOps controller fit, policy integration
Trade-offs
One integrated suite vs best-of-breed chain
Representative options
GitHub + Actions, GitLab, Azure DevOps, Argo CD, Flux, Terraform/OpenTofu, Nexus/Artifactory options, not selections (A-08)
Avoid when
Avoid snowflake pipelines per team - templates with escape hatches instead

Internal developer portal Development and Platform Engineering

Business use case
Service catalog, scaffolding, self-service environments, docs, scorecards.
Logical pattern
Portal over platform APIs; templates call IaC/CI; ownership metadata canonical
Protocols
REST/GraphQL plugins
Identity & access
SSO; actions authorized via platform RBAC
Data handling
Catalog metadata (owners, SLOs, tiers) - keep authoritative
Availability & scaling
Modest footprint; availability tied to developer productivity not prod traffic
Observability
Adoption metrics; scaffold usage; DevEx survey integration
Security controls
C-ID-01, C-GOV-01
Operating owner
Platform engineering
Selection criteria
Plugin ecosystem vs hosted simplicity; catalog model fit
Trade-offs
Backstage flexibility vs upkeep cost; hosted portals trade control
Representative options
Backstage, hosted IDP products (Port/Cortex-class) options, not selections (A-08)
Avoid when
Avoid portal-first rollouts - paved roads must exist before the storefront

Security

SIEM / SOAR / detection stack Security

Business use case
Central security analytics, detection engineering, automated response.
Logical pattern
Log pipeline -> SIEM detections -> SOAR playbooks -> ITSM cases
Protocols
Syslog/CEF/OTLP/native connectors
Identity & access
SOC roles; playbook approvals for destructive actions
Data handling
Security telemetry retention per policy; privacy-aware log scoping
Availability & scaling
Ingest scales with estate; cost per GB is the design constraint
Observability
Detection coverage mapping; MTTD/MTTR trends
Security controls
C-OPS-03, C-OPS-04, C-GOV-03
Operating owner
Security operations
Selection criteria
Ingest economics, detection content quality, SOAR integration breadth, data-lake offload options
Trade-offs
Single-vendor XDR gravity vs best-of-breed; log volume drives cost surprises
Representative options
Microsoft Sentinel, Splunk, Elastic Security, CrowdStrike + SIEM pairings options, not selections (A-08)
Avoid when
Avoid onboarding everything at max verbosity - telemetry tiering first

CNAPP / posture & workload protection Security

Business use case
Cloud misconfiguration detection, workload vulnerability management, runtime protection.
Logical pattern
Agentless posture scans + runtime sensors where justified
Protocols
Cloud provider APIs, agents/eBPF sensors
Identity & access
Read-only posture roles; finding-based access
Data handling
Findings metadata; no customer data
Availability & scaling
SaaS-delivered; scan scheduling
Observability
Finding SLAs; recurring-finding analytics
Security controls
C-CLD-04, C-SC-04
Operating owner
Security engineering
Selection criteria
Coverage of your cloud(s) + K8s, prioritization quality (reachability), noise levels
Trade-offs
Consolidated CNAPP vs existing point tools overlap
Representative options
Wiz, Orca, Microsoft Defender for Cloud, Palo Alto Prisma Cloud options, not selections (A-08)
Avoid when
Avoid buying overlapping scanners - rationalize before adding

Observability and Operations

Observability platform Observability and Operations

Business use case
Metrics/logs/traces storage, dashboards, SLOs, alerting; OTel-native.
Logical pattern
OTel collectors -> backend(s); SLO engine; alert routing by ownership
Protocols
OTLP, PromQL/native query APIs
Identity & access
SSO; team-scoped data access
Data handling
Telemetry redaction at collector; retention tiers by signal
Availability & scaling
Ingest autoscaling; sampling strategies control cost
Observability
Self-monitoring; ingest/cost dashboards
Security controls
C-OPS-01, C-OPS-02
Operating owner
SRE / platform
Selection criteria
OTel fidelity, query ergonomics, cost model (ingest vs seats), correlation UX
Trade-offs
SaaS convenience vs self-hosted cost control at volume
Representative options
Grafana stack (Prometheus/Loki/Tempo), Datadog, Dynatrace, New Relic, Elastic options, not selections (A-08)
Avoid when
Avoid three observability stacks 'temporarily' - consolidation is a wave-1 quick win

Incident management & paging Observability and Operations

Business use case
On-call scheduling, escalation, incident comms, post-incident workflow.
Logical pattern
Alert routes -> paging -> incident room -> ITSM record -> PIR
Protocols
Email/SMS/push/chat integrations, ITSM APIs
Identity & access
SSO; schedule ownership per team
Data handling
Incident metadata; comms templates
Availability & scaling
Vendor-managed HA (this must not share fate with your outage)
Observability
MTTA/MTTR; alert-noise analytics
Security controls
C-OPS-01, C-GOV-03
Operating owner
SRE
Selection criteria
Reliability of the pager itself, ITSM integration depth, cost per responder
Trade-offs
Standalone pager resilience vs suite consolidation
Representative options
PagerDuty, Opsgenie, ServiceNow paging modules options, not selections (A-08)
Avoid when
Avoid paging through the same cloud/region as production only

Backup and Recovery

Backup / immutable backup / cyber vault Backup and Recovery

Business use case
Policy-driven backup across DBs, object stores, SaaS; immutability; isolated recovery copies.
Logical pattern
Central policy engine; immutability windows; vault with separate credentials
Protocols
Provider snapshot APIs, agent-based where needed, SaaS-backup connectors
Identity & access
Separate backup admin realm; vault credentials air-gapped from prod IdP
Data handling
Backup data inherits source classification; encryption with owned keys
Availability & scaling
Restore-time objectives measured, not assumed
Observability
Restore-test evidence dashboards; job failure alerts
Security controls
C-RES-01, C-RES-02, C-DP-02
Operating owner
SRE / infrastructure
Selection criteria
Coverage of your stores incl. SaaS, immutability guarantees, restore ergonomics at scale
Trade-offs
Cloud-native simplicity vs cross-platform consistency of enterprise suites
Representative options
cloud-native backup services, Veeam, Rubrik, Cohesity, Commvault options, not selections (A-08)
Avoid when
Avoid backup tools whose restore you have never timed

Cloud, Hybrid, Edge and Virtualization

Cloud provider & hybrid platform Cloud, Hybrid, Edge and Virtualization

Business use case
Primary hosting for the modernized estate; hybrid coexistence with on-prem during transition.
Logical pattern
Single primary provider (ADR-02) + landing zones; private interconnect to on-prem
Protocols
Provider APIs, IaC providers
Identity & access
Org-level IAM federation; SCPs/policies as guardrails
Data handling
Residency placement per overlay; egress cost governance
Availability & scaling
Multi-AZ baseline; multi-region per OD-01 decision only
Observability
Cloud-native monitoring + billing export to FinOps
Security controls
C-CLD-01, C-GOV-02, C-NET-02
Operating owner
Cloud foundation team
Selection criteria
Existing contracts/skills, managed-service depth for your workload mix, region availability vs residency needs, unit pricing
Trade-offs
Provider depth vs lock-in; multi-cloud only with documented justification (ADR-03)
Representative options
Microsoft Azure, AWS, Google Cloud, VMware-successor / Nutanix for residual on-prem virtualization options, not selections (A-08)
Avoid when
Avoid multi-cloud for resilience theater - it doubles platform cost for rarely-realized benefit (ADR-03)