Skip to content
Alpha

This site is an alpha version and is still being developed in the open - your feedback will help us improve it. See the roadmap. Last updated: 14 October 2026.

Version in force: 0.3.0 (6 October 2026).

What's new

Significant changes to guardrails, capabilities and governance. Minor wording changes are visible in the commit history.

October 2026

Version 0.3.0 released

  • Version 0.3.0 includes everything listed above this point: the technology capabilities aligned to TBM, service patterns, simpler navigation, the prototype label on Deliver a service and the files for tools and AI. Its PDF of every guardrail is attached to the release. The banner on every page now shows 0.3.0 as the version in force.

Simpler navigation

  • The top navigation has 7 tabs instead of 11. Rules holds principles, guardrails and non-functional requirements; Reuse holds the handrail and patterns; Topics holds data and security. Every page keeps its address, so links still work.

Patterns: service patterns and solution patterns

  • Reference architectures are now service patterns, in the Patterns section. A service pattern shows the shape of a whole kind of service; a solution pattern solves one recurring problem inside a service. Both are exploratory, early work for discussion, not agreed designs. Old addresses redirect to the new pages.

Technology capabilities aligned to TBM

  • The technology capabilities page now shows Defra's Technology Business Management (TBM) model: 6 level 1 areas and their level 2 capabilities. The full catalogue is maintained by Strategic Architecture.
  • The old TC01 to TC24 capabilities and their strategic, emerging and gap statuses have gone. Guardrails, platforms, reference architectures and the capability mapping now point to level 2 capabilities.

The site has moved to the DEFRA GitHub organisation

  • The site is now at defra.github.io/architecture, and its source at DEFRA/architecture. Old addresses redirect to the same page, including guardrail anchors. See moving to the DEFRA GitHub organisation and ADR 0006.
  • Version 0.2.0 and its PDF stay at their original address, so contracts that cite them remain valid. New contracts should cite releases from DEFRA/architecture.
  • Changes can still be prepared in a fork and proposed to DEFRA/architecture. Only DEFRA/architecture publishes the site and makes releases.

Content style and site design

  • New page: guide for the team - start here to update the site: how it is built, the rules every change follows, which file to edit and what to do when a check fails.
  • New page: site design - how pages are built from data by hooks, the templates, theme tokens, components and interactive tools, for maintainers. A test checks that it describes every hook.
  • New page: content style - the house rules on top of the GOV.UK style guide, how to write a guardrail and a pattern, diagrams and a glossary of the terms this site uses.
  • Pull requests now get prose warnings from Vale (words to avoid, filler words and exclamation marks) and a check that headings are in sentence case. They never block a merge.

How the site is maintained

  • MAINTAINERS.md sets out the roles (names to be confirmed), the two-week triage target, labels, the route for changing a Must (TDA review, then TGB approval), deprecation, releases, a monthly and quarterly review cadence, and the move to the DEFRA GitHub organisation.
  • Code owners are requested for review automatically, and CI now warns about any guardrail not reviewed for more than 12 months.

Services and capabilities

  • New draft page: services and capabilities. It uses the definitions from Defra's six-level service taxonomy - outcomes, whole services and services, products, common business capabilities, components and data - and shows where the business capability model, technology capabilities and Defra on a page fit into it. It also explains where architecture uses words such as capability, platform and "service" differently. Definitions are context-specific and we will keep iterating them with service design and product colleagues.

Draft guardrails for research data and for failures

Three new draft guardrails, for comment. They are Shoulds, so the number of Musts does not change.

All three have evidence for each phase and are in the guardrail backlog as drafts for comment.

User experience in patterns

  • Every architecture pattern now has three sections for designers and researchers: what users see, content to design, and what to test with users. They link to GOV.UK Design System patterns and components where they exist.
  • Written in full for asynchronous submission (reference number, what happens next, how long, delayed processing and duplicate submissions), file upload (the scanning wait, rejected files, and size and type limits up front) and acting on behalf (choosing who you act for, missing permissions, and agent and owner wording), and for the worked example.
  • The other two patterns have the sections with a "To be confirmed" box. The pattern catalogue shows which are written.

Smaller changes

  • New issue forms to propose an architecture pattern, answer an open question and give feedback by role, alongside reporting a content error. The pull request checklist now asks contributors to confirm guardrail ids are unchanged, the changelog is updated, all checks have run and unconfirmed facts are marked "To be confirmed".

  • Where things live now explains what the site, the repository, Issues, the GitHub Project, Discussions and releases are each for, and why guidance never goes in a wiki.

  • Abbreviation tooltips no longer appear inside guardrail ids such as GR-API-05, or next to their own expansion such as "Technical Design Authority (TDA)", where screen readers could read the expansion twice.
  • Raise a decision for review now uses the StrategicEnterpriseArchitecture@defra.gov.uk mailbox instead of the alpha holding address.
  • The question of whether the guardrails apply to Defra's arm's length bodies is now asked once, on the guardrails overview, instead of on each of the 15 area pages. The open questions page lists it once.
  • Getting onto Defra platforms now links GOV.UK Pay's public support page.

Version 0.2.0 released

  • Version 0.2.0 is the first release with a PDF of every guardrail attached, to cite in contracts and assessments. It includes everything listed below. The banner on every page now shows 0.2.0 as the version in force.

Joined up with the Defra Digital Service Manual

The manual covers how to do the job and who to contact; this site covers architecture rules, decisions and evidence. A new page, where things live, sets out the split and lists the matching links between the two, which are now checked automatically.

  • AI guardrails link to the AI digital toolkit at the matching point: GR-AI-01 to the "check if AI is right for your idea" triage, GR-AI-02 to choosing a tool and keeping data safe, GR-AI-07 to AI security, and GR-AI-08 to GR-AI-11 to working with AI agents. The toolkit's AI Capability and Enablement (AICE) team is named.
  • Accessibility, sustainability and forms guardrails link to the matching manual pages, and GR-HOST-01 to the Core Delivery Platform.
  • Getting onto Defra platforms links the Core Delivery Platform onboarding documentation and names the support route for Defra Customer Identity (also known as Defra ID), Defra Forms and the Defra Interactive Map. GOV.UK One Login no longer has its own section, because Defra services use it through Defra Customer Identity.
  • Secure by Design says the authoritative lifecycle requirements are on the DDTS Portfolio Hub, owned by the Defra Security team, and presents this site's phase table as the architecture view of them.
  • The home page describes the DDTS doctrine as draft until the approval status records it as endorsed.
  • Developing architecture at Defra now describes the three areas of architecture: Delivery Architecture in the delivery groups, Technical Architecture in Group Infrastructure and Operations (GIO), and Enterprise Architecture in the CTO Office.
  • Solution design authorities now say how governance fits together: the TGB agrees strategies, the TDA is the technical decision-making authority and grants authority to SDAs, and in an SDA the principal architect is accountable for decisions that align with a roadmap agreed at the TDA, follow the principles and stay within the guardrails.
  • New open questions on how Must exceptions relate to the Delivery Architecture team's exception process, and whether the guardrails apply to off-the-shelf products and data platforms.

Developing architecture at Defra

  • New page: developing architecture at Defra - architecture roles and skills, the Architecture Community and its All Architecture meetups, and how to get involved. Linked from the home page and the architecture team page.

Where architecture decisions are kept

  • Architecture decision records now separate team decisions, kept in each service repository, from Technical Design Authority (TDA) and Technology Governance Board (TGB) decisions, kept in an architecture decision register on the Defra architecture SharePoint site.
  • Raise a decision for review by email, with no GitHub account needed. During alpha the address is a holding address; the real mailbox and the register's address are open questions.
  • ADR 0005 records this decision.

Aligned with the Defra Digital Service Manual

The Defra Digital Service Manual is the place for how to run a service in Defra. This site now links to it rather than repeating or contradicting it, and keeps to architecture.

  • Deliver a service now points to the manual for service assessments, operational service readiness, spend control, governance, and design, research and content.
  • Sign-in (GR-IAM-01) now names Defra Customer Identity (Defra ID), which uses GOV.UK One Login and Government Gateway, instead of presenting One Login as an alternative.
  • Approved technologies (GR-DEV-01) now follow the manual's software development standards and the Tools Radar.
  • AI data (GR-AI-02) now follows the AI digital toolkit's rules on using data with AI.
  • Non-functional requirements point to the service tiers and NFR list owned by business analysis. This site's catalogue is kept for now, with the manual taking precedence.
  • Architecture patterns are now called that, with a pointer to the manual's design patterns. The guardrails page explains that business analysis guardrails are different.
  • Getting onto Defra platforms links each platform to the manual, adds the Defra Interactive Map and corrects CDP support and portal links.
  • Working with architects and the architecture team give the Delivery Architecture team's mailbox.

Fewer Must guardrails

  • There are now 29 Must guardrails, down from 55. A guardrail is a Must only where law or mandatory government policy requires it, it is a baseline security control, or it puts a DDTS doctrine non-negotiable into practice. The other 26 are now Shoulds: still the strong default, but you can depart from them with a recorded reason rather than an exception. We will make guardrails Musts again where feedback and real-world experience show they need to be. See ADR 0004.
  • Alpha now has 18 Musts (was 37) and beta 25 (was 50).

Spend control, investment and technology radars

  • Governance now names the Portfolio Assurance Board (PAB) for spend control and InvestCo for investment approvals.
  • The handrail links to Defra's tools radar of approved software tools, and to the Emerging Technology Radar 2026 and its four themes. Both need a Defra network connection and sign-in.

Working with architects

  • New page: working with architects for service designers, interaction designers, content designers and user researchers - which design decisions are also architecture decisions, when to involve an architect in each phase, what to bring and what architects do in return. Linked from the home page and Deliver a service.
  • The architecture team page now explains the architect's place in a multidisciplinary team.

Who leads each guardrail

  • Every guardrail now names the roles that lead it, using DDaT role names - for example content designers lead Welsh language support, and service designers and user researchers lead human oversight of AI.
  • Guardrails by role: a page for each role, listing its guardrails phase by phase, the patterns that help and when to work with an architect.
  • The guardrail library can now be filtered by role.

Evidence that matches the phase

  • Every Must guardrail now says what to show in each phase: in discovery the intent or constraint identified, in alpha the design or plan, in beta what was built and tested, and in live how it is operated and reviewed - plus what to show for a significant change or when retiring a service. The phase pages and evidence checklists show the evidence for that phase, so alpha no longer asks for a published accessibility statement or the date of the last recovery test.
  • Fewer, better-placed Musts per phase. We re-checked when each Must applies. Discovery now lists 11 Musts (was 13) and alpha 37 (was 45). Beta (50) and live (49) are unchanged.

Automated guardrail checks

  • Check your repository automatically: a GitHub Action that checks a repository against GR-OPEN-02, GR-DEV-08, GR-API-02, GR-OPEN-03, GR-DEV-03, GR-DEV-06 and GR-DEV-09, and writes a report naming each guardrail. Each of those guardrails now names the check as its automated check.
  • Decisions about this site: this site now records its own architecture decisions, following GR-DEV-09.

For the CDIO: versions, approvals and health

Delivery partners

Patterns and a worked example

  • New Patterns section, modelled on the Department for Education's: asynchronous submission with an outbox, acting on behalf of an organisation or holding, file upload with malware scanning, reading from an authoritative source, and publishing open data with metadata. Each lists the guardrails it helps you meet and related Secure by Design artefacts.
  • Worked example: apply for a licence: a fictional service taken through the transactional reference architecture, with C4 context and container diagrams, three sample ADRs and a threat model excerpt.
  • Proposed reference architectures for capabilities Defra does not yet have a strategic solution for: field inspection, incident response and grants and schemes.

Deliver a service

  • New Deliver a service section: one page for each phase - discovery, alpha, beta and live - and for significant change and retiring a service. Each lists the guardrails that apply, the architecture artefacts to produce, the governance touchpoints and the evidence pack to bring to an assessment.
  • Printable evidence checklists for each phase, built from the guardrail metadata so they always match the guardrail library.
  • Getting onto Defra platforms: what the Core Delivery Platform, Defra ID, GOV.UK One Login, Defra Forms, GOV.UK Notify, GOV.UK Pay, the data platform and the API gateway give you, and how to get access. Details we have not confirmed yet are listed on the open questions page.
  • The home page has two new routes: deliver a service, and get onto Defra platforms.

Guardrail metadata

  • Every guardrail now has structured metadata: status (draft, endorsed or deprecated), the phases it applies in, the evidence that shows you meet it, whether it can be checked automatically, the Service Standard, Technology Code of Practice and Secure by Design points it supports, the DDTS doctrine it applies, its owner and when it was last reviewed. Open Phases, evidence and status under any guardrail to see it.
  • The guardrail library can now be filtered by phase and status, and each card shows the evidence and automated check.
  • Guardrail metadata is published as guardrails.json for tools and dashboards.
  • New guardrail GR-DEV-09 Record significant decisions as ADRs. The self-assurance checklist now points to it instead of a principle.
  • New open questions page listing facts that are still to be confirmed.
  • Fixed the guardrails page describing "ten" architecture principles - there are eight.

Traceability, guardrail backlog and standards

  • Doctrine to guardrails: every guardrail page now shows the doctrine and principles it applies, and the Principles page shows coverage, including where guardrails are thin.
  • Guardrail backlog: guardrails we know we are missing, including the agreed Defra on a page.
  • Fixed broken links to the Data Standards Authority, UK GEMINI and the Public Sector Geospatial Agreement. Links are now checked weekly.
  • The repository now follows the Defra software development standards: pinned GitHub Actions, dependency review, grouped Dependabot updates, exact dependency versions, Ruff and neostandard linting.

Alpha and roadmap

  • The site is now marked as alpha, with a phase banner on every page.
  • New roadmap: now, next and later, including an AI architecture facilitator agent (next), AI tools and architecture review automation (later).
  • Technology capabilities are now aligned with the cross-government Digital Technology Capability Model, with links to OCTO's citizen-facing reference architecture, self-assessment and AI enablement tools.
  • Search now treats ids such as GR-HOST-01 and NFR-AVL-01 as single terms, so searching an id finds it first.

DDTS doctrine

  • DDTS doctrine: the CDIO's seven non-negotiables now sit above the architecture principles, with links to the principles and guardrails that apply them.
  • Principles have their own section, showing how doctrine, principles and guardrails fit together.
  • GR-AI-01 now asks teams to consider AI first, in line with the doctrine.
  • Fixed the home page figures displaying incorrectly when the browser had cached an older stylesheet.
  • Technology stack view: technology capabilities shown as layers, inspired by the Local Government Architecture Model.
  • Seek advice, not permission: the advice process is now explicit in governance, and ADRs record the advice sought.
  • Links to the cross-government Secure by Design artefact library, the Local Government Architecture Model and government data architecture guidance.

Principles, NFRs and accessibility

  • Architecture principles now use Defra's eight agreed Strategic Architecture Principles, each linked to the guardrails that put it into practice.
  • Non-functional requirements: new section with service tiers, an NFR catalogue and guidance on writing good NFRs. Targets are draft until confirmed.
  • Accessibility: every page is now checked against WCAG 2.2 AA in light and dark mode on each change. Fixed colour contrast, keyboard access to the home page search, touch target sizes and diagram text alternatives.
  • Draft markers: pages awaiting confirmation now show a "Draft - to be confirmed" banner.

Front door and tools

  • New home page with search, "What do you need to do?" routes, the governance flow, the capability map and links to detailed guidance.
  • Check a decision: an interactive check that suggests a governance route and drafts a decision record.
  • Guardrail library: search and filter every guardrail and principle, built automatically from the guardrail pages.
  • Links to the Defra software development standards for detailed coding practice.

First release

  • New site. First version of the Defra architecture site, published in the open.
  • Guardrails: first set of guardrails across 13 areas, with stable ids and Must/Should/Could levels, and a 10-minute self-assurance checklist.
  • Handrail: Defra business capability model (9 core and 2 supporting capabilities) with draft level 2 capabilities, a technology capability catalogue of 24 capabilities, a capability mapping matrix and three reference architectures. The model is published as machine-readable YAML and JSON.
  • Governance: the three-tier model (TGB, TDA and solution design authorities), triage, ADR guidance, exception process and templates.
  • Data: Defra on a page and data standards.
  • Security: Secure by Design in Defra, threat modelling and managing security exceptions.