Open questions

Facts this site needs but that are not yet confirmed - names, contacts, lead times and approvals. We would rather show a gap than guess.

Each question links to the "To be confirmed" box on the page where it is needed. If you know the answer, open an issue or select Edit this page on that page and replace the box with the fact.

This list is built from the pages each time the site is published.

37 open questions on 26 pages.

Approval status

• which board approved each endorsed section and when, and the route and timetable for endorsing the sections still in draft.

Developing architecture at Defra

• how often the All Architecture meetups run, how to join them and the Architecture Community's collaboration channel.
• learning routes and pathways into architecture at Defra, such as mentoring, shadowing, apprenticeships and training budgets, and who to contact about them.

Moving to the DEFRA GitHub organisation

• which Defra team owns the repository and reviews changes (for .github/CODEOWNERS), and whether the site moves to a Defra-owned custom domain at beta.

Updating the Defra architecture site: a guide for the team

• the names of the content designer, guardrail area owners and lead maintainer.

Where things live

• turn on Issues and Discussions for the repository, switch off the wiki, create the GitHub Project for the roadmap, and add their addresses here and on the roadmap.
• whether the Defra Digital Service Manual will link back to this site at the matching points, and who owns that change in the manual.

Getting onto Defra platforms

• Defra Core Delivery Platform (CDP): lead time.
• Defra Customer Identity (also known as Defra ID or IDMv2): lead time.
• Defra Forms: how to request access and lead time.
• GOV.UK Notify: lead time.
• GOV.UK Pay: lead time.
• Defra strategic data platform: how to request access, lead time, support and documentation.
• Platform API gateway and messaging: lead time, support and documentation.

Working with architects

• when and where the architecture drop-in sessions run, and how designers and researchers book them.

Architecture decision records

• the address of the architecture decision register on the Defra architecture SharePoint site, who can read it, and who owns it.
• the Power Automate flow that adds emailed decisions to the register, who owns it, and how long triage takes.

Exception register

• whether Defra will publish its exception register in the open, which exceptions are recorded here (for example Must guardrails only), and how security exceptions are kept out of the public register.

Exceptions to guardrails

• how an exception to a Must guardrail agreed at the Technical Design Authority relates to the Delivery Architecture team's exception process for the software development standards - whether one request can cover both, and which comes first.

Guardrails

• which guardrails apply to commercial off-the-shelf products and to data and reporting platforms. The architecture guidance in the Defra Digital Service Manual says it may not apply to deploying commercial off-the-shelf software or building a data or reporting platform.
• whether the guardrails apply to Defra's arm's length bodies as well as the core department, and any differences by area. Each area page links here until its applicability is confirmed; record the answer in that page's applicability front matter.

Capability mapping

• Strategic Architecture to review this mapping. It was converted from the earlier technology capability model to the TBM level 2 capabilities and is a first draft. Some columns combine several earlier capabilities, so they may show more dots than they should.

Reference architecture

• the scope of the reference architecture, who owns it and when it will be published.

Services and capabilities

• whether a later version of the service taxonomy has replaced version 2 (published July 2025), and whether the service strategy, ownership and performance team is content for this site to use its definitions as quoted here.

Contracting with this site

• confirm with Defra commercial and legal teams that the model clauses on this page can be used in Defra contracts, and in which frameworks.
• the notice period Defra gives before a new Must applies to new work, and how it is communicated to suppliers.

Handover and exit

• Defra's standard overlap period for supplier transitions, and who signs off that handover is complete.

Mobilisation checklist

• typical lead times for security clearance, Defra devices and accounts, GitHub organisation access and Core Delivery Platform access, and who arranges each.

Working with other suppliers

• Defra's incident management process and tools for digital services, and how suppliers are given access to them.

Acting on behalf

• whether relationships to land holdings, as well as organisations, come from Defra Customer Identity, and how services should query it.

Authoritative source

• what users see when data from the authoritative source is out of date or unavailable, the content for those situations, and what to test with users. Write these three sections with a designer and a user researcher.

File upload and scanning

• whether the Core Delivery Platform provides a shared file upload and malware scanning service, and how teams use it.

Publishing open data

• what users of the published data see, such as the dataset page, licence and update dates, the content for them, and what to test with users. Write these three sections with a designer and a user researcher.

Field inspection

• whether Defra intends to buy a field inspection product or build shared components, and which team owns the capability.

Grants and schemes

• which reusable grants components exist on the Core Delivery Platform, who owns them, and how a new scheme team starts using them.

Incident response

• which incident types are in scope for a shared capability, and which team owns incident and emergency management technology.

Secure by Design

• reconcile this phase table with the Secure by Design lifecycle requirements on the DDTS Portfolio Hub, and record any differences.