# 28 Reference Architecture Scenarios > Twenty-eight reference architectures for AI, data, resilience and platforms, each with flows, trust boundaries, failure modes and the alternative. - Web page: https://www.alesanalytics.com/architecture/scenarios - Markdown: https://www.alesanalytics.com/architecture/scenarios.md - Part of: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md), section "Failure and design" - Last verified: 13 October 2026 - Publisher: Ales Analytics ## How each scenario is set out Twenty-eight common enterprise designs, each reduced to the parts an architect needs in a review. Every card follows the same order: - **Components and flows,** with flows marked I for identity, D for data and N for network where it helps. - **Boundaries and controls:** where trust changes, and what enforces it. - **Failure and cost:** what breaks first, and what dominates the bill. - **Alternative:** the obvious other design, and why this shape was chosen over it. - **Notice:** the detail that is easiest to miss, including corrections made in the second edition. Three of these are worked through in full, from requirements to an injected failure, on the [worked examples page](https://www.alesanalytics.com/architecture/worked-examples.md). ## AI over enterprise data ### 1. Internal AI assistant - **Components and flows.** I: OIDC sign-in to the app, which calls a model gateway with the user's claims. D: ACL-filtered retrieval, then the model, then a cited answer. N: an identity-aware proxy, a private application, private endpoints. - **Boundaries and controls.** User to app: Conditional Access and a compliant device. App to model provider: no training on prompts, region pinned. DLP on output. - **Failure and cost.** The identity provider, the model API and index freshness. Cost is dominated by retrieved context, not by the answer. - **Alternative.** Microsoft 365 Copilot. This shape wins when you need one gateway to centralise policy and metering across sources. - **Notice.** Late verification of the top results at the source, and a revocation window set per data class. See [worked example 1](https://www.alesanalytics.com/architecture/worked-examples.md). ### 2. Private RAG platform - **Components and flows.** Ingest into a raw zone, then a chunked zone, then indexes partitioned by class, with a workload identity per tenant. - **Boundaries and controls.** A partition per class, a key per tenant, and deletion events that reach the index. - **Failure and cost.** Changing the embedding model means a re-embedding migration. Vector storage grows quietly. - **Alternative.** The provider's managed search. This shape shares freshness, ACL handling and provenance across every application that uses it. - **Notice.** Keep storage classification (the maximum of the inputs) separate from exposure classification (per request, after trimming). ### 3. Agent platform - **Components and flows.** An agent runtime, an MCP tool registry, a policy decision point, approvals, Entra Agent ID or workload identities, a memory store and an evaluation harness. - **Boundaries and controls.** Every tool is a boundary. Side effects need approval. Each of ASI01 to ASI10 is mapped to a control. - **Failure and cost.** Loops (ASI08) need circuit breakers. Multi-step tasks multiply tokens. - **Alternative.** A workflow engine, or AgentCore, Foundry or the Agent Platform. Whatever you choose, keep authorization outside the model. - **Notice.** The blueprint credential is Tier-0. Side-effecting tools must be idempotent. Irreversible actions fail to manual. ### 4. AI over Microsoft 365 - **Components and flows.** Delegated Graph access, or the semantic index, feeding Copilot. Output carries the strictest label among its sources. - **Boundaries and controls.** Permission remediation first. DLP on the Copilot location. Restricted Content Discovery where needed. - **Failure and cost.** Oversharing. The four-hour DLP lag. Per-user licensing against per-token cost. - **Alternative.** A custom RAG platform using `Sites.Selected`. Either way, the permission state *is* the architecture. - **Notice.** Copilot DLP is a separate policy estate. The identity that grants Selected scopes is Tier-0. Replace RSS with RCD now: it is closed to new enablement and retiring. ### 5. AI over SAP and ERP - **Components and flows.** Reads go through CDC into a curated data product and a semantic layer. Writes go through a tool to the ERP API, with the user mapped. - **Boundaries and controls.** ERP roles mapped to data-platform roles; row-level security in the warehouse; approved writes only. - **Failure and cost.** Replication lag. API limits. - **Alternative.** The vendor's own AI. Whichever you choose, reuse the ERP's authorization or reproduce it and test the reproduction. - **Notice.** Write tools must be idempotent. ### 6. AI over documents - **Components and flows.** Upload into quarantine (malware scanning, injection heuristics), then layout parsing, then the index, with citations to the page. - **Boundaries and controls.** Nothing is indexed before quarantine. Retention in the index matches retention at the source. - **Failure and cost.** OCR drift. Per-page OCR cost. Long-context cost. - **Alternative.** Long context alone, which works only for small collections. - **Notice.** Ingestion is a security boundary. ### 7. AI over databases - **Components and flows.** A semantic layer, then text-to-SQL, then a validator (read-only, with cost limits), then a database with row-level security. - **Boundaries and controls.** No DDL or DML. Caps on rows and cost. - **Failure and cost.** Joins that are silently wrong. Scan cost. - **Alternative.** Metrics APIs exposed as tools. The semantic layer is what constrains the model. - **Notice.** The semantic layer and the read-only validator do the work; the model doesn't. ### 8. Multi-model gateway - **Components and flows.** A multi-region gateway, policy mapping models to data classes, a vault, metering. - **Boundaries and controls.** Allow-lists, redaction, bulkheads. - **Failure and cost.** A provider outage or a regulatory withdrawal triggers an equivalent fallback. The gateway is Tier-1. - **Alternative.** Each provider's own gateway. This shape gives you a single choke point for authorization, cost and resilience. - **Notice.** Every check has its own fail mode, and a fallback is a route that must pass the same evaluation and residency checks. ### 9. Self-hosted open-weight models - **Components and flows.** Kubernetes with DRA and a quota queue, a PagedAttention-class serving engine, a signed model registry, no egress. - **Boundaries and controls.** Weight provenance. Licence terms, such as the Llama 4 clause on multimodal use in the EU. No prefix cache shared across tenants. - **Failure and cost.** GPU exhaustion, Xid errors and out-of-memory, KV utilisation, time to first token. - **Alternative.** Managed open-weight endpoints. Self-hosting trades serving operations for control. - **Notice.** Size on KV memory (see the [numbers](https://www.alesanalytics.com/architecture/numbers.md)). DRA's core is stable and its partitioning features are beta. ### 10. Hybrid AI - **Components and flows.** A classifier routes high-class requests to an on-premises model, and low-class requests to the cloud with redaction. - **Boundaries and controls.** Default deny to the cloud when the class is unknown. - **Failure and cost.** Misclassification. Running two estates. - **Alternative.** Everything on-premises. Compute goes where the data is allowed to go. - **Notice.** The default for an unclassified request decides whether this design meets its requirement. ### 11. On-premises AI - **Components and flows.** Local GPUs, a serving engine, a vector database, an identity provider, telemetry. - **Boundaries and controls.** No external processing zone at all. - **Failure and cost.** Hardware lead times, a single site, fixed capacity, which means admission control. - **Alternative.** A sovereign cloud, which also removes external processing. - **Notice.** With fixed capacity, the queueing curve is the design. See [utilisation and latency](https://www.alesanalytics.com/architecture/numbers.md). ### 12. Cloud AI - **Components and flows.** Provider models, search, agents and private endpoints. - **Boundaries and controls.** The provider's IAM. - **Failure and cost.** Regional availability, quotas, deprecations. - **Alternative.** Add a gateway. Going cloud-native gets the most out of managed services, and ties you to the provider's agent and evaluation tooling. - **Notice.** Track renames and deprecations as lifecycle events. ### 13. Multi-cloud AI - **Components and flows.** A gateway, cross-cloud workload identity federation, and cost normalised to FOCUS. - **Boundaries and controls.** No static keys anywhere. - **Failure and cost.** Separate control planes help only if the fallback has been tested. Egress. - **Alternative.** A single cloud. You're trading model diversity against identity complexity. - **Notice.** List everything that gets duplicated: IAM, networking, KMS, logging, landing zones, runbooks. ### 14. Strict data residency - **Components and flows.** In-region deployments with no global routing; in-region indexes and logs; a sovereign cloud such as AWS European Sovereign Cloud; customer-managed keys. - **Boundaries and controls.** Data at rest, data in processing and support access treated separately. Cross-region inference disabled. - **Failure and cost.** Disaster recovery must stay inside the jurisdiction. - **Alternative.** On-premises. Residency binds every hop, including telemetry. - **Notice.** Telemetry is derived data. A fallback can't leave the jurisdiction. ### 15. Highly regulated AI - **Components and flows.** An inventory, a risk register, evaluation evidence, immutable logs, human review, change control. - **Boundaries and controls.** Every model, prompt and index change controlled, with evidence. - **Failure and cost.** A gap in the evidence is a compliance failure. - **Alternative.** None really: regulation turns into traceability. Under the EU AI Act as amended by Regulation (EU) 2026/1744, the Annex III high-risk obligations apply from 2 December 2027. - **Notice.** Article 50 applies from 2 August 2026, and the machine-readable marking duty in Article 50(2), for generative systems already on the market before that date, has a transitional deadline of 2 December 2026. Evidence must distinguish systems placed on the market before and after 2 August 2026. ## Platform, resilience and integration ### 16. Highly available application - **Components and flows.** Compute across availability zones, a zone-redundant load balancer and cache, a database with a synchronous replica. - **Failure and cost.** A zonal loss is absorbed. Pre-scale for static stability: 1.5 times at three zones, 2 times at two. - **Alternative.** Multi-region. - **Notice.** **Corrected:** zones are the cheapest independent domain for *physical* faults only. They share the region's control plane, configuration and identity. ### 17. Multi-region application - **Components and flows.** Active-passive, with asynchronous replication and DNS or a global load balancer, or active-active with conflict semantics or a global database. - **Failure and cost.** Hidden global dependencies. DNS TTL bounds how fast you can fail over. - **Alternative.** None: regions are independent only if their dependencies are. - **Notice.** **Corrected fact:** in the October 2025 AWS incident, global-table replicas in other regions stayed reachable with prolonged replication lag, while sign-in through a regional IAM path failed. Design for fail-static identity. See [worked example 2](https://www.alesanalytics.com/architecture/worked-examples.md). ### 18. Hybrid enterprise - **Components and flows.** One identity provider, non-overlapping IP ranges, hybrid DNS, dual links, unified policy, a central SIEM, IaC. - **Boundaries and controls.** Tiered administration. - **Failure and cost.** A single link or a single DNS forwarder as a point of failure. - **Alternative.** None: consistency of identity, naming and policy matters more than location. - **Notice.** Give the IPv6 path the same policy as the IPv4 one. ### 19. Data platform - **Components and flows.** CDC into a lake on an open table format, query engines, a catalogue with lineage, row-level security and masking, and data products served to AI. - **Boundaries and controls.** Data moves zone by zone, and reaches external processing only through data products. - **Failure and cost.** Freshness and completeness SLOs. - **Alternative.** A warehouse-centric design, or a data mesh. Open formats keep the decision reversible. - **Notice.** Tombstones and lineage carry deletion. ### 20. Event-driven integration - **Components and flows.** A broker, a schema registry, the outbox pattern, idempotent consumers, a dead-letter queue. - **Boundaries and controls.** Authorization at the message level. - **Failure and cost.** Poison messages, lag, duplicates. - **Alternative.** Synchronous APIs. With events, outages become delays. - **Notice.** Exactly-once *effect* comes from idempotency, not from the broker. ### 21. Disaster recovery - **Components and flows.** Immutable backups under separate credentials, IaC rebuild, runbooks, break-glass for DR, DNS failover. - **Boundaries and controls.** The backup identity plane is isolated. - **Failure and cost.** Untested restores. Keys in the compromised account. No GPU capacity in the DR region. - **Alternative.** Tiers from restore-only through pilot light and warm standby to active-active. Recovery exists only if it has been exercised. - **Notice.** Build the restore dependency graph, and keep the keys separate. ### 22. Secure API platform - **Components and flows.** A gateway with OAuth and OIDC, mutual TLS for partners, a WAF, rate limits, schema validation and an API catalogue. - **Boundaries and controls.** Fine-grained authorization inside each service, which is what stops broken object-level authorization (BOLA). - **Failure and cost.** Metrics per consumer. - **Alternative.** A service mesh alone. - **Notice.** The gateway is coarse; the service is fine. A gateway can't check object-level access. ### 23. Enterprise search - **Components and flows.** Connectors that capture ACLs, identity mapping and security trimming. - **Boundaries and controls.** Completeness of the identity mapping. - **Failure and cost.** Over- or under-exposure; throttling. - **Alternative.** None: this is the same architecture as RAG retrieval, so build it once and share it. - **Notice.** A vector database and a search index are the same capability, a derived retrieval index. ### 24. SaaS integration - **Components and flows.** An iPaaS, SCIM, webhooks into a queue, a vault, rate-limit handling. - **Boundaries and controls.** An identity per connector. - **Failure and cost.** API deprecations. Lost webhooks, which need reconciliation. - **Alternative.** Point-to-point integration. External control planes need buffering. - **Notice.** Assume webhooks get lost, and reconcile on a schedule. ### 25. Kubernetes platform - **Components and flows.** A managed control plane, GPU pools, a CNI with network policy, the Gateway API, workload identity, admission policy, GitOps and a signed registry. - **Boundaries and controls.** Isolation by namespace or tenant. - **Failure and cost.** Upgrades, API deprecations, CoreDNS saturation. The cluster is the blast radius. - **Alternative.** VMs. Kubernetes gives a consistent substrate in exchange for platform operations. - **Notice.** Plan the skew path, and set webhook failure policies deliberately. ### 26. Developer platform - **Components and flows.** A portal, templates, CI/CD with SLSA provenance, ephemeral environments, policy as code, cost per team. - **Boundaries and controls.** Signed artefacts. - **Failure and cost.** Templates drifting from what teams actually run. - **Alternative.** None: a platform encodes decisions as defaults. - **Notice.** The CI identity is Tier-0. ### 27. Observability platform - **Components and flows.** OpenTelemetry, a pipeline that samples and redacts, backends, an SLO service, a store for AI traces. - **Boundaries and controls.** Redaction before storage. - **Failure and cost.** Ingest and cardinality cost. It needs a failure domain of its own. - **Alternative.** None: telemetry that shares fate goes blind when you need it. - **Notice.** Independent paging, residency of telemetry, and access control on logs. ### 28. Zero-trust application - **Components and flows.** An identity-aware proxy, device posture, a per-request PDP, mTLS service identities, micro-segmentation, following NIST SP 800-207. - **Boundaries and controls.** Every request. - **Failure and cost.** The PDP and the identity provider are Tier-0. Cached decisions with bounded staleness. - **Alternative.** A VPN. Zero trust moves the perimeter to each request. - **Notice.** **Corrected:** "bounded staleness" means a stated revocation window, ideally shortened by CAE-style events. Should you have any questions regarding this page, please contact us at solutions@alesanalytics.com. ## Sources 1. [Regulation (EU) 2026/1744, the Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng). European Union, 2026. The 2026 amendment that moved the high-risk deadlines. 2. [SP 800-207, Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final). NIST, 2020. The reference definition of zero trust: per-request access decisions by a policy decision point and enforcement point. ## Where to go next - Previous: [Architecture Trade-Offs and Second-Order Effects](https://www.alesanalytics.com/architecture/trade-offs.md) - Next: [Worked Architecture Examples](https://www.alesanalytics.com/architecture/worked-examples.md) - Overview and every page: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md) - The whole site in one file: https://www.alesanalytics.com/llms-full.txt