Appendix A: The Catalogue of Tools of the Series

This appendix lists every tool that the ten earlier volumes of The Transformed Architecture describe, as recorded in data/tool_inventory.jsonl. An entry gives the tool as its book names it, the book and chapters where it appears, the identifier family where there is one, and the chapter of this book that treats it. The list is generated by scripts/generate_outlines.py; edit the inventory, not this file. The repository's own publishing scripts are listed in Appendix B.

The catalogue has 1402 entries.

Artefacts

Tool	Book	Chapters	Identifier	Treated in
05_CODE_1: GDPR-compliant CI/CD pipeline (GitHub Actions workflow)	1	5, A	05_CODE_*	Chapter 5
05_CODE_2: Jenkins pipeline with GDPR compliance	1	5, A	05_CODE_*	Chapter 8
05_CODE_3: Terratest for VPC implementation	1	5, A	05_CODE_*	Chapter 5
06_CODE_5: Structurizr workspace for a complete e-commerce platform	1	6, A	06_CODE_*	Chapter 6
07_CODE_1: VPC setup with GDPR compliance (CloudFormation)	1	7, A	07_CODE_*	Chapter 8
10_CODE_1: Advanced Policy-as-Code module for EU compliance	1	10, A	10_CODE_*	Chapter 8
10_CODE_2: OSCAL profile for regulated financial services	1	10, A	10_CODE_*	Chapter 8
10_CODE_3: OSCAL component definitions for reusable cloud modules	1	10, A	10_CODE_*	Chapter 8
10_CODE_4: Automated OSCAL System Security Plan generator	1	10, A	10_CODE_*	Chapter 8
13_CODE_A: Vitest configuration for IaC projects	1	13, A	13_CODE_*	Chapter 5
13_CODE_B: Terraform configuration generator	1	13, A	13_CODE_*	Chapter 6
13_CODE_C: Terraform configuration generator tests	1	13, A	13_CODE_*	Chapter 6
13_CODE_D: Infrastructure validator	1	13, A	13_CODE_*	Chapter 6
13_CODE_E: Infrastructure validator tests	1	13, A	13_CODE_*	Chapter 6
13_CODE_F: GitHub Actions Vitest workflow	1	13, A	13_CODE_*	Chapter 5
13_CODE_G: Requirements as Code definition	1	13, A	13_CODE_*	Chapter 4
13_CODE_H: Requirements validation framework	1	13, A	13_CODE_*	Chapter 5
13_CODE_I: Terratest for GDPR-compliant infrastructure	1	13, A	13_CODE_*	Chapter 6
13_CODE_J: Policy-as-Code testing with OPA	1	13, A	13_CODE_*	Chapter 5
13_CODE_K: Kubernetes infrastructure test suite	1	13, A	13_CODE_*	Chapter 6
13_CODE_L: Infrastructure testing pipeline	1	13, A	13_CODE_*	Chapter 5
14_CODE_1: Terraform service blueprint for a web application landing zone	1	14, A	14_CODE_*	Chapter 6
14_CODE_2: Environment configuration and observability controls	1	14, A	14_CODE_*	Chapter 15
14_CODE_3: Continuous delivery workflow for infrastructure changes	1	14, A	14_CODE_*	Chapter 6
15_CODE_1: Cost-aware Terraform infrastructure configuration	1	15, A	15_CODE_*	Chapter 17
15_CODE_2: Kubernetes cost optimisation manifests	1	15, A	15_CODE_*	Chapter 17
15_CODE_3: AWS cost monitoring and optimisation automation	1	15, A	15_CODE_*	Chapter 17
17_CODE_1: Infrastructure platform team blueprint	1	17, A, C	17_CODE_*	Chapter 6
17_CODE_2: IaC competency framework utilities	1	17, A	17_CODE_*	Chapter 21
17_CODE_3: DevOps performance measurement framework	1	17, A	17_CODE_*	Chapter 15
21_CODE_1: Multi-cloud enterprise landing zone	1	21, A	21_CODE_*	Chapter 6
24_CODE_1: Comprehensive test framework for Architecture as Code	1	24, A	24_CODE_*	Chapter 5
24_CODE_2: Governance policy configuration	1	24, A	24_CODE_*	Chapter 8
AaC reference Structurizr workspace (aac_reference_workspace.dsl) and manifest	1	6, 24, B		Chapter 4
ADR dashboards (lifecycle timeline, policy coverage heat map, review debt tracker)	1	4		Chapter 14
ADR directory layout (docs/adr/)	1	4		Chapter 4
ADR status lifecycle (Proposed, Accepted, Deprecated, Superseded)	1	4		Chapter 4
Advanced threat detection platform (Python)	1	9b		Chapter 12
Agent role set (Project Manager, Architect, Requirements Analyst, Designer, Developer, Quality Control, Editor, Graphic Designer)	1	20		Chapter 18
AI-augmented infrastructure optimiser (ai_optimiser.py)	1	12		Chapter 6
Anti-pattern severity classification	1	26b		Chapter 7
Architect agent system prompt	1	20		Chapter 18
Architecture as Code Maturity Model (Levels 0-5)	1	D, Maturity model		Chapter 8
Architecture coverage script and ci/validate-architecture.py	1	6		Chapter 14
Architecture Decision Record (ADR) template	1	4	ADR-*	Chapter 4
Argo CD Application manifest	1	7		Chapter 16
AsyncAPI 3.0 saga definition	1	8		Chapter 9
Authentication FR as code (requirements/authentication-fr.yaml)	1	2		Chapter 5
Automated compliance pipeline (compliance-check.yml)	1	21		Chapter 8
Backend partial configuration (backend.eu-central-1.hcl)	1	21		Chapter 6
Budget envelope files (Budgeting as Code)	1	19		Chapter 5
CALM definition example	1	22		Chapter 16
Carbon-aware scheduling (carbon_aware_scheduling.py)	1	25		Chapter 17
CloudFormation legacy import template and resource identifier list	1	16		Chapter 5
CODEOWNERS for architectural review	1	2, 6, 19		Chapter 4
Community of practice charter	1	18		Chapter 3
Compliance test container (test/Dockerfile.compliance-test)	1	5		Chapter 8
Control Mapping Matrix	1	12, D, 15a	SEC-*	Chapter 8
Course action plan canvas, lab submission checklist, module workbook template, radar reflection log	1	course		Chapter 3
Crypto-agility baseline (crypto-agility-baseline.tf)	1	12		Chapter 6
Documentation workflow (.github/workflows/docs.yml)	1	2		Chapter 5
Editor agent documentation-consistency workflow	1	20		Chapter 18
Enterprise security Rego policy (package se.enterprise.security) and MFA identity policy	1	10		Chapter 20
Evidence export pipeline in the blueprint	1	C		Chapter 5
Evidence lifecycle table (capture, packaging, storage, indexing, retrieval, expiry, access control)	1	15a		Chapter 5
Evidence manifest	1	15a		Chapter 5
FINOS project blueprint (CALM-based repository blueprint)	1	C		Chapter 17
GDPR compliance Rego policy (policies/gdpr_compliance.rego)	1	9b		Chapter 8
Governance and Security Controls as Code backlog	1	11		Chapter 8
Governance Rego policies (encryption at rest, tag compliance) with tests and CI step	1	11		Chapter 8
Handover checklist from ADRs	1	4		Chapter 3
Incident response playbook as state machine	1	9c		Chapter 12
Infrastructure CI workflow (infrastructure-ci) and package.json test scripts	1	13		Chapter 6
Issue templates for management decisions	1	19		Chapter 22
Istio VirtualService weighted canary routing	1	8		Chapter 16
Kubernetes Deployment, Helm values, Docker Compose and Terraform cluster examples	1	7		Chapter 16
Legacy resource import script (migration/import-legacy-resources.sh)	1	16		unassigned
Lessons-learned knowledge registry entry (LL-*)	1	23	LL-*	Chapter 5
Management as Code artefacts (OKRs, budgets, competency frameworks, playbooks, policies as files)	1	19		Chapter 12
Maturity model checklist (50 yes/no questions across ten disciplines)	1	D, Maturity model		Chapter 8
MFA evidence export pipeline	1	15a		Chapter 5
Migration assessment automation (infrastructure_discovery.py)	1	16, D		Chapter 6
Migration playbook (generated Markdown)	1	16, D		Chapter 12
Migration testing framework	1	16		Chapter 5
New-service DSL template (templates/new-service.dsl) and onboarding guide	1	6		Chapter 4
OPA Gatekeeper constraint blocking privileged containers	1	7		Chapter 5
Pandoc defaults (docs/pandoc.yaml excerpt)	1	B		Chapter 5
Performance NFR as code (requirements/performance-nfr.yaml)	1	2		Chapter 5
Pipeline monitoring ConfigMap (monitoring/pipeline-monitoring.yaml)	1	5		Chapter 5
Pipeline stage table (validation, scanning, cost estimation, compliance tests)	1	5		Chapter 17
PlantUML and Mermaid diagram examples	1	22		Chapter 4
Platform and product team charter (team-structure.yaml)	1	18		Chapter 6
Radar assessment export (JSON and PDF report)	1	D		Chapter 8
Readiness scorecard	1	26a		Chapter 3
Requirements validation test (test/requirements_validation.py)	1	2		Chapter 5
Resilience checklist for infrastructure changes	1	14		Chapter 13
Risk definition document (RISK-*)	1	9c	RISK-*	Chapter 7
SBOM generation steps (Syft, CycloneDX) in CI	1	15a		Chapter 5
Secure IaC state management and security foundation Terraform module	1	9b		Chapter 6
Security requirements as code (requirements/security-requirements.yaml)	1	2		Chapter 5
Self-service developer portal (infrastructure_provisioning.py)	1	21		Chapter 6
Serverless infrastructure definition	1	12		Chapter 6
Skills matrix (technical Levels 1-4 and interpersonal)	1	18		Chapter 21
SLSA provenance attestation (in-toto statement)	1	15a		Chapter 5
Structurizr CI workflows (diagram automation, documentation, validation; GitLab CI job)	1	6		Chapter 5
Structurizr example workspaces (E-Commerce, Microservices, Event-Driven, Multi-Tenant SaaS)	1	6		Chapter 4
Structurizr multi-file workspace layout (workspace.dsl, model/*.dsl)	1	6		Chapter 4
Team norms file (team-norms.yaml)	1	23		Chapter 5
Time-bound risk exception	1	9c		Chapter 7
Training programme blueprint (training-program.yaml)	1	18		Chapter 21
unified-build-release.yml workflow excerpt	1	B		Chapter 16
Acceptable-use policy for staff	2	9	—	Chapter 5
Adoption dashboard definition	2	15	dashboards/adoption/*.yaml	Chapter 3
Agent environment assessment	2	19	agent_environment_assessment	Chapter 18
Agent permission manifest	2	18, 20	agents/*/permissions.yaml	Chapter 20
Agent stop policy	2	19	agent_stop_policy	Chapter 19
AI competence framework	2	14	competence/ai-competence-framework.yaml	Chapter 21
AI Decision Record	2	3, 8, 9, 13, 21	AIDR-*	Chapter 7
AI governance charter	2	1	charter.yaml	Chapter 8
AI governance policy	2	9	governance/policy.md	Chapter 8
AI risk report to the management body	2	16	—	Chapter 8
AI system inventory entry	2	9	ai-system/*	Chapter 7
AI team topology	2	12	organisation/ai-team-topology.yaml	Chapter 6
Algorithm register entry (public)	2	17	NR-ALG-*	Chapter 7
Allocation map and showback	2	16A	finops/allocation/*.yaml	Chapter 17
Anti-pattern catalogue	2	20	—	Chapter 3
Anti-pattern fitness functions	2	20	anti-pattern-fitness-functions.yaml	Chapter 3
Audit test procedure	2	11	TP-AI-*	Chapter 8
Benefits record	2	16	portfolio/benefits/*	unassigned
Champions charter	2	15	—	Chapter 3
Competence record	2	14	competence/records/*.yaml	Chapter 21
Consultation commitments	2	15	consultation/*-commitments.yaml	Chapter 22
Consumption forecast	2	16A	portfolio/forecasts/*.yaml	Chapter 3
Contract clause checklist	2	7	—	Chapter 9
Data handling standard	2	9	data_handling_standard	Chapter 7
Decision record (minute)	2	13, 16A	DEC-*	Chapter 4
Decision tiers	2	13	governance/decision-tiers.yaml	Chapter 8
Decision-rights matrix	2	16	decision_rights	Chapter 8
Declared intent and staff statement on AI tools	2	1, 4	—	unassigned
Deployer obligations checklist	2	11	deployer_obligations	Chapter 16
Deployment policy	2	9	ai.governance.deployment	Chapter 16
Due-diligence questionnaire	2	7	—	Chapter 12
Economics decision table	2	16A	economics-decisions.yaml	Chapter 8
Engagement charter	2	12	—	unassigned
Entity reporting profile	2	16	reporting/profiles/entities.yaml	Chapter 8
EU AI Act obligation mapping	2	Appendix A	governance/aiact/obligation-mapping.yaml	Chapter 8
Evidence manifest	2	11	EvidenceManifest	Chapter 5
Evidence pack index	2	11	evidence_pack	Chapter 5
Exit and substitution plan	2	6, 7	—	Chapter 9
Fairness evaluation configuration	2	10	fairness_evaluation	Chapter 22
Forum terms of reference	2	13, 16	governance/forums/*.yaml	Chapter 18
FRIA summary for publication	2	17	—	Chapter 8
Fundamental rights impact assessment (FRIA)	2	10, 17	FRIA-*	Chapter 7
Governance roadmap	2	23	roadmaps/*.yaml	Chapter 8
Group entity profile	2	12	organisation/group-entities.yaml	Chapter 5
Horizon register	2	22, 24	horizon-register.yaml	Chapter 23
Human-oversight design specification	2	10	oversight_design	Chapter 8
Impact assessments as pipeline inputs	2	8, 10	—	Chapter 7
Incident classification record	2	11	incident_classification	Chapter 13
Investment and value record	2	16A	portfolio/value/*.yaml	Chapter 19
Learning path	2	14	—	Chapter 21
Legal mandate note	2	5	—	Chapter 18
Legal-basis / algorithm descriptor	2	17	—	Chapter 8
Maturity self-assessment	2	Appendix B	governance/maturity/assessment-*.yaml	Chapter 8
Minimum control baseline per mode	2	2	—	unassigned
Model approval policy	2	9	ai.governance.model_approval	Chapter 5
Model card and system card	2	4, 11	—	unassigned
Model-origin assessment record	2	6	GEO-*	Chapter 9
Model-origin policy	2	6	policies/model-origin-policy.yaml	Chapter 5
Option comparison	2	16A	—	Chapter 3
Portfolio exception record	2	16	EXC-*	Chapter 7
Portfolio use-case entry	2	16	UC-*	Chapter 12
Practice checklist	2	21	ai-practice-checklist.yaml	Chapter 3
Principle exception record	2	4	EXC-*	Chapter 7
Principle set with executable verifications	2	4	architecture/principles.yaml	Chapter 5
Principles for the use of AI (public statement)	2	4	—	unassigned
Programme plan	2	25	ProgrammePlan	unassigned
Public appraisal summary	2	16A	—	unassigned
Readiness scorecard	2	5	readiness/scorecard.yaml	Chapter 12
Regulatory position record	2	3	RegulatoryPosition	Chapter 8
Retirement record	2	21	portfolio/retirements/*.yaml	Chapter 5
Risk appetite statement	2	8	risk_appetite	Chapter 7
Risk classification policy	2	8	ai.risk.classification	Chapter 7
Risk register entry	2	8	RISK-*	Chapter 7
Risk-tiering questionnaire	2	8	—	Chapter 7
Role description (AI system owner)	2	14	—	Chapter 21
Shared-platform service agreement	2	12	agreements/ai-platform/*.yaml	Chapter 6
Spend-stop record	2	16A	SPD-*	Chapter 19
Substantial-modification rule	2	8	ai.risk.substantial_modification	Chapter 7
System-level transparency record	2	10	—	Chapter 8
Team consumption envelope	2	16A	finops/envelopes/*	Chapter 17
Transparency notice to affected persons	2	10	—	Chapter 8
Usage-mode register	2	2	usage-modes/*.yaml	Chapter 7
Use-case descriptor and policy decision	2	8	—	Chapter 12
Use-case intake record	2	5	UC-*	Chapter 12
Vendor assessment record	2	7	vendors/assessments/*.yaml	Chapter 9
Waiver record	2	9	waiver	Chapter 8
30-60-90-day plan	3	18		unassigned
Agent containment profile	3	19	agents/*/containment.yaml	Chapter 20
Agent permission manifest and tool allow-list	3	11, Appendix A	agents/*.yaml	Chapter 20
Agent routing policy	3	15	agent-routing-policy.yaml	Chapter 5
Agent skill (worked example)	3	8, 11	SKILL.md	Chapter 18
Agent skill for reviewing AI Decision Records	3	11, Appendix A	SKILL.md	Chapter 7
Agent workload-identity authorisation policy	3	17	package ai.agents.authz	Chapter 20
AGENTS.md repository configuration for coding agents	3	11	AGENTS.md	Chapter 18
AI Decision Record as structured data	3	5, Appendix A	AIDR-*	Chapter 7
AI Decision Record template (Markdown)	3	5, Appendix A	AIDR-*	Chapter 7
AI gateway route and policy configuration	3	12	gateway/routes/*.yaml	Chapter 5
AI incident runbook	3	21	RB-AI-*	Chapter 13
Alerting rules	3	21	groups:	Chapter 15
Annex A control mapping with evidence	3	9		Chapter 8
Annex IV technical documentation mapping	3	5		Chapter 4
API contract for a probabilistic service	3	12	openapi.yaml	Chapter 9
Capacity plan as code	3	13	platform/capacity/*.yaml	Chapter 17
Catalogue entry for a skill or agent	3	8	catalogue_entry	Chapter 18
CI security test workflow	3	17	ai-security-tests	Chapter 5
Classification-routed hybrid agent setup (practical guide)	3	15		Chapter 7
Cloud AI service controls	3	14	cloud-ai-service-controls.yaml	Chapter 9
Cloud versus on-premises decision matrix	3	14		Chapter 16
Complete agent configuration	3	11	agents/*/agent.yaml	Chapter 18
Component manifest for one use case	3	4		Chapter 12
Compromised dependency or model artefact response (practical guide)	3	9		Chapter 13
Containment sandbox, overreach detection and response guides	3	19		Chapter 20
Control catalogue	3	17	ControlCatalogue / CTRL-*	Chapter 8
Cost-aware model routing policy	3	22, Appendix A	policies/routing/*.yaml	Chapter 17
Data contract for an AI data product	3	6, Appendix A	contracts/*.yaml	Chapter 9
Data product descriptor	3	6	data_product	Chapter 6
Datasheet (for datasets)	3	5, 6, 20	Datasheet	Chapter 4
Decision record on model origin and hosting	3	13	AIDR-*	Chapter 4
Declarative reference architecture model	3	4	ReferenceArchitecture	Chapter 4
Delegated token claims	3	12	token claims	Chapter 20
Deny-by-default permission manifest for an IT-operations agent	3	11	agents/*/manifest.yaml	Chapter 20
Drift detection job	3	21, Appendix A	DriftDetectionJob	Chapter 12
Drift runbook	3	21	runbooks/*/drift.md	Chapter 16
Evaluation report summary	3	20		Chapter 8
Evaluation suite definition	3	20, Appendix A	evals/suites/*.yaml	Chapter 5
Evidence manifest	3	7, 8, Appendix A	evidence/*/manifest.yaml	Chapter 5
First-90-days platform and security plan	3	25	PlatformSecurityPlan	Chapter 6
Gateway security configuration	3	17	gateway	Chapter 6
Generated decision index	3	5	decisions/index.yaml	Chapter 8
Go/no-go decision record	3	23		Chapter 4
Golden dataset datasheet	3	20	Datasheet	unassigned
Golden path template manifest	3	23	golden-paths/*/template.yaml	Chapter 5
GPU capacity plan	3	22	capacity/*.yaml	Chapter 17
Guardrail policy	3	16	guardrails	Chapter 5
Hardening source-control and CI (practical guide)	3	9		Chapter 20
Human-approval policy	3	11	approvals/*.yaml	Chapter 5
LLM-as-a-judge prompt with rubric	3	20		Chapter 5
Market overlay (jurisdiction overlay)	3	4, 24	architecture/overlays/*	Chapter 4
ML-BOM for a fine-tuned model	3	16, 8	ML-BOM	Chapter 5
Mode baseline as platform policy	3	2	platform/mode-baselines.yaml	Chapter 5
Model card	3	5	model_card	Chapter 7
Model promotion pipeline with evaluation gates	3	7, 8, Appendix A	model-promotion.yml	Chapter 19
Model registry entry	3	7	registry://	Chapter 6
Model routing policy (gateway)	3	22	ModelRoutingPolicy	Chapter 5
Patch-velocity policy	3	18	patch-velocity-policy.yaml	Chapter 5
Pipeline setup and reproducible-release practical guides	3	8		Chapter 16
Placement policy	3	14	placement-policy.yaml	Chapter 5
Platform onboarding declaration	3	1	systems/*/onboarding.yaml	Chapter 6
Platform requirements catalogue	3	3	PlatformRequirementsCatalogue	Chapter 6
Platform roadmap	3	24	PlatformRoadmap	Chapter 6
Predetermined change envelope	3	7	change_envelope.yaml	Chapter 5
Production readiness checklist	3	23	readiness/checklist.yaml	Chapter 3
Promotion gate definition	3	7	gates/*.yaml	Chapter 19
Prompt injection playbook as code	3	17	PB-AI-*	Chapter 20
Prompt record	3	8	prompt_record	unassigned
Prompt section for handling untrusted content	3	16		unassigned
RAG system configuration	3	10	rag_system	Chapter 6
Red-team test plan	3	20	RT-*	Chapter 5
Reference-architecture variant derivation (practical guide)	3	4		Chapter 4
Release record	3	8	release	Chapter 16
Repository layout for an AI system	3	8		unassigned
Requirements-to-capability matrix	3	3		Chapter 4
Retention and erasure rule	3	6	policies/retention/RET-*.yaml	Chapter 6
Retrieval prompt template with grounding and abstention	3	10		Chapter 6
Review agent configuration with least privilege and approval gates	3	11, Appendix A	agents/*.yaml	Chapter 18
Risk register entry as code	3	9	HM-LOOP-*	Chapter 7
SCI calculation record	3	22	sustainability/sci/*.yaml	Chapter 12
Security review checklist for a new AI system	3	16		Chapter 3
Self-hosting readiness check	3	14	self-hosting-readiness.yaml	Chapter 6
Sovereignty decision matrix	3	13		Chapter 9
Sovereignty requirements profile	3	13	procurement/profiles/*.yaml	Chapter 9
Stage-by-stage pipeline risk assessment (practical guide)	3	9		Chapter 7
Synthetic-media-resistant approval policy	3	18		Chapter 15
System card for compound systems	3	5		Chapter 8
Telemetry collector configuration	3	21	otel collector	Chapter 15
Threat model as code	3	16, 17	ThreatModel	Chapter 10
Tool registry entry for an MCP server	3	11	tool-registry/*.yaml	Chapter 20
Training run record	3	7	training_run	Chapter 21
Use-case intake record	3	23	UC-2026-*	Chapter 12
Use-case to control-point mapping (practical guide)	3	2		Chapter 12
Versioned system prompt with metadata	3	7, 8, Appendix A	prompts/*.md	Chapter 7
Agent containment profile	4	4	platform.example.eu/v1 AgentContainmentProfile	Chapter 20
Agent credential profile	4	14	hm-sec-001-credentials	Chapter 20
Agent permission manifest (SOC investigation agent)	4	18	HM-SEC-*	Chapter 20
AI asset record (agent)	4	9	HM-SEC-001 (asset id)	Chapter 18
AI red-team campaign plan	4	13	NR-SEC--C	Chapter 11
AI-assisted threat assessment (STIX report)	4	19		Chapter 12
Autonomy-level decision record (AI Decision Record)	4	6	AIDR-*	Chapter 18
Chaos safety-boundary policy	4	25	HM-SEC-*-boundaries	Chapter 14
Containment catalogue	4	21	HM-SEC-001 (catalogue)	Chapter 20
Containment test plan (agent escape paths)	4	13	HM-SEC--CT-	Chapter 20
CSF profile as code with an AI focus	4	3	HM-CSF-*	Chapter 8
CSF profile summary of the two organisations	4	27	nordvik-region / hansa-mutual	Chapter 8
Decoy register entry	4	19	HM-DEC-*	Chapter 7
Degradation-mode definition	4	17	HM-SEC-*-degradation	Chapter 13
Delegated patch decision	4	11	DPD-*	Chapter 12
Detection rule with test cases (Sigma)	4	19		Chapter 12
Emulation finding record	4	12	FND-*	Chapter 11
Emulation plan (ATT&CK-mapped)	4	12	HM-TLPT-*	Chapter 11
Finding record carried to verified closure	4	26	FND-*	Chapter 12
First-90-days programme plan	4	28	AI-DEFENCE-FIRST-90	Chapter 8
Grounded triage record	4	18	NR-SEC-001/triage/*	Chapter 12
Guardrail policy	4	16	NR-SEC-*-guardrails	Chapter 5
Impact query (parameterised SQL)	4	20	IQ-CTA-*	Chapter 13
Incident record with AI classification step	4	20, 21	HM-INC-*	Chapter 13
Patch-velocity service-level policy	4	11	HM-PATCH-SLO-*	Chapter 5
Practical-guide structure (purpose, defaults, definition of done)	4	2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26		unassigned
Prepared recovery message record	4	24	HM-COMMS-RC-*	Chapter 13
Programme charter for AI-enabled defence	4	1	NR-SEC-PROG-*	Chapter 8
Purple session plan	4	26	PS-*	Chapter 14
Recoverability test definition (restore drill)	4	24	NR-SEC--RD-	Chapter 13
Recovery plan as code	4	22	RP-*	Chapter 13
Reporting-clock configuration	4	21	INC-HM-*	Chapter 8
Resilience exercise design record	4	15	NR-AWR-*	Chapter 14
Return-to-service checklist for an AI system	4	23	RTS-*	Chapter 3
Return-to-service evidence record	4	22	RTS-*	Chapter 5
Risk-appetite statement / supplier / etc. templates listed as planned in Appendix B	4	B	various	Chapter 9
Risk-appetite statement as code	4	5	HM-RAS-*	Chapter 7
Rules-of-engagement manifest	4	7, 12, 13, 15, 25, 26	RoE-*	Chapter 11
Secure-configuration baseline policy (Rego)	4	16	secai_baseline	Chapter 5
Security AI evaluation (golden-dataset evaluation)	4	26	EVAL-*	Chapter 19
Security chaos experiment manifest	4	25	SCE-*	Chapter 14
Supplier assurance requirements for security AI	4	8	NR-SUP-*	Chapter 9
Synthetic-media-resistant approval policy	4	14	hm-approvals-synthetic-media	Chapter 15
Threat model (threat-model.yaml)	4	10		Chapter 10
Threat profile entry (AI-enabled threat, evidence-labelled)	4	2	HM-TP-*	Chapter 5
Usage-mode and autonomy-level scales	4	6	Mode 0-5; Level 0-4	Chapter 18
Agent incident timeline record	5	25	TL-*	Chapter 13
AI Decision Record	5	7, 10, 11, 13, 14, 16, 20, 32	AIDR-*	Chapter 7
AI policy for a school or graduate programme	5	7	AIDR-*	Chapter 5
AI threat register	5	4, 32, Appendix A	THR-*	Chapter 23
Calibration log	5	32		Chapter 13
Callback-verification policy for approvals	5	20	CVP-*	Chapter 5
Capability snapshot	5	5	CAPS-*	Chapter 23
Claim card	5	3	CC-*	Chapter 7
Content-provenance policy	5	10	CPP-*	Chapter 5
Control-to-threat coverage matrix	5	30	CCM-; CTRL-	Chapter 14
Crux map	5	4	CRX-*	Chapter 7
Delegation register entry with reversibility test	5	26	DEL-; RVT-	Chapter 18
Dependency map with exit references	5	15	DEP-*	Chapter 23
Disparate-impact test configuration	5	12	DIT-*	Chapter 22
Exit plan	5	15, 30	EXIT-*	Chapter 9
Graded evidence record	5	4, Appendix A	EVD-*	Chapter 5
Harm-path review of an automated decision system	5	11	HPR-*	Chapter 23
Household and classroom agreement on AI use	5	31	LIB-*	unassigned
Instrument mapping of register entries	5	28	IMAP-*	Chapter 7
Layered evaluation plan with monitoring and decoys	5	23	EVP-*	Chapter 23
Library AI literacy programme	5	31	LIB-*	unassigned
Model-routing and carbon policy	5	17	RP-*	Chapter 17
One-page board briefing	5	32	THR-*	Chapter 13
Oversight-quality metric	5	14	OQM-*	Chapter 8
Positive-scenario entry	5	34	POS-*	Chapter 13
Procurement clause for catastrophic-misuse safeguards	5	19	HM-PROC-*	Chapter 23
Procurement clause on training-data transparency and opt-out compliance	5	16	PC-*	Chapter 21
Prohibited-practice check	5	13	PPC-*	Chapter 3
Safeguarding policy for an assistant	5	9	SG-*	Chapter 5
Schema of an AI threat register entry	5	32, Appendix A	THR-*	Chapter 23
Stop-path test record	5	24	SPT-*	Chapter 19
Supplier evidence request from a safety framework	5	29	SER-*	Chapter 9
Supplier-exposure record	5	21	SXR-*	Chapter 9
Sycophancy evaluation configuration	5	8	EVAL-*	Chapter 23
Team working agreement for AI use	5	6	WA-*	Chapter 23
Terms of reference for an AI threat assessment	5	1, Appendix A	ATA-*	Chapter 18
Threat register entry (AI-accelerated exploitation)	5	18	THR-NR-*	Chapter 23
Threat register entry (reward hacking)	5	22	THR-HM-*	Chapter 23
Threat register entry (systemic loss of control)	5	27	THR-HM-*	Chapter 23
Threat register snapshot with triggers	5	35	THR-BOOK-; TRG-	Chapter 23
Threat statement	5	33	ATA-*	Chapter 13
Trope catalogue	5	2, Appendix A	T1-T10	Chapter 23
24-month plan	6	26	PLAN-*	Chapter 8
Agent identity record	6	8	HM-EVC-001 (identity: ...)	Chapter 20
AI Decision Record (AIDR) for the commission	6	1, 3, 5, 13, throughout	AIDR-05xx	Chapter 7
Anti-pattern record	6	24	AP-*	Chapter 3
Appendix B artefact index (templates by activity)	6	B	none	unassigned
Apprenticeship plan	6	15	AIDR-0562 (plan)	Chapter 21
Call-back rule	6	8, 25, 26	CBR-*	Chapter 20
Chaos experiment record	6	11, 25, 26	SCE-*	Chapter 14
Competence framework	6	21, A	SA-CF	Chapter 21
Competence record	6	21, 4, 15, 22	CMP-*	Chapter 21
Containment profile	6	7, A	CP-*	Chapter 20
Control catalogue (first ten entries)	6	9	catalogue: nordvik-controls	Chapter 8
Control catalogue entry	6	9, A	CTRL-*	Chapter 8
Craft-keeping programme and no-AI exercise calendar	6	15	CKP-*	Chapter 21
Decision tier policy	6	17	security-architecture-decision-tiers	Chapter 5
Decision-rights RACI as code	6	16	roles/decision-rights.yaml	Chapter 5
Delegated patch playbook decision	6	10	HM-PATCH-SLO-*, AIDR-0554	Chapter 12
Delegation register and reversibility test	6	11, 15, 23, 27	(delegation register)	Chapter 18
Evidence manifest	6	9, 19	(evidence fields)	Chapter 5
Exception gate rule	6	17	package gates.exceptions	Chapter 7
Exception record	6	17, 25	EXC-*	Chapter 7
Exit plan	6	20	EXIT-*	Chapter 9
First-90-days plan	6	27	PLAN-HM-SA-PL-90	Chapter 4
Hiring profile and interview exercise	6	22	HP-, IX-	Chapter 21
Horizon register	6	23	HZN-*	Chapter 23
Learning path	6	22	LP-*	Chapter 21
Managed security service provider annex	6	10	MS-*	Chapter 12
Management report	6	19	MGT-*	Chapter 8
Mandate manifest	6	12, 13, A	MND-*	Chapter 18
Market overlay	6	20	overlays/markets/*.yaml	Chapter 8
Permission manifest	6	3, 7, 8, 9	(per agent)	Chapter 20
Practice audit record	6	2	PA-*	Chapter 8
Procurement security requirements annex	6	20	SECREQ-*	Chapter 9
Prompt and skill record / AI use log	6	12	(work log, session record)	unassigned
Recoverability requirements annex	6	11	NR-REQ-HOST-*	Chapter 13
Recovery definition	6	11, 25, 26	RCV-*	Chapter 13
Rego zone-crossing rule	6	5	package architecture.zones	Chapter 5
Regulatory mapping	6	18	MAP-*	Chapter 8
Review checklist	6	14	(checklist)	Chapter 3
Review protocol by risk tier	6	14	protocol: architecture-review	Chapter 7
Review record	6	14, A	REV-*	Chapter 3
Role charter	6	4, A	ROLE-*	Chapter 21
Shift assessment	6	3	assessments/shift-assessment-*.yaml	Chapter 5
Structurizr workspace with trust-zone properties	6	5	(model as code)	Chapter 4
Tender annex for a supplier boundary	6	7	TA-*	Chapter 9
Threat model as code	6	6	kind: ThreatModel	Chapter 10
Threat-model pipeline gate	6	6	package threatmodel.gate	Chapter 5
Timed stop drill record	6	10, A	STOP-*	Chapter 19
Year timeline	6	25	timeline: NR-SA-*	Chapter 4
24-month plan for governing the AI boss	7	32, B.22	management/plans/ai-in-management-2027-2029.yaml	Chapter 22
AI Act control set	7	21	management/ai-act-controls.yaml	Chapter 8
AI Decision Record (AIDR)	7	1, 4, 7, 21, 22, 23	AIDR-0600 to AIDR-0699	Chapter 7
Anti-pattern checklist	7	31, B.21	management/anti-pattern-checklist.yaml	Chapter 3
Autonomy and fairness survey plan	7	11	SVY-NR-STV-01	Chapter 22
Chain record	7	17	CHN-HM-CLM-01	Chapter 22
Co-determination checklist	7	23, B.12		Chapter 22
Competence record for a manager	7	19	CMP-NR-MGR-01	Chapter 21
Contestation and appeal form	7	27, B.7		Chapter 22
Contestation record	7	27, B.8	CNT-NR-, CNT-HM-	Chapter 22
Data protection impact assessment extract	7	22	DPIA-2026-031	Chapter 7
Decision-rights file	7	20, B.17	DRF-NR-01, DRF-HM-01	Chapter 22
Delegation profile	7	4, 9, 7, 11, 25, B.2	DLG-*	Chapter 18
Delegation register of management functions	7	4, 25, 32, B.3	management/delegation-register.yaml	Chapter 18
Development conversation guide (development without a score)	7	19, B.19		Chapter 22
Disparate-impact test record	7	12, 24	DIT-HM-CTA-01, DIT-NR-ROS-*	Chapter 22
Evaluation plan	7	15	EVP-NR-ROS-2027-01, EVP-HM-AB-2027-01	unassigned
Explanation template	7	27, B.9		Chapter 8
First 90 days plan	7	33	plans/ai-boss/first-90-days.yaml	Chapter 22
Fundamental rights impact assessment extract	7	21, 22, B.14	FRIA-2026-007	Chapter 7
Management Decision Record (MDR)	7	25, 9, B.4	MDR-NR-, MDR-HM-	Chapter 22
Management Decision Record schema	7	25, A	MDR schema	Chapter 22
Management function map	7	1, 2, B.1	management/function-map.yaml	Chapter 5
Manager's weekly review protocol	7	29, 16, B.18		Chapter 22
Mandate manifest for agents a manager directs	7	16, B.16	MND-HM-CLM-*	Chapter 18
Measure lineage record	7	3	AIDR-0624	Chapter 7
Office feature register	7	10	management/office-feature-register.yaml	Chapter 7
One-page board report on algorithmic management	7	32, B.20		Chapter 22
Oversight record	7	26, 30, B.5	OVR-*	Chapter 8
Oversight-quality metrics	7	26, B.6	OQM-NR-ROS-01, OQM-HM-CLM-01	Chapter 8
Pause record for a screening model	7	7	AIDR-0601	Chapter 7
Platform Work Directive benchmark	7	5	PWD-BENCH-NR-SW-01	Chapter 19
Procurement requirement set for management functions	7	24, B.15	NR-PRQ-MGT-01	Chapter 9
Reversibility test	7	25, 19, 7	RVT-HM-CTA-2027-01, RVT-NR-ROS-*	Chapter 5
Role charter for a line manager	7	29	ROLE-HM-MGR-01, ROLE-NR-MGR-01	Chapter 21
Team charter for a mixed team	7	18	TCH-HM-CLM-01	Chapter 18
Ten questions for governing the AI boss	7	33		Chapter 22
Transparency register	7	28, B.11	management/transparency-register.yaml	Chapter 8
Work-environment risk assessment	7	6, 14	WRA-NR-HC-01	Chapter 7
Worker information notice	7	28, B.10	WIN-NR-SW-HC-01, WIN-HM-CTA-DE	Chapter 8
Works agreement annex of change classes	7	13, 23, B.13	KBV-IT-2024 annex	Chapter 22
Works agreement clause set for algorithmic management	7	23, B.13		Chapter 22
Analyst AI-use log (AI use record)	8	12	AI-use log	Chapter 12
Analyst AI-use policy	8	12, B.10	team/ai-use-policy.yaml	Chapter 5
Anti-pattern record and checklist	8	25, B.23	AP-*	Chapter 3
Apprenticeship record	8	23	APP-*	Chapter 21
Blue team function inventory / function map	8	2, B.1	team/function-map.yaml	Chapter 7
Board page for the blue team	8	20, B.18	reporting/blue-team-page.yaml	Chapter 14
Case record	8	8, B.6	CASE-*	Chapter 12
Closure policy	8	7, B.5	CLOSE-*	Chapter 5
Competence conditions on autonomy	8	22	competence/conditions.yaml	Chapter 21
Competence framework SOC-CF	8	22	SOC-CF	Chapter 21
Competence record	8	22, B.20	CMP-*	Chapter 21
Containment profile	8	13, 15	CP-*	Chapter 20
Craft programme and craft register	8	23, B.21	craft register	Chapter 21
Decision-rights table	8	18, B.16	DRF-*	Chapter 20
Delegation profile	8	4, B.2	DLG-*	Chapter 18
Delegation register for the blue team	8	4, B.3	DLG-*	Chapter 18
Detection record	8	6, B.4	DET-*	Chapter 12
Evidence manifest	8	27, 28	EVD-*	Chapter 5
Fatigue and on-call review	8	21, B.19	review	Chapter 13
Final test	8	28	reviews/final-test-2027.yaml	Chapter 5
Finding register	8	11, 15, 25	FND-*	Chapter 7
First inventory of AI in the team	8	1	inventory	Chapter 7
Horizon register	8	24, B.22	HZN-*	Chapter 23
Horizon statement	8	28	HZN-BT-AUTHOR-2036	Chapter 23
Hunt record	8	9, B.7	HNT-*	Chapter 12
Incident clock (reporting-clock profile)	8	19, 26, B.17	CLK-*	Chapter 13
Intelligence record	8	5	INTEL-*	Chapter 12
Mandate manifest for a SOC agent	8	13, B.11	MND-*	Chapter 18
Ninety-day plan	8	28	plan	unassigned
One-page acceptable-use sheet for analysts	8	12, 23	AUS-*	Chapter 12
Permission manifest	8	13, 15	permission manifest	Chapter 20
Playbook manifest	8	10, B.8	PBK-*	Chapter 12
Post-incident review	8	11, B.9	PIR-*	Chapter 13
Pre-production checklist for SOC AI	8	15, B.13	checklist	Chapter 12
Pressure register	8	3	PRS-*	Chapter 7
Provider annex for AI visibility	8	16, B.14	MS-2	Chapter 9
Review protocol and oversight report	8	14, 20, 21, B.12	OQM-*	Chapter 8
Role charter	8	17, B.15	ROLE-*	Chapter 21
Role map	8	17	roles map	unassigned
Team charter	8	4, B.2	team/charter.yaml	Chapter 18
Two-year plan	8	27, B.24	PLAN-*	unassigned
Weekly intelligence-to-detection routine	8	5	intel/routine.yaml	Chapter 12
Works agreement clause for SOC tooling	8	21	KBV-*	Chapter 12
Year-in-review register	8	26	year-in-review register	Chapter 7
AI Decision Record for the loop (audit committee / executive board questions)	9	1, 19, 28	AIDR-08xx	Chapter 8
Annual loop calendar	9	27		Chapter 12
Anti-pattern checklist	9	26, B.26		Chapter 3
Anti-pattern record	9	26, B.26	AP-*	Chapter 3
Board decisions for the management body / AIDR-0849, AIDR-0899	9	28	AIDR-0849, AIDR-0899	Chapter 7
Board page for the loop	9	18, B.18	LPG-*	Chapter 8
Change record	9	10, B.9	CHG-*	Chapter 16
Change-routing table	9	10, B.9		Chapter 18
Competence record	9	24, B.24	CMP-*	Chapter 21
Consent and notice protocol	9	22	CNP-*	Chapter 22
Continuous emulation pipeline definition	9	8, B.6	HM-SEC-004 pipeline	Chapter 11
Continuous emulation schedule and variation policy	9	8, B.6		Chapter 11
Coverage page	9	17, 18	(PRI-NR-2028-01)	Chapter 14
Coverage record	9	17, B.17	COV-*	Chapter 14
Coverage-status rule file	9	17		Chapter 14
CSF profile kept as code	9	17, 3		Chapter 14
Decay estimate	9	3	DCY-*	Chapter 12
Decision-rights file	9	20, B.20	DRF-*	Chapter 20
Delegation profile for the loop (Nordvik)	9	14	DLG-NR-EMU-*	Chapter 18
Detection checklist for AI systems and agents	9	12, B.12		Chapter 12
Detection record for AI agents	9	12, B.12	DET-*	Chapter 12
Emulation plan	9	7, 8, 13, B.5	EMU-*	Chapter 11
Evidence manifest	9	11, 16, B.11	EVD-*	Chapter 5
Exercise decision-rights table	9	20, B.20	DRF-*	Chapter 14
Exercise-information notice	9	23	EIN-*	Chapter 14
Expectation sheet	9	9		Chapter 12
Finding record	9	9, 10, 13, B.8	FND-*	unassigned
Findings policy	9	16, B.16	POL--FND-	Chapter 5
Horizon register	9	25, B.25	HZN-*	Chapter 23
Independence checklist	9	15, B.15		Chapter 19
Independence checklist for supervisors and boards	9	15		Chapter 19
Independence statement	9	15, B.15	IND-*	Chapter 19
Injected-test schedule	9	13, 22, B.13	(annex MS-2)	Chapter 5
Inventory of AI in testing and in detection	9	1, B.1	AIINV-*	Chapter 12
Joint scorecard	9	23	SCR-*	unassigned
Learning path	9	24	LP-*	Chapter 21
Loop charter	9	4, B.2	LOOP-*	Chapter 18
Loop delegation profile	9	4, 14, B.2	DLG-*	Chapter 18
Mandate manifest (series)	9	6, 14	MND-*	Chapter 18
Mandate manifest for emulation agent	9	14, B.14	MND--EMU-	Chapter 18
Measure catalogue	9	18	MSC-LOOP-*	Chapter 7
Obligation register	9	21, B.21	OBL-*	Chapter 8
Operating-model decision	9	19	AIDR-0820	Chapter 8
Outcome table	9	9, B.8		Chapter 12
Priority list	9	5, 17	PRI-*	Chapter 10
Provider annex amendment (independence)	9	15, 22, B.22	MS-2-IND-*	Chapter 19
Provider annex clause on testing	9	22, B.22	MS-2-TST-*	Chapter 5
Purple loop inventory	9	4, B.1		Chapter 14
Purple session charter	9	23, B.23	PSC-*	Chapter 14
Purple session record	9	9, B.7	PRP-*	Chapter 14
Regression case	9	11, B.10	REG-*	Chapter 14
Risk acceptance with expiry	9	20, 10	(FND-*, risk accepted)	Chapter 7
Role charter	9	19, B.19	ROLE-*	Chapter 21
Rules-of-engagement manifest	9	6, B.4	RoE-*	Chapter 11
Safety-class table	9	6	SCT-*	Chapter 20
Scenario record	9	5, B.3	SCN-*	unassigned
Sector information-sharing protocol	9	22	SHP-*	Chapter 14
Seeded-gap record	9	15, B.15	SGP-*	Chapter 19
Seeded-incident register	9	13, B.13	(EMU-HM-2028-03)	Chapter 19
Seeded-incident test plan	9	13, B.13		Chapter 19
Tabletop record	9	20, B.20	TTX-*	Chapter 3
Testing authorisation and legal-basis checklist	9	21, B.21		Chapter 20
Testing-forms register	9	2	TFR-*	Chapter 7
Tier-0 checklist for the findings register and emulation agents	9	16, B.16		Chapter 20
Two-year plan	9	28, B.27		Chapter 7
Verification status behind a board page	9	11	BTP-*	Chapter 8
Action closure rule	10	12, Appendix A.8		Chapter 7
Agent permission manifest and refusals	10	18, Appendix A.14		Chapter 20
AI Decision Record	10	1, 30	AIDR-0900 to AIDR-0999	Chapter 7
AI incident record with clock sheet	10	14, Appendix A.10	INC-*	Chapter 13
Alert-correlation evaluation record	10	6, Appendix A.2	EVL-*	Chapter 15
Alert-correlation policy	10	6, Appendix A.2, Appendix B.4	ACP-*	Chapter 15
Anti-pattern record	10	28	AP-*	Chapter 3
Autonomy-budget review checklist	10	4, Appendix B.18		Chapter 18
Board paper outline	10	30		Chapter 5
Capacity record	10	11, Appendix A.7	CAP-*	Chapter 17
Change class and change record	10	8, 13, Appendix A.4, Appendix B.6	CHG-*	Chapter 16
Change gate policy	10	8, Appendix A.4		Chapter 5
Clock sheet	10	14, Appendix A.10		Chapter 13
Competence framework OPS-CF	10	26	OPS-CF	Chapter 21
Competence record	10	26, Appendix A.20, Appendix B.17	CMP-*	Chapter 21
Cost-and-latency budget	10	15, Appendix A.11	CAP-*	Chapter 17
Dark-day record	10	26, 29	DKD-*	Chapter 14
Decision-rights file with checker	10	22, Appendix A.18	DLG-*	Chapter 18
Delegation profile	10	4, 22, Appendix A.18, Appendix B.2	DLG-*	Chapter 18
Drill-year plan	10	26, Appendix A.20	PLAN-*	Chapter 19
Eleven action classes and ceilings	10	4		Chapter 18
Exit-test record	10	24	RST-*	Chapter 5
First-ten-actions remediation catalogue	10	10		Chapter 16
Freeze calendar	10	9	FRZ-*	Chapter 16
Golden incident set	10	6	GLD-*	Chapter 13
Horizon register	10	27	HZN-*	Chapter 23
Incident record	10	7, Appendix A.3, Appendix B.5	INC-*	Chapter 13
Mandate manifest for an operations agent	10	1, 16, 18, Appendix A.12, Appendix B.9	MND-*	Chapter 18
Mandate policy decision point rule	10	16, Appendix A.12		Chapter 18
Metric definition catalogue	10	20, Appendix A.16	MET-*	Chapter 15
Model-change record	10	13, Appendix A.9	CHG-*	Chapter 16
Observer manifest	10	4, 17, Appendix A.13, Appendix B.11	OBS-*	Chapter 19
Observer review checklist	10	17, Appendix B.19		Chapter 19
On-call charter	10	25, Appendix A.19, Appendix B.16	ONC-*	Chapter 21
Operations annex to a managed-service contract	10	21, 24	OPA-*	Chapter 9
Operations charter	10	31	CHR-*	Chapter 13
Operations mandate summary	10	1	MND-*	Chapter 18
Post-incident review	10	12, Appendix A.8, Appendix B.8	PIR-*	Chapter 13
Problem record	10	12, Appendix A.8, Appendix B.8	PRB-*	Chapter 7
Progressive-delivery policy	10	9, Appendix A.5	ROL-*	Chapter 16
Promotion and demotion policy	10	16, Appendix A.12, Appendix B.10	PRM-*	Chapter 19
Quality, restraint and freshness objectives for an AI service	10	13, Appendix A.9	SLO-*	Chapter 15
Quarterly resilience register review checklist	10	19, Appendix B.20		Chapter 13
Reconciler sync policy	10	8, Appendix A.21, Appendix B.6		Chapter 5
Register-of-information entry	10	24		Chapter 7
Regulation-to-control mapping record	10	23	RCM-*	Chapter 8
Resilience register	10	4, 19, 29, Appendix A.15, Appendix B.14, Appendix B.20		Chapter 13
Restore-test record and resilience register row	10	19, 24, Appendix A.15, Appendix B.14	RST-*	Chapter 13
Role charter for the operations conductor	10	21, Appendix A.17, Appendix B.15	ROLE-*	Chapter 21
Rollout with independent analysis template	10	9, Appendix A.22		Chapter 19
Runbook manifest	10	10, Appendix A.6, Appendix B.7	RBK-*	Chapter 16
Seeded-fault record	10	17, Appendix A.13, Appendix B.12	SDF-*	Chapter 19
Service level objective record	10	5, 13, Appendix A.1, Appendix B.3	SLO-*	Chapter 15
Service record with dependencies and blast radius	10	3, Appendix B.1	SVC-*	Chapter 15
Stop drill record	10	4, 10, 14, 16, 17, 20, 22, 26, 29, 31	STOP-*	Chapter 19
Sync-policy review checklist	10	8, Appendix B.21		Chapter 5
Ticket-era and code-era change record comparison	10	2	CHG-*	Chapter 16
Tier-0 checklist for the operator's AI	10	18, Appendix B.13		Chapter 20
Twelve-month operations plan	10	30	OPL-*	Chapter 5
Year ledger	10	29		Chapter 7

Own tools

Tool	Book	Chapters	Identifier	Treated in
Architecture as Code Maturity Radar Tool	1	D, Maturity model		Chapter 8
Claude Code workflow (claude.yml)	1	20		Chapter 5
Issue to draft PR workflow (assign-codex2.yml)	1	20		Chapter 5
Mermaid Designer Bot (mermaid-designer-bot.yml)	1	20		Chapter 4
scripts/adr_impact_analysis.py	1	repo		Chapter 4
scripts/adr_metrics.py	1	repo		Chapter 15
scripts/check_structurizr_manifest.py and update_structurizr_manifest.py	1	6		Chapter 4
scripts/generate_adr_catalogue.py	1	repo		Chapter 4
scripts/new_adr.sh	1	repo		Chapter 4
scripts/render_structurizr_diagrams.sh	1	6, B		Chapter 4
scripts/validate_adrs.py	1	4, repo		Chapter 4
structurizr-diagrams.yml workflow	1	B		Chapter 5
validate_artefacts.py	9	4, 11, 17, A		Chapter 18

Third-party tools and standards

Tool	Book	Chapters	Identifier	Treated in
adr-tools and adr-log	1	4		Chapter 4
Ansible	1	5, 9		unassigned
Argo CD	1	7		Chapter 16
AsyncAPI / OpenAPI	1	8		Chapter 9
AWS Application Discovery Service, Azure Migrate	1	16		Chapter 7
AWS CDK	1	3, 5, 13, 14		Chapter 6
AWS CloudFormation	1	14, 16, A		Chapter 6
AWS Step Functions, Azure Logic Apps, Temporal	1	9c, 20		Chapter 12
Azure Pipelines / Azure DevOps	1	5, 13		Chapter 5
Backstage	1	21		Chapter 6
Bicep	1	3		Chapter 6
C4 model	1	6, 8, 22		Chapter 4
CALM (FINOS Common Architecture Language Model)	1	1, 2, 6, 22, B, C		Chapter 4
Chaos Monkey	1	13		Chapter 14
Checkov	1	5, 13, 16, 21, A		Chapter 5
Conftest	1	2, 5, 8, 21		Chapter 5
Crossplane	1	7		Chapter 6
CycloneDX and SPDX	1	15a		Chapter 5
Docker and Docker Compose	1	6, 7, 31		Chapter 6
Docusaurus, Sphinx, Jekyll	1	22		Chapter 4
Draw.io / Lucidchart	1	6		Chapter 4
FinOps Framework	1	15, 24, 25, 26b		Chapter 17
Flux	1	7		Chapter 16
GitHub Actions	1	5, 6, 11, 13, 14, 15a, 19, 20, B, A		Chapter 5
GitLab CI	1	5, 6		Chapter 5
Green Software Foundation Carbon Aware SDK and Software Carbon Intensity	1	25, 26b		Chapter 17
Gremlin, Chaos Mesh	1	8		Chapter 14
HashiCorp Sentinel	1	9, 9c, 10, 11		Chapter 5
HashiCorp Vault and cloud secret managers (AWS Secrets Manager)	1	9		Chapter 20
HCP Terraform / Terraform Cloud	1	4, 9b, 15, 21		Chapter 6
Helm	1	7, 8		Chapter 6
in-toto	1	15a		Chapter 5
Infracost	1	5		Chapter 17
Istio	1	7, 8		Chapter 16
Jenkins	1	5, 13, A		Chapter 5
jq	1	5, 15a, 16		Chapter 5
Kafka, PostgreSQL	1	4		Chapter 4
kubeconform / kubeval	1	7		Chapter 5
Kubernetes	1	5, 7, 9, 10, 13, 15, 18, A		Chapter 6
Kyverno	1	7, 13		Chapter 5
Linkerd, Cilium	1	7, 8		Chapter 6
Mermaid and Mermaid CLI	1	2, 6, 9c, 20, 22, B, D		Chapter 4
Microsoft Threat Modeling Tool (STRIDE)	1	9, 9c		Chapter 10
MITRE ATT&CK	1	9b		Chapter 10
MkDocs	1	2, 22, B		Chapter 4
NIST Secure Software Development Framework (SSDF)	1	15a		Chapter 8
NIST SP 800-30 risk assessment	1	9c		Chapter 8
NIST SP 800-53, ISO/IEC 27001, SOC 2 (control frameworks)	1	9, 10, 11, 12, 15a, D		Chapter 12
Obsidian with Git synchronisation	1	23		Chapter 4
OPA Gatekeeper	1	7, 10, 13		Chapter 5
Open Policy Agent (OPA) and Rego	1	2, 5, 7, 8, 9, 9b, 10, 11, 13, 15a, 22, 26b, A		Chapter 5
OpenCost / Kubecost	1	15		Chapter 17
OpenGitOps principles	1	7, 25		Chapter 16
OpenTofu	1	4, 14, 27		Chapter 6
OSCAL (Open Security Controls Assessment Language)	1	10, A		Chapter 8
Pact	1	25		Chapter 9
Pandoc, XeLaTeX and the Eisvogel template	1	B, 29		unassigned
PlantUML	1	6, 22		Chapter 4
Pluralsight, KodeKloud	1	18		Chapter 21
Prometheus, Grafana, CloudWatch, Azure Monitor	1	5, 8, 9c, 15, A		Chapter 15
Pulumi	1	13, 14		Chapter 6
pytest	1	5, 13		Chapter 6
Sigstore Cosign	1	15a		Chapter 5
Slack / Microsoft Teams	1	20		Chapter 18
SLSA	1	15a		Chapter 5
Software Bill of Materials (NTIA minimum elements)	1	15a		Chapter 5
STIX and TAXII	1	9b, 9c		Chapter 12
Structurizr (DSL, local, export)	1	2, 6, 22, 24, B		Chapter 4
Syft	1	15a		Chapter 5
Terraform	1	2, 3, 4, 5, 7, 8, 9, 9b, 10, 11, 13, 14, 15, 16, 18, 21, 23, A, D		Chapter 6
terraform-compliance	1	5, 13		Chapter 8
Terratest	1	5, 11, 13, 14, A		Chapter 5
TFLint	1	5		Chapter 5
tfsec	1	5, 21		Chapter 5
Trivy	1	5, 16, 21, A		Chapter 5
Vitest	1	13, A		Chapter 5
AI gateway and model registry	2	6, 9		Chapter 6
ALTAI (Assessment List for Trustworthy AI)	2	5, 8, 10		Chapter 7
CycloneDX ML-BOM	2	6, 18, 27		Chapter 5
Datasheets for datasets	2	4		Chapter 4
FinOps framework and FinOps for AI	2	16A		Chapter 17
Git repository and pull-request review	2	9, 16, 29		Chapter 8
ISO/IEC 23894	2	8		Chapter 8
ISO/IEC 42001	2	9, 12, 13		Chapter 8
ISO/IEC 42005	2	8		Chapter 8
Mermaid	2	Appendix C		Chapter 4
MITRE ATLAS	2	21		Chapter 10
Model cards	2	4, 11		Chapter 8
NIST AI RMF 1.0 and Generative AI Profile	2	8, 21		Chapter 8
Open Policy Agent / Rego	2	8, 9		Chapter 5
Open Source AI Definition	2	6, 7		Chapter 6
OpenTelemetry (GenAI semantic conventions)	2	11, 21		Chapter 15
OWASP Top 10 for Agentic Applications	2	16A		Chapter 10
OWASP Top 10 for LLM Applications	2	2, 10, 16A, 21		Chapter 10
SLSA and Sigstore	2	11, 21		Chapter 5
Software Carbon Intensity specification	2	Appendix B		Chapter 17
UNESCO Readiness Assessment Methodology and Ethical Impact Assessment	2	5, 10, Appendix C		Chapter 7
Agent Skills (SKILL.md)	3	8, 11		Chapter 20
AGENTS.md	3	11		Chapter 18
Aider	3	15		Chapter 18
C4 model	3	4		Chapter 4
CISA Known Exploited Vulnerabilities catalogue	3	9, 18		Chapter 12
Claude Code, GitHub Copilot, Cursor	3	2, 9		Chapter 3
Cline	3	15		Chapter 18
Codex CLI	3	15		Chapter 18
Continue	3	15		Chapter 18
Crush	3	15		Chapter 18
CVSS	3	9		Chapter 12
CycloneDX ML-BOM	3	8, 16, 17		Chapter 5
DVC	3	8		Chapter 6
EPSS	3	18		Chapter 12
Gaia-X	3	4, 13		Chapter 9
GitHub Actions	3	9, Appendix A		Chapter 5
gitsign	3	8		Chapter 5
Goose	3	15		Chapter 18
HELM	3	20		Chapter 6
Hugging Face	3	9, 14, 19		Chapter 6
ISO/IEC 42001 and ISO/IEC 27001	3	8, 9, 17		Chapter 8
Kubeflow Pipelines	3	7		Chapter 5
Kubernetes	3	7, 13		Chapter 6
lakeFS	3	8		Chapter 6
LiteLLM	3	15		Chapter 6
llama.cpp	3	15		Chapter 6
LM Studio	3	15		Chapter 6
Mermaid	3			Chapter 4
MITRE ATLAS	3	3, 9, 16, 17		Chapter 10
MITRE ATT&CK	3	16		Chapter 10
MkDocs	3			Chapter 5
MLflow	3	7, 8, 9		Chapter 6
Model Context Protocol (MCP)	3	11, 12, 15, 16		Chapter 20
Ollama	3	9, 14, 15		Chapter 12
Open Policy Agent and Rego	3	4, 8, 11, 17		Chapter 5
OpenAPI	3	12		Chapter 9
OpenCode	3	2, 15		Chapter 18
OpenSSF Model Signing (OMS)	3	8, 9		Chapter 5
OpenTelemetry (GenAI semantic conventions)	3	21, 11, 12		Chapter 15
OWASP Top 10 for Agentic Applications	3	16, 17		Chapter 10
OWASP Top 10 for LLM Applications	3	16, 17		Chapter 10
Pandoc	3			Chapter 5
Rekor	3	8, 9		Chapter 8
safetensors	3	14, 16		unassigned
Sigstore	3	8, 9, 16, 17		Chapter 5
SLSA	3	8, 9, 16, 17		Chapter 5
Software Carbon Intensity specification	3	22		Chapter 17
SPIFFE	3	17		Chapter 20
Structurizr	3	4		Chapter 4
Terraform	3	8, 13		Chapter 6
Triton Inference Server	3	9		Chapter 12
Trivy	3	9		Chapter 5
vLLM	3	9, 14, 15		Chapter 6
Big Sleep	4	11		Chapter 12
Chaos Monkey	4	25		Chapter 14
CISA Known Exploited Vulnerabilities catalogue	4	5, 11		Chapter 12
EPSS	4	5, 11		Chapter 12
European Vulnerability Database (EUVD)	4	5, 11		Chapter 12
ISO/IEC 27001	4	1, 3, 9		Chapter 8
Mermaid CLI	4			Chapter 4
MITRE ATLAS	4	2, 4, 7, 8, 9, 10, 11, 12, 13, 16, 18, 19, 20, 25, 26		Chapter 10
MITRE ATT&CK	4	1, 2, 4, 7, 8, 9, 10, 12, 14, 15, 17, 18, 19, 20, 25, 26		Chapter 10
MITRE D3FEND	4	4, 10, 19, 21		Chapter 10
MkDocs	4			Chapter 4
Model Context Protocol (MCP)	4	9, 2		Chapter 20
NIST Cyber AI Profile (IR 8596 preliminary draft)	4	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26		Chapter 8
NIST Cybersecurity Framework 2.0	4	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28		Chapter 8
OWASP Top 10 for Agentic Applications for 2026	4	10, 13, 14		Chapter 10
OWASP Top 10 for Large Language Model Applications	4	4, 6, 7, 8, 9, 10, 11, 13, 14, 16, 17, 18, 21, 23		Chapter 10
Pandoc with XeLaTeX (Eisvogel template)	4			unassigned
Principles of Chaos Engineering	4	25		Chapter 14
purple-align	4	26		Chapter 14
Rego	4	3, 16		Chapter 5
Sigma	4	19, 26		Chapter 12
SPIFFE	4	14, 18		Chapter 20
SSVC	4	11		Chapter 12
STIX 2.1 and TAXII 2.1	4	10, 19		Chapter 12
STRIDE	4	10		Chapter 10
Threat Modeling Manifesto	4	10		Chapter 10
TIBER-EU	4	1, 2, 6, 7, 12, 25, 26, 27		Chapter 11
Anthropic Responsible Scaling Policy	5	19, 29		Chapter 5
Coalition for Content Provenance and Authenticity (C2PA) content credentials	5	10		Chapter 20
Code of Practice on marking and labelling AI-generated content	5	10		Chapter 3
European Vulnerability Database (EUVD)	5	18		Chapter 12
Exploit Prediction Scoring System (EPSS)	5	18		Chapter 12
General-Purpose AI Code of Practice	5	10, 19, 28		Chapter 3
International AI Safety Report	5	5, 32		Chapter 8
JSON Schema	5	32, Appendix A		Chapter 5
Known-exploited vulnerability catalogues	5	18		Chapter 12
Mermaid, Pandoc, XeLaTeX, MkDocs	5	About the Author		Chapter 4
Model cards	5	29		Chapter 4
NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile	5	4, 32		Chapter 8
OpenAI Preparedness Framework	5	19, 24, 29		Chapter 23
System cards (o1, Claude Opus 4 and Sonnet 4)	5	22, 23, 24, 29		Chapter 23
Version control with pull-request review and pipeline validation	5	32		Chapter 5
Watermarking and AI-content detection classifiers	5	10		Chapter 12
Agent Skills and AGENTS.md	6	12, 13, 16		Chapter 18
Architecture Decision Records (Nygard)	6	4, 5, 14, 17, 19		Chapter 4
Attack trees	6	6		Chapter 10
C4 model	6	5, 19		Chapter 4
Chaos engineering principles	6	10, 11		Chapter 14
Claude Code and Codex permission and sandbox settings	6	7, 12, 17		Chapter 20
Conftest	6	5		Chapter 5
DORA research programme and key metrics	6	3, 12, 23		Chapter 15
ECSF, SFIA and NICE frameworks	6	1, 4, 16, 21, 22, 25, 27		Chapter 21
EPSS, CISA KEV and EUVD	6	3, 10, 19		Chapter 12
FINOS CALM	6	3, 5, 19		Chapter 4
GitHub code owners	6	4, 5, 6, 13		Chapter 8
GitHub Copilot	6	3, 12		Chapter 3
in-toto attestations	6	9		Chapter 8
ISC2 CISSP-ISSAP	6	2, 21, 22		Chapter 21
ISO/IEC 27001 / 27002	6	1, 2, 4, 9, 16, 17, 19, 24, 25, 26		Chapter 8
ISO/IEC 42001	6	9		Chapter 8
Mermaid	6	B		Chapter 4
MITRE ATLAS	6	1, 6, 7, 10, 13, 15, 21, 22		Chapter 10
MITRE ATT&CK	6	1, 6, 7, 8, 10, 11, 13, 21		Chapter 10
MITRE D3FEND	6	6, 10		Chapter 10
Model Context Protocol (MCP)	6	6, 7, 8, 13, 24		Chapter 20
NIST CSF 2.0	6	9, 11, 19		Chapter 8
NIST SP 800-207 Zero Trust Architecture	6	2, 3, 7, 8, 27		Chapter 8
NIST SP 800-53A	6	9		Chapter 8
OAuth 2.0 Token Exchange, RAR and DPoP	6	8		Chapter 20
Open Policy Agent / Rego	6	3, 5, 6, 9, 13, 17, 21		Chapter 5
OWASP Non-Human Identities Top 10	6	8		Chapter 10
OWASP pytm	6	6		Chapter 10
OWASP Top 10 for Agentic Applications	6	6, 7, 8, 13, 21		Chapter 10
OWASP Top 10 for LLM Applications	6	6, 12, 21		Chapter 10
SABSA and TOGAF	6	2, 16, 22		Chapter 3
SBOM and CycloneDX	6	16, 20		Chapter 5
Sigstore	6	9, 11, 14		Chapter 5
SLSA	6	11, 14, 16		Chapter 5
SPIFFE / SPIRE	6	8		Chapter 20
STRIDE	6	6, 22		Chapter 10
Structurizr (DSL)	6	1, 2, 3, 5, 6, 19, 25		Chapter 4
Team Topologies	6	4, 16, 23, 26		unassigned
Threagile	6	6		Chapter 10
Threat Modeling Manifesto	6	6		Chapter 10
Three Lines Model	6	9, 16		Chapter 8
Agent2Agent Protocol (A2A)	7	17		Chapter 20
ISO 45003	7	24		Chapter 8
Job Demands-Resources model	7	2, 11		unassigned
JSON Schema 2020-12	7	25, A		Chapter 5
Karasek demand-control model	7	2, 6, 11, 14		unassigned
Mermaid	7			Chapter 4
Model Context Protocol (MCP)	7	17		Chapter 20
OAuth 2.0 Token Exchange (RFC 8693)	7	17		Chapter 20
Pandoc, MkDocs, GitHub Actions	7			Chapter 5
YAML	7	A		Chapter 5
Case management and ticketing	8	2		Chapter 12
CISA Known Exploited Vulnerabilities catalogue (KEV)	8	5		Chapter 12
ECSF (ENISA)	8	22		Chapter 21
EDR	8	2, 8, 10		Chapter 12
EPSS	8	5		Chapter 12
European Vulnerability Database (EUVD)	8	5		Chapter 12
Mermaid	8	README		Chapter 4
MITRE ATLAS	8	1, 5, 15, 25, 26		Chapter 10
MITRE ATT&CK	8	1, 2, 5, 6, 7, 8, 9, 10, 11, 12, 14, 15, 20, 22, 24, 25, 26, 30		Chapter 10
NIST CSF 2.0	8	1, 2, 8, 10, 11		Chapter 8
NIST incident response CSF 2.0 community profile (SP 800-61 Rev. 3)	8	2, 8, 10, 11		Chapter 13
OWASP Top 10 for Agentic Applications	8	9, 10, 15		Chapter 10
OWASP Top 10 for LLM Applications	8	8, 15		Chapter 10
SFIA 9	8	22		Chapter 21
SIEM	8	2, 6, 7		Chapter 12
Sigma	8	2, 6, 9, 30		Chapter 12
SOAR	8	2, 7, 10		Chapter 12
STIX 2.1 and TAXII 2.1	8	2, 5, 11		Chapter 12
Threat-intelligence platform	8	2, 5		Chapter 12
Atomic Red Team	9	1, 2, 8, 19		Chapter 11
ATT&CK Navigator	9	17		Chapter 10
Breach-and-attack simulation (BAS)	9	2		Chapter 11
CBEST	9	2, 21		Chapter 12
CISA KEV and EUVD	9	5, 22		Chapter 12
DORA (DevOps Research and Assessment) four key metrics	9	3		Chapter 15
ECSF and SFIA	9	19, 24		Chapter 21
Mermaid	9	33		Chapter 4
Microsoft, AWS and Google Cloud penetration-testing rules	9	22		Chapter 11
MITRE ATLAS	9	5, 12, 13		Chapter 10
MITRE ATT&CK	9	1, 2, 5, 9, 17		Chapter 10
MITRE Caldera	9	1, 2, 8, 19		Chapter 11
MITRE D3FEND	9	5		Chapter 10
MITRE Engenuity CTID	9	5, 17		Chapter 10
Model Context Protocol (MCP)	9	12		Chapter 20
NIST Cyber AI Profile	9	17		Chapter 8
NIST Cybersecurity Framework 2.0	9	17		Chapter 8
NIST SP 800-115	9	2		Chapter 8
NIST SP 800-55 Measurement Guide	9	18		Chapter 8
OpenTelemetry GenAI semantic conventions	9	12		Chapter 15
OWASP Top 10 for Agentic Applications	9	12, 16		Chapter 10
OWASP Top 10 for LLM Applications	9	12, 16		Chapter 10
Pandoc, XeLaTeX, MkDocs, GitHub Actions	9	33		Chapter 5
Principles of Chaos Engineering / Security Chaos Engineering	9	8, 11, 15		Chapter 14
security.txt (RFC 9116)	9	22		Chapter 12
SIEM	9	9, 12		Chapter 12
Sigma	9	5, 10		Chapter 12
STIX and TAXII	9	5, 22		Chapter 12
Summiting the Pyramid	9	17		Chapter 14
TIBER-EU	9	2, 7, 20, 21		Chapter 11
Top ATT&CK Techniques	9	5		Chapter 10
Traffic Light Protocol (TLP 2.0)	9	22		Chapter 3
Zero Trust Architecture (NIST SP 800-207)	9	6, 14		Chapter 8
AI Incident Database	10	14		Chapter 13
Ansible and Event-Driven Ansible	10	2, 10		unassigned
Anthropic Agent Skills	10	16, 18		Chapter 18
Argo CD	10	8, 9, 10, 16, 17, 18, 19, 32, Appendix A, Appendix B		Chapter 16
Argo CD MCP server	10	16, 18		Chapter 20
Argo Rollouts	10	8, 9, 32, Appendix B		Chapter 16
Argo Workflows	10	8, 10, 32, Appendix B		Chapter 16
AWS DevOps Agent	10	27, 31		Chapter 18
Camunda Zeebe	10	10		Chapter 5
CISA Known Exploited Vulnerabilities catalogue	10	11		Chapter 12
Cloud Sovereignty Framework	10	24		Chapter 9
Crossplane	10	8, Appendix B		Chapter 6
CWE-117 Improper Output Neutralization for Logs	10	18		Chapter 10
DORA research programme and four key metrics	10	1, 2, 3, 8, 9, 20, 21, 22, 27, 31, 32		Chapter 15
ECSF, SFIA and e-CF	10	26		Chapter 21
European Vulnerability Database (EUVD)	10	11		Chapter 12
Exploit Prediction Scoring System (EPSS)	10	11		Chapter 12
FinOps Framework	10	4, 11, 15, 16, 32, Appendix A		Chapter 17
Flagger	10	8, 9, 32, Appendix B		Chapter 16
Flux	10	8, 9, 16, 17, 18, 32, Appendix A, Appendix B		Chapter 16
Flux MCP Server	10	8, 16, 18		Chapter 20
FrugalGPT	10	15		Chapter 17
Google Config Connector	10	8		Chapter 6
Grafana Labs observability survey	10	3		Chapter 15
ISO/IEC 20000-1	10	1, 2, 32		Chapter 8
ITBench	10	7, 10, 26, 27, 31		Chapter 19
ITIL 4	10	1, 2, 4, 32		Chapter 3
Jira Service Management	10	7		Chapter 13
Kargo	10	8, 9, 32, Appendix B		Chapter 16
KEDA	10	17		Chapter 17
Knowledge-Centered Service (KCS)	10	12		Chapter 3
Kubernetes	10	2, 4, 8, 9, 10, 16, 17, 18, 32, Appendix B		Chapter 6
Kubernetes Horizontal Pod Autoscaler	10	10, 17		Chapter 23
Kubernetes MCP server	10	16		Chapter 20
Kubernetes Validating Admission Policy	10	18		Chapter 5
Mermaid	10	35		Chapter 4
MITRE ATLAS	10	18		Chapter 10
MITRE ATT&CK	10	18		Chapter 10
Model Context Protocol (MCP)	10	8, 16, 18, 32		Chapter 20
National Incident Management System (NIMS)	10	22		Chapter 13
NIST AI RMF	10	18		Chapter 8
NIST Cybersecurity Framework 2.0	10	1, 4, 19, 32		Chapter 8
NIST SP 800-184 Guide for Cybersecurity Event Recovery	10	10, 19		Chapter 13
NIST SP 800-207 Zero Trust Architecture	10	16, 18		Chapter 8
NIST SP 800-53	10	8		Chapter 8
NIST SP 800-61 / incident response recommendations	10	7, 12		Chapter 13
OECD AI incident definitions and reporting framework	10	14		Chapter 13
Open Policy Agent and Rego	10	8, 18, Appendix A, Appendix B		Chapter 5
OpenGitOps principles	10	2, 4, 8, 16, 17, 19, 32		Chapter 16
OpenSLO	10	5		Chapter 15
OpenTelemetry	10	3, 5, 8, 13, 24, Appendix B		Chapter 15
OpenTelemetry Semantic Conventions for Generative AI	10	13, Appendix B		Chapter 15
OpenTofu	10	8, 18, 19, 32, Appendix B		Chapter 6
OWASP Top 10 for Agentic Applications	10	15, 16, 18		Chapter 10
OWASP Top 10 for LLM Applications	10	15, 18		Chapter 10
PagerDuty incident response guide	10	22		Chapter 13
Pandoc, XeLaTeX and MkDocs	10	35, Appendix B		unassigned
Principles of Chaos Engineering	10	1, 9, 10, 12, 17, 19		Chapter 14
Prometheus	10	17, 29, Appendix B		Chapter 15
Prometheus Operator Watchdog alert	10	2, 17, 29, Appendix B		Chapter 15
RCAEval and OpenRCA benchmarks	10	7, 27, 31		Chapter 19
ServiceNow incident state model	10	7		Chapter 13
Site Reliability Engineering practice (Google SRE books)	10	1, 2, 3, 4, 5, 6, 7, 9, 10, 11, 12, 16, 20, 21, 25, 26, 27, 28, 29, 31, Appendix B		Chapter 3
SLSA	10	8, 18		Chapter 5
Software Carbon Intensity (SCI) specification	10	15		Chapter 17
SPACE framework of developer productivity	10	20, 25		Chapter 15
SPIFFE	10	8, 16, 18		Chapter 20
State Chart XML (SCXML)	10	7		Chapter 13
Team Topologies	10	2, 21		Chapter 6
Temporal	10	8, 10, 16, 32, Appendix B		Chapter 16
Terraform	10	8, 18, 19, 32, Appendix B		Chapter 6
TIBER-EU	10	19, 24		Chapter 11
vLLM	10	15		Chapter 17

Methods

Tool	Book	Chapters	Identifier	Treated in
ADR discovery, review and supersession workflow	1	4		Chapter 5
Anti-pattern detection and remediation playbook	1	26b		Chapter 12
Architecture as Code maturity assessment (radar)	1	D, Maturity model		Chapter 8
Architecture fitness functions (evolutionary architecture)	1	B		Chapter 4
Assure once, comply many	1	10, 11, 12, 15a, D		Chapter 8
Competency development loop	1	18		Chapter 21
Culture as Code and Knowledge as Code	1	23		Chapter 3
Documentation as Code	1	2, 22		Chapter 4
DORA delivery metrics	1	5, 17, 18, 20		Chapter 15
Drift detection and prevention	1	2, 7		Chapter 12
Evidence lifecycle management	1	15a		Chapter 5
Fail-fast feedback and progressive validation; progressive deployment	1	5		Chapter 16
FinOps and commitment-based pricing	1	15		Chapter 17
Four-phase blueprint roadmap (pilot, expand, govern, sustain)	1	C		Chapter 3
Management as Code, Budgeting as Code, Competence Management as Code	1	19		Chapter 21
Mandatory architectural review gates via pull requests	1	2, 3, 11		Chapter 4
Migration approach: assessment, wave planning, lift-and-shift vs re-architecting, gradual codification	1	16		Chapter 4
Playbooks as state machines, exercised continuously	1	9c		Chapter 14
Policy as Code operating model	1	10, 11		Chapter 5
Readiness assessment framework (four loops)	1	26a		Chapter 16
Requirements as Code with traceability	1	2, 13		Chapter 4
Risk as code with exceptions	1	9c		Chapter 7
Saga and event sourcing patterns	1	8		Chapter 9
Security chaos engineering / Chaos Monkey experiments	1	9c, 13		Chapter 14
Step-by-step adoption strategy	1	27		Chapter 3
Team Topologies team design	1	17, 18		Chapter 6
Testing policies with opa test	1	11, 13		Chapter 5
Threat modelling from code	1	9, 9c		Chapter 10
Transparent decisions through Issues and Discussions	1	19		Chapter 8
Zero Trust architecture	1	9		Chapter 4
AI Act classification decision tree	2	8		Chapter 8
Architecture decision record (Nygard)	2	3, 13, 16		Chapter 4
Conway's law applied to AI	2	12		Chapter 4
Diffusion of innovation	2	15		Chapter 3
Employee consultation as design review	2	15		Chapter 3
Fitness functions for governance	2	4, 20		Chapter 8
Forum structure and decision-rights design	2	13		Chapter 7
Governance gates in the pipeline	2	9		Chapter 8
Internal algorithmic audit	2	11		Chapter 8
Investment gate lifecycle	2	16A		Chapter 7
Kotter's eight steps applied to AI	2	15		Chapter 3
Maturity model (five levels, eight dimensions)	2	Appendix B		Chapter 8
Mode drift check	2	2		Chapter 12
Model-origin geopolitical risk assessment	2	6		Chapter 7
Observable, expected, speculation horizons	2	22		Chapter 23
Setting a cost envelope and stop conditions	2	16A		Chapter 19
Showback before chargeback	2	16A		Chapter 8
Tabletop exercise built on the OpenAI / Hugging Face incident timeline	2	19		Chapter 14
Team Topologies	2	12, 14		Chapter 6
Westrum organisational culture typology	2	15		Chapter 3
Drift detection with reference and current windows	3	21		Chapter 12
Evaluation pyramid	3	20		Chapter 5
FinOps for AI and chargeback	3	22		Chapter 17
LLM-as-a-judge	3	20		unassigned
ML Test Score	3	7, 8, 20, 23		Chapter 5
Patch-window compression	3	18		Chapter 12
Production readiness review	3	23		Chapter 3
Red teaming and continuous security testing	3	17, 20		Chapter 11
Sampled human review	3	21		Chapter 15
Service level objectives for probabilistic services	3	21		Chapter 15
Shadow and canary deployment	3	7		Chapter 16
Software Carbon Intensity calculation	3	22		Chapter 17
STRIDE extended with ATLAS threat modelling	3	17		Chapter 10
AI-assisted STRIDE and ATLAS analysis	4	10		Chapter 10
AI-assisted threat-modelling review on a pull request	4	10		Chapter 10
Applying a guardrail policy to a security AI capability	4	16		Chapter 5
Assigning a usage mode and an autonomy level	4	6		Chapter 18
Assure once, comply many	4	3		Chapter 8
Assuring a vendor's AI feature before enabling it in the SOC	4	8		Chapter 12
Building a current and target CSF profile with an AI focus	4	3		Chapter 8
Building an AI-aware threat profile	4	2		Chapter 12
Chain of custody for AI analysis	4	20		Chapter 13
Containment that does not depend on intent	4	4, 12, 14, 18, 21		Chapter 20
Defining degradation modes for a security AI capability	4	17		Chapter 13
Defining delegated patch decisions for known-exploited vulnerabilities	4	11		Chapter 12
Designing a deepfake-resilience exercise	4	15		Chapter 14
Drafting rules of engagement for an AI exercise	4	7		Chapter 14
Executing a recovery plan with AI-assisted sequencing and verification	4	22		Chapter 13
Golden-dataset evaluation	4	26		unassigned
Hardening approvals against deepfakes	4	14		Chapter 20
Honeytokens, canaries and decoys	4	19		Chapter 23
Introducing an AI triage assistant at Level 1 Assisted	4	18		Chapter 18
Introducing security chaos engineering in stages	4	25		Chapter 14
Mapping one incident to every reporting obligation	4	21		Chapter 13
Placing a new security AI capability on the reference architecture	4	4		Chapter 4
Preparing a safe AI-assisted emulation run	4	12		Chapter 11
Purple loop (finding to verified closure)	4	26, 12, 19		Chapter 14
Reconciling the AI inventory with discovered assets	4	9		Chapter 7
Restore, do not repair (known-good redeploy, clean room)	4	17, 21, 22		Chapter 16
Returning an AI system to service after an incident	4	23		Chapter 13
Running a quarterly purple-team session	4	26		Chapter 14
Running a red-team campaign on a retrieval-augmented assistant	4	13		Chapter 11
Running an AI-assisted incident tabletop	4	20		Chapter 13
Running an escape-path assessment on a production agent	4	13		Chapter 18
Setting up a monthly AI-assisted restore drill	4	24		Chapter 13
Steady-state hypothesis for security	4	25		Chapter 14
Taking a threat report to a deployed, tested detection in a day	4	19		Chapter 12
Threat-led testing (DORA TLPT / TIBER-EU)	4	7, 12		Chapter 11
Writing a risk-appetite statement for security AI	4	5		Chapter 7
Agent incident rehearsal from logs	5	25		Chapter 13
AI companion decision for care settings	5	9		Chapter 23
AI dependency mapping with exit options	5	15		Chapter 23
AI service footprint estimate	5	17		Chapter 23
Assuring a provider's catastrophic-misuse safeguards	5	19		Chapter 23
Callback verification of approvals	5	20		Chapter 23
Constructive discussion in four steps	5	1, 4, 6-27		Chapter 12
Control-to-threat mapping and gap testing	5	30		Chapter 5
Dangerous-capability evaluations	5	5, 19, 27, 29		Chapter 23
Decoys (self-concealing canary assets)	5	23		Chapter 16
Evidence ladder	5	4, 32, 35		Chapter 23
Existential-risk scenario writing for a register	5	27		Chapter 7
Fairness metrics (demographic parity, disparate-impact ratio, equal opportunity, equalised odds)	5	12		Chapter 22
Grading an AI threat claim on the evidence ladder	5	4		Chapter 23
Harm-path review	5	11		Chapter 23
Household and classroom lanes	5	31		unassigned
Keeping oversight skills alive (rotation, drills, oversight-quality metric)	5	14		Chapter 8
Layered assurance against evaluation awareness (paired variants, report-record comparison, decoys)	5	23		Chapter 21
Mapping register to legal instruments	5	28		Chapter 7
Observable, expected, speculation labelling	5	4, 32		Chapter 23
Patch velocity as a supervised metric	5	18		Chapter 15
Pre-release sycophancy testing	5	8		Chapter 16
Publishing with provenance	5	10		Chapter 5
Reading a system card as a deployer	5	29		Chapter 16
Reading an AI risk claim (ten-question check)	5	3		Chapter 7
Reversibility test	5	26		Chapter 5
Setting up a threat register in a quarter (13-week plan)	5	32		Chapter 23
Shortcut-rate measurement	5	22		Chapter 15
Skill-preserving AI use (working agreement and reasoning check)	5	6		Chapter 23
Stop-path test	5	24		Chapter 19
Supplier defence-exposure assessment	5	21		Chapter 9
Tail-risk handling with leading indicators	5	4, 27		Chapter 7
Task classification for AI in education	5	7		Chapter 7
Ten tropes as hypotheses (T1-T10)	5	2, 35		Chapter 23
Trigger-based register review	5	32		Chapter 7
Adding a market overlay without weakening the baseline	6	20		Chapter 8
Assure once, comply many	6	5, 9		Chapter 8
Auditing an inherited security architecture practice	6	2		Chapter 8
Blast radius as a design parameter	6	7		Chapter 12
Building a 24-month plan	6	26		Chapter 8
Classifying controls as verified, declared or failed	6	9		Chapter 7
Competence assessment by practical demonstration	6	21		Chapter 21
Correlated-controls review	6	7		unassigned
Craft-keeping programme	6	15		Chapter 21
Designing a containment profile in six questions	6	7		Chapter 20
Diagnosing anti-patterns	6	24		Chapter 3
First 90 days in the role	6	27		Chapter 18
Four shifts assessment	6	3		Chapter 3
Framing the question (commission)	6	1		Chapter 3
Generated threat models in eight weeks	6	6		Chapter 10
Horizon register and four scenarios	6	23		Chapter 23
Interview exercise testing judgement with and without AI	6	22		Chapter 14
Introducing an agent team in three stages	6	13		Chapter 18
Measuring review quality without monitoring individuals	6	14		unassigned
Moving a reference architecture document into a model and policy set	6	5		Chapter 5
One-page architecture report for a management body	6	19		Chapter 8
Personal AI workflow set-up	6	12		Chapter 5
Redesigning a review board as a design authority with gates	6	17		Chapter 7
Registering an agent identity	6	8		Chapter 20
Reversibility test on a delegation	6	11		Chapter 18
Review protocol by risk tier	6	14		Chapter 7
Reviewing a year in the role	6	25		unassigned
Role-map workshop	6	16		Chapter 21
Second agent as adversary	6	14		Chapter 11
Security chaos experiment	6	11		Chapter 14
Seeded-error drill	6	15, 14		Chapter 19
Setting a patch-velocity service level	6	10		Chapter 15
Soundness defined in advance with non-trusting review techniques	6	14		Chapter 19
Testing a charter against ten decisions	6	4		Chapter 5
Timing a stop path end to end	6	10		Chapter 19
Turning a spreadsheet of Annex A controls into a catalogue	6	9		Chapter 8
Turning an article into a control	6	18		Chapter 8
Twelve-month learning path	6	22		Chapter 21
Writing a mandate manifest	6	13		Chapter 18
Writing a role charter in five steps	6	4		Chapter 21
Writing testable security requirements for a tender	6	20		Chapter 5
Building a feature register for office assistants and analytics	7	10		Chapter 7
Building an appeal path	7	27		Chapter 22
Checking for solely automated decisions (GDPR Art. 22)	7	22		unassigned
Classifying a system under the AI Act and recording it	7	21		Chapter 8
Counterfactual explanation	7	27, 22		unassigned
Disparate-impact test with the representatives	7	12		Chapter 22
Drafting a works agreement for a continuously changing AI system	7	23		Chapter 22
Drawing the chain of accountability and testing the stop path	7	17		Chapter 19
Introducing Management Decision Records for one system	7	25		Chapter 22
Introducing, pausing or retiring a screening model with a record	7	7		Chapter 21
Locating the organisation on the five functions in an afternoon	7	1		unassigned
Managerial craft programme	7	19		Chapter 21
Mapping a team's management functions	7	2		unassigned
Measuring autonomy and perceived fairness	7	11		Chapter 22
Multi-year evaluation design	7	15		unassigned
Negotiating a delegation profile with unions or works council	7	9		Chapter 22
Platform Work Directive test of internal allocation systems	7	5		Chapter 6
Proportionality review of monitoring data	7	13		unassigned
Quarterly review with the representatives	7	30		Chapter 8
Reviewing against the anti-pattern checklist	7	31		Chapter 3
Seeded-error testing of oversight	7	16, 19, 26		Chapter 19
Setting up an oversight-quality metric	7	26		Chapter 8
Team charter for a mixed team	7	18		Chapter 18
Testing whether a performance score is decisive in practice	7	8		Chapter 5
Tracing the lineage of a measure	7	3		Chapter 15
Turning a year's records into a 24-month plan	7	32		Chapter 8
Weekly verification routine for the team leader	7	16		Chapter 19
Work-environment risk assessment of pace systems	7	6		Chapter 7
Writing a decision-rights file with the representatives	7	20		Chapter 22
Writing a first delegation profile	7	4		Chapter 18
Writing a mandate manifest for a team's agents	7	16		Chapter 18
Writing a role charter and time budget for a line manager	7	29		Chapter 21
Writing and testing a worker information notice	7	28		Chapter 5
Writing health and rest constraints into an optimiser	7	14		Chapter 22
Writing tender requirements for management systems in a public authority	7	24		Chapter 4
Anti-pattern review in two hours	8	25		Chapter 3
Autonomy matched to reversibility (Levels 0-4)	8	1, 4, 10		Chapter 18
Blameless review in 90 minutes	8	11		Chapter 13
Building the incident clock	8	19		Chapter 13
Canaries	8	15		Chapter 20
Constructive debate in four steps	8	7, 21, 23, 24		Chapter 23
Degraded-mode drill	8	13, 23		Chapter 18
Five checks before an AI-assisted case is closed	8	8		Chapter 12
Four-week hunt cycle	8	9		Chapter 12
Half-day exercise assessment	8	22		Chapter 14
Independent reproduction and critique agent	8	14		Chapter 19
Introducing a SOC agent in four steps	8	13		Chapter 12
Observable, expected, speculation labelling	8	3, 24, 28		Chapter 23
Patch velocity as a service level	8	5		Chapter 15
Purple loop	8	11		Chapter 14
Red teaming the SOC's AI	8	15		Chapter 11
Replacing closure-rate target with three measures and gaming check	8	20		Chapter 14
Reviewing an AI-drafted detection	8	6		Chapter 12
Seeded-incident programme	8	14, 20, 22, 23		Chapter 19
Setting the ceiling for a response action	8	10		Chapter 13
Soundness criteria for a security conclusion	8	14		Chapter 8
Stop-path drill	8	10, 15, 20, 25		Chapter 19
Tabletop with decision-rights table	8	18		Chapter 3
Taking a supplier-default rule into the repository	8	6		Chapter 9
Tested one-day switch-off	8	16		Chapter 5
Turning a conclusion into a plan	8	27		unassigned
Unassisted practice (randomised share)	8	12, 23		Chapter 3
Year-in-review from records	8	26		unassigned
Annual loop calendar	9	27		Chapter 12
Blameless session ground rules	9	23		unassigned
Classifying and segregating a findings register	9	16		Chapter 7
Classifying existing testing	9	2		Chapter 7
Closure rule	9	4, 11		Chapter 5
Consent and notice for provider-crossing tests	9	22		Chapter 22
Continuous emulation trigger and cadence choice	9	8		Chapter 11
Continuous emulation with variation	9	8		Chapter 11
Coverage as a claim (status, evidence age, expiry, honest not tested)	9	17		Chapter 14
Debate in four steps	9	8, 15, 24, 25		Chapter 12
Delegation profile writing	9	4		Chapter 18
Designing a board page that cannot be gamed	9	18		Chapter 15
Detection record for agent over permission ceiling	9	12		Chapter 12
Emulation plan giving ground truth without the plan	9	7		Chapter 11
Expectation first	9	9		Chapter 12
Finding-to-change decision	9	10		unassigned
Goodhart's law awareness	9	8, 18		Chapter 21
Heat map replaced by coverage records	9	17		Chapter 14
Held-out scenarios	9	15		Chapter 19
Horizon register practice	9	25		Chapter 23
Independence principle (five separations, one rule, three proofs)	9	4, 15		Chapter 19
Independence review of a loop	9	15		Chapter 19
Injected-test clause for managed-service contract	9	13		Chapter 9
Mandate manifest writing for emulation runner	9	14		Chapter 18
Mapping obligation to control and evidence	9	21		Chapter 8
Observable, expected, speculation labelling	9	1, 25		Chapter 23
One-page inventory of AI in testing and detection	9	1		Chapter 12
Operating-model decision with exit criteria	9	19		Chapter 8
Outcome taxonomy	9	9		Chapter 11
Priority technique list (20 to 40 techniques)	9	5		Chapter 12
Purple loop (P1 Target, P2 Emulate, P3 Observe, P4 Improve, P5 Verify)	9	4		Chapter 14
Purple session (blameless, expectations first)	9	9, 23		Chapter 14
Recognising early signs of anti-patterns	9	26		Chapter 3
Red apprenticeship route	9	24		Chapter 21
Reproduction by a person	9	15		Chapter 19
Safety classes for scenarios	9	6		Chapter 20
Scope as code / policy decision point enforcement	9	6		Chapter 5
Seeded gaps	9	15		Chapter 19
Tabletop of decision rights	9	20		Chapter 3
Test-to-change ratio estimate	9	3		Chapter 5
Turning a closed finding into a regression case	9	11		Chapter 14
Writing a two-year loop plan	9	28		Chapter 4
Agent promotion, shadow period and demotion	10	16		Chapter 19
Agent proposes through the desired-state repository	10	16		Chapter 18
Autonomy budget	10	4, 10, 15, 20		Chapter 18
Backup 3-2-1 rule and immutability	10	10, 19		Chapter 13
Blameless, evidence-based review	10	12		Chapter 5
Break-glass	10	18, 29		unassigned
Burn-rate alerting	10	5, Appendix A.1		Chapter 15
Capacity forecasting with backtest	10	11		Chapter 17
Cell-based architecture	10	9		Chapter 4
Classifying drift and choosing a response	10	8		Chapter 13
Cognitive forcing functions	10	7		unassigned
Competence with and without the assistant	10	26		Chapter 21
Constructive debate in four steps	10	10, 17, 26, 27		Chapter 23
Cost per outcome as a distribution	10	15		Chapter 17
Dead-man's switch / heartbeat	10	4, 17, 28		Chapter 19
Decision rights (six fields)	10	22		Chapter 3
Dependency-and-blast-radius mapping	10	3		Chapter 13
Eight anti-patterns	10	28		Chapter 3
Exit test	10	24		Chapter 5
Fallback ladder	10	15		unassigned
Feature flags	10	9		Chapter 16
Four classes of AI incident and containment ladder	10	14		Chapter 20
Four golden signals	10	5		Chapter 3
Four key metrics	10	20		Chapter 15
Four owners	10	21		unassigned
Freezes and blast-radius budgets	10	9		Chapter 16
Game day and chaos experiment	10	19, 26, 29		Chapter 14
Game day with the agents off / dark day	10	19, 26, 29		Chapter 14
GitOps (OpenGitOps principles)	10	2, 4, 8, 16, 17, 19		Chapter 16
Golden incident sets and precision/recall per alert class	10	6		Chapter 13
Incident command	10	7, 22		Chapter 13
Incident record as a state machine	10	7		Chapter 13
Knowledge hygiene	10	12		unassigned
Level 4 prohibitions	10	4, 10, 19		Chapter 18
Manual-practice clause	10	26		Chapter 3
Model-change release path (shadow, canary, ramp) with pinning and fallbacks	10	13		Chapter 16
Noise budget	10	6, Appendix A.2		Chapter 15
Observability as code	10	5		Chapter 15
Observable, expected, speculation labelling	10	3, 9, 15, 18, 27, 28		Chapter 23
Observer principle (independence, dependence and stop tests)	10	1, 4, 17		Chapter 19
Operating model options	10	21		Chapter 9
Operational transparency and exit-test annex	10	24		Chapter 8
Operations loop (O1 Observe, O2 Diagnose, O3 Change, O4 Restore, O5 Sustain)	10	1, 4		Chapter 7
Policy as code in the change path	10	8		Chapter 5
Practical guide: Adding an operations annex to a managed-service contract	10	21		Chapter 9
Practical guide: Board paper outline	10	30		Chapter 5
Practical guide: Building a clock sheet for a service in scope of more than one regime	10	14		Chapter 13
Practical guide: Building a decision-right matrix for the first ten decisions of a bad night	10	22		Chapter 19
Practical guide: Choosing an operating model by service criticality and sovereignty	10	21		Chapter 9
Practical guide: Classifying the practices a team has	10	2		Chapter 7
Practical guide: Defining quality objectives and a rollback for an AI service	10	13		Chapter 16
Practical guide: Defining standard change classes that an agent may author and a pipeline may release	10	8		Chapter 16
Practical guide: Drafting an on-call charter with the works council	10	25		Chapter 22
Practical guide: Drawing a dependency-and-blast-radius map in an afternoon	10	3		Chapter 13
Practical guide: Drawing up an alert-correlation policy	10	6		Chapter 15
Practical guide: Five things on Monday and the first week	10	31		unassigned
Practical guide: Inventorying where AI already takes part in operating a service	10	1		Chapter 7
Practical guide: Keeping a horizon register for operations	10	27		Chapter 23
Practical guide: Monthly review of the operations loop	10	29		Chapter 3
Practical guide: Planning a drill year with agents off	10	26		Chapter 18
Practical guide: Reading a post-incident report with the five functions	10	28		Chapter 13
Practical guide: Running a restore test and writing the claim it supports	10	19		Chapter 13
Practical guide: Running a review with an AI-drafted timeline and a human-written analysis	10	12		Chapter 13
Practical guide: Running an incident with an assistant	10	7		Chapter 13
Practical guide: Setting a cost-and-latency budget for an AI service with a stop condition	10	15		Chapter 19
Practical guide: Setting guardrails for a rightsizing agent	10	11		Chapter 18
Practical guide: Setting stop conditions for a staged rollout with a second system evaluating them	10	9		Chapter 19
Practical guide: Specifying an observer	10	17		Chapter 19
Practical guide: Turning an article into a control with an owner and evidence	10	23		Chapter 5
Practical guide: Writing a delegation profile for one service	10	4		Chapter 18
Practical guide: Writing a mandate manifest for a runbook-runner agent	10	16		Chapter 18
Practical guide: Writing a metric definition with intended use and misuse notes	10	20		Chapter 23
Practical guide: Writing a permission manifest and deny-by-default policy for a remediation agent	10	18		Chapter 20
Practical guide: Writing a runbook so that a machine may run it	10	10		Chapter 16
Practical guide: Writing an SLO from a user journey	10	5		Chapter 15
Practical guide: Writing the operational transparency and exit-test annex to a cloud or managed contract	10	24		Chapter 9
Progressive delivery (rings, canaries, bake time)	10	9, 13		Chapter 16
Provenance record for changes	10	8		Chapter 5
Reading evidence in three grades	10	3		Chapter 5
Rebuild from declared state	10	19		Chapter 20
Reconciler as a change actor	10	8, 17, 18		Chapter 18
Regulation-to-control mapping	10	23		Chapter 8
Remediation tiers	10	10		Chapter 16
Remediation windows by maintenance group and patch-velocity measure	10	11		Chapter 16
Resilience as a claim (six parts, derived statuses, evidence age)	10	4, 19		Chapter 13
Restore test (kinds and default clocks)	10	10, 19		Chapter 13
Rollback safety	10	9		Chapter 16
Safe execution of runbooks (idempotency, retry budget, back-off)	10	10, 17		Chapter 16
Second-hypothesis rule / designing against anchoring	10	7		Chapter 16
Seeded faults and seeded errors	10	6, 14, 17, 26		Chapter 19
Service level objective and error budget	10	5, 20		Chapter 15
Setting a delegation ceiling (reversibility, blast radius, evidence)	10	4		Chapter 18
Signed runbooks and input provenance	10	18		Chapter 16
Six kinds of independence	10	17		Chapter 19
Skills as versioned files	10	16		Chapter 18
Standard, normal and emergency change	10	2, 8		unassigned
Testing the ceiling	10	18		Chapter 5
Time to restore as a distribution	10	20, Appendix A.16		Chapter 8