Skip to content
Alpha

This site is an alpha version and is still being developed in the open - your feedback will help us improve it. See the roadmap. Last updated: 14 October 2026.

Version in force: 0.3.0 (6 October 2026).

Roadmap

What we are working on, what comes next and what we are considering. This site is in alpha: we are developing it in the open and it will change as we learn from the teams and partners who use it.

Now Iterate, refine and embed guardrails

Next Capabilities and decisions

  • Refine the business capabilities, agreeing the level 2 capabilities with business owners
  • Map business capabilities to technology capabilities, and to the products and platforms that deliver them
  • Collate architecture decision records from across Defra into a searchable register, so teams can reuse each other's decisions

  • AI architecture facilitator agent: with the team's agreement, an agent joins stand-ups and design conversations to:

    A named person always confirms what is recorded (GR-AI-03), and the trial will have a DPIA and be published as an algorithmic transparency record (GR-AI-04)

Later Proposed

  • Develop the proposed service patterns for field inspection, incident response and grants with the teams who own those capabilities
  • Grow the patterns library, starting with infrastructure patterns
  • Measure how quickly teams get to a decision, and publish the results
  • AI tools: an assistant that answers architecture questions from this site, suggests which guardrails and capabilities apply to a design, and drafts decision records for teams to check
  • Architecture review automation: extend the guardrail check beyond its first seven guardrails - for example hosting and infrastructure as code - so reviews focus on judgement rather than checklists
  • Assess our architecture practice with the cross-government maturity self-assessment, and publish what we will improve
  • Move to beta

Done recently

Guardrail backlog

Work on the roadmap and the backlog is tracked in the repository's GitHub Project - see where things live.

Guardrails we know we are missing, found by tracing each doctrine and principle to the guardrails that put it into practice. Priorities are a starting point for discussion.

Priority Proposed guardrails The gap Doctrine and principle
High Agreed Defra on a page Publish the agreed enterprise data model to replace the draft Defra on a page, with the authoritative source for each entity confirmed 4. Data is an enterprise asset · Principle 4
High Products and platforms - drafted as GR-PROD-01 to 04 Nothing yet says how to build as products: long-lived product teams, product ownership, contributing back to shared platforms, and retiring products 1. Platforms before projects · Principles 1 and 3
High Digital first and end-to-end services - drafted as GR-DIG-01 to 03 No guardrail asks teams to challenge paper processes, design across organisational boundaries or provide assisted digital routes 6. Outcomes over structures, 7. Digital first · Principle 2
High Field working and end-user devices - drafted as GR-FIELD-01 to 04 Principle 8 has almost no guardrails: devices suited to the job, offline-first working, connectivity in remote areas and device security 7. Digital first · Principle 8
High Agentic AI - drafted as GR-AI-08 to 11 AI agents that take actions need extra controls: least-privilege tool access, human approval for consequential actions, audit trails and protection from prompt injection 5. Assume AI · Principles 6 and 7
High Research data - drafted as GR-DATA-10 and 11, draft for comment Research recordings, notes and prototypes hold personal data: consent, approved storage and tools, deletion, DPIA screening and no real data in prototypes. Builds on the manual's user research standards 4. Data is an enterprise asset · Principle 4
High Telling users when things fail or are slow - drafted as GR-FE-07, draft for comment GR-OPS-04 asks services to degrade gracefully, but nothing asks teams to design what users see when they do 7. Digital first · Principle 2
Medium Experimentation and sandboxes How to experiment safely and quickly: sandbox environments, synthetic data, time-boxed prototypes and the route from experiment to production 5. Assume AI · Principle 7
Medium Low-code and Power Platform Environment strategy, application lifecycle, data loss prevention and support for low-code solutions built outside delivery teams 3. Reuse before buy · Principle 3
Medium Resilience and continuity Business continuity and disaster recovery beyond hosting: dependency mapping, exercising and recovery testing by service tier 2. Standards before exceptions · Principles 1 and 6
Medium Cost management (FinOps) Tagging, budgets and alerts, showing cost per service and per business capability 3. Reuse before buy · Principle 3
Medium Legacy and technical debt A debt register, time-bound exceptions for legacy, and plans to retire systems and archive their data 1. Platforms before projects · Principle 3
Medium Domains, email and web security GOV.UK domain rules, email security (DMARC), cookies and privacy notices 2. Standards before exceptions · Principle 6
Low Networks and zero trust Connectivity between Defra group bodies, partners and clouds, moving to zero trust access 2. Standards before exceptions · Principle 6
Low Mobile apps When a native app is justified rather than a responsive web service 7. Digital first · Principle 2

Want to take one on, or think something is missing? Propose a guardrail.

Shape the roadmap

Tell us what would help you most. Open an issue, comment on an existing one, or raise it with your solution design authority. Significant changes are recorded in what's new.