Illustrative enterprise prototype

What are we working on?

Ask a question, create an output, or build an app that works across your tools and governed enterprise data.

Get started across the organization

Build a security architecture posture dashboard across internet-facing applications, APIs, store networks, workforce access, and third-party connectivity.

AI

I need scoped access to the enterprise asset inventory and security telemetry.

Gatekeeper: Security telemetry + CMDBRequesting read-only access to asset ownership, control coverage, policy exceptions, and summarized security events. Credentials remain isolated and every query is logged.

Approved. Do not expose raw event or customer data.

AI

Access is limited to aggregated posture metadata.

Executed code

const posture = await env.SECURITY_GRAPH.assess({
  domains: ["digital", "api", "store-edge",
    "workforce", "third-party"],
  controls: ["ddos", "waf", "api-security",
    "zero-trust", "dns"]
});
const priorities = posture.findings.filter(f =>
  ["critical", "high"].includes(f.severity)
);
workspace.render(SecurityPosture, { posture, priorities });

AI

Security Posture Dashboard is ready with illustrative data. It highlights three architecture decisions that need review without exposing raw telemetry.

Draft a target-state Zero Trust reference architecture for store, corporate, cloud, and third-party access. Ground it in our architecture principles, NIST SP 800-207, and PCI DSS.

AI

I will use centrally governed standards from the context library.

Context library: Architecture + complianceLoading read-only architecture principles, security standards, vendor requirements, NIST SP 800-207, and PCI DSS 4.0.1 control mappings.

AI

The reference architecture needs three explicit decisions:

1. Identity enforcement for every administrative path
2. Segmentation boundaries across stores, cloud, and the CDE
3. Resilient fallback patterns that cannot become permanent bypasses

AI

Zero Trust Reference Architecture v1.0 is ready. The document maps access paths to guardrails, evidence, and measurable validation criteria.

Build a 90-day security architecture roadmap that turns our highest-priority risks into validated engineering decisions and a scalable rollout plan.

AI

I will request read-only planning and operational data.

Gatekeepers: Jira + ServiceNow + architecture repositoryRead epics, change records, architecture decisions, owners by team, and milestone status. Exclude ticket comments and personal data.

Approved for architecture workstreams only.

AI

Executed code

const initiatives = await env.JIRA.getEpics({
  portfolio: "SECURITY-ARCHITECTURE",
  horizon: "90-days"
});
const decisions = await env.ARCH_REPO.getOpenADRs();
deck.generate(SecurityRoadmap, {
  initiatives, decisions, evidence: "aggregated"
});

AI

90-Day Security Architecture Roadmap is ready. It organizes discovery, validation, pilot, and decision gates around five workstreams.

Security Architecture Posture

Illustrative dataLive app

92%

Critical services with standard edge controls

3

High-priority architecture decisions

78%

Store edge policy coverage

24h

Exception review target

Priority architecture findings

Digital ordering APIs: Two legacy endpoints sit outside the standard API discovery and schema validation policy.

Third-party access: Four persistent vendor paths do not enforce device posture or time-bound authorization.

Store edge: Eleven illustrative locations use direct-origin failover that bypasses centralized inspection.

Control coverage by domain

Digital storefront + 7NOW96%Protected

7Rewards + identity92%Protected

Corporate workforce88%Managed

Store edge78%In progress

Third-party access71%Review

Legacy origin paths63%Priority

Generated application query

const posture = await env.SECURITY_GRAPH.assess({
  domains: ["digital", "api", "store-edge", "workforce", "third-party"],
  controls: ["ddos", "waf", "api-security", "zero-trust", "dns"],
  dataMode: "aggregate-only"
});

return render(<SecurityPostureDashboard data={posture} />);

Zero Trust Reference Architecture v1.0

Illustrative draft

Enterprise Zero Trust Reference Architecture

Version 1.0 · Illustrative draft · August 2026 · Owner: Security Architecture & Engineering

1. Purpose

Define a consistent target state for workforce, store, cloud, administrative, and third-party access. The architecture replaces network location as a trust signal with verified identity, device posture, application context, and continuously evaluated policy.

2. Design principles

Authenticate and authorize every access path.
Grant application-level access instead of broad network reachability.
Separate cardholder, store operations, corporate, and vendor trust zones.
Preserve store resiliency without creating unmanaged bypass paths.
Centralize policy evidence while minimizing retained sensitive data.

3. Control decisions

Access path	Target-state decision	Required guardrail	Validation evidence
Store administration	Application-specific access; no inbound administrative VPN	Phishing-resistant MFA, managed device posture, least privilege	Identity and application access logs
Corporate workforce	Identity-aware access and secure web gateway policy	Continuous device and session evaluation	IdP, device, and policy telemetry
Third-party support	Time-bound, approved access to named applications	No standing network access; session recording for privileged work	Approval and session audit trail
CDE operations	Dedicated segmented administrative paths	PCI-scoped controls and explicit service identity	Control mapping and quarterly access review
AI and automation	Service identity, governed egress, and isolated credentials	Gatekeeper-based secrets and approved model endpoints	API inventory, policy decisions, and usage logs

Architecture decision: Local resiliency must be maintained without allowing direct-origin failover to become a permanent inspection bypass.

4. Validation sequence

Inventory critical access paths, define policy and evidence requirements, validate representative store and corporate flows, test failure modes, and use the results as the decision gate for scaled rollout.

90-Day Security Architecture Roadmap

Slide deck

Slide 1 of 4

90-Day Security Architecture Roadmap

From prioritized risk to validated engineering decisions

Slide 2 of 4

Priority workstreams

Workstream	Accountable team	Stage	Progress
DDoS + edge resilience	Network Security	Design	35%
API discovery + protection	Application Security	Pilot	60%
Store network segmentation	Store Technology	Discovery	25%
Third-party access	Identity Engineering	Pilot	50%
AI service governance	Security Architecture	Design	40%

Illustrative portfolio data for demonstration.

Slide 3 of 4

Decision-gate success measures

100%Critical applications mapped

<30sAutomated mitigation target

95%Privileged paths identity-enforced

0Unmanaged public origin target

Slide 4 of 4

90-day execution path

Days 1-30Baseline. Inventory critical paths, normalize ownership, and agree on evidence.

Days 31-60Validate. Test policy, resiliency, and operational workflows with representative traffic.

Days 61-90Pilot. Run production-like use cases, measure outcomes, and close blocking decisions.

DecisionScale gate. Approve target patterns, owners, funding, and phased rollout.

Aggregated source records

System	Scope	Fields used	Permission
Jira	Security Architecture portfolio	Epic, status, team, milestone	Read-only
ServiceNow	Architecture-related changes	Change class, status, service	Read-only
Architecture repository	Open decisions	ADR title, state, review date	Read-only

Planning cadence, reporting definitions, approval policy, audit requirements, and internal controls.

Read-onlyUpdated Aug 2026

Skills

Reusable, governed workflows available across business functions.

Name	Description	Group	Source
meeting-prep	Combine calendar, communications, and approved context into concise briefing material.	General	Enterprise
weekly-report	Compile cross-tool activity, outcomes, risks, and next steps into a weekly summary.	General	Enterprise
incident-response	Draft and update response procedures grounded in approved standards and control mappings.	Security	Enterprise
vendor-assessment	Generate security questionnaires, gather evidence, and summarize third-party risk.	Security	Enterprise
compliance-evidence	Map controls to evidence and prepare review packages for authorized compliance teams.	Security	Enterprise
architecture-review	Build decision-oriented reviews from project, service catalog, and architecture data.	Architecture	Enterprise
change-impact	Map dependencies, affected services, business owners, and implementation risk.	Architecture	Enterprise
api-catalog	Discover, document, and classify approved API endpoints with ownership and health.	Architecture	Enterprise
store-operations-health	Summarize store-system availability, operating exceptions, and support trends.	Operations	Enterprise
supplier-scorecard	Generate supplier performance summaries from delivery, quality, and procurement data.	Operations	Enterprise
runbook-draft	Convert approved procedures and system context into reviewable operating runbooks.	Operations	Enterprise
customer-insights	Analyze approved loyalty and experience trends using aggregated customer measures.	Customer	Enterprise
promotion-analysis	Compare campaign performance, customer response, and operational impact.	Customer	Enterprise
budget-analysis	Compare actuals to plan, explain variances, and forecast period-end outcomes.	Finance	Enterprise
job-posting-draft	Draft role descriptions using approved competencies, templates, and compensation guidance.	HR	Enterprise
onboarding-guide	Create role-based onboarding plans from policy, team context, and access procedures.	HR	Enterprise

Integrations

Illustrative enterprise connections. Gatekeepers isolate credentials, enforce scoped permissions, and log agent actions.

Enterprise systems

M365

Microsoft 365

Mail, calendar, documents, spreadsheets, presentations, and files.

TM

Microsoft Teams

Messages, channels, meetings, and governed collaboration workflows.

J

Jira

Projects, epics, issues, milestones, and delivery status.

C

Confluence

Enterprise knowledge, project spaces, and approved documentation.

SN

ServiceNow

IT services, HR cases, change requests, CMDB, and facilities.

W

Workday

Employee records, organizational structure, payroll, leave, and benefits.

SAP

Finance, supply chain, procurement, inventory, and planning.

SF

Salesforce

Business relationships, service workflows, and approved customer programs.

GH

GitHub

Repositories, pull requests, issues, releases, and engineering metadata.

DB

Snowflake

Governed enterprise data, analytics, and cross-functional reporting.

SIEM

Security analytics

Alerts, summarized events, control telemetry, and security correlation.

BI

Power BI / Tableau

Dashboards, executive reporting, and governed visualization.

MCP servers

Store Operations APImcp://store-operations

Authorized

POS & Paymentsmcp://pos-and-payments

Needs approval

7Rewards Customer Datamcp://loyalty-data

Needs approval

Employee Directorymcp://employee-directory

Authorized

Cloudflare APIhttps://mcp.cloudflare.com/mcp

Authorized