Chapter 33. Module Reference: Foundations, Classification, Lifecycles
Modules M1 to M9, each specified to a uniform template. This part is written for reference rather than reading: when you need to know what a module consumes, produces, and depends on, look here; when you need to know how to run it well, follow the cross-reference to the narrative chapter.
33.1 How to read a module entry
TOGAF gives each ADM phase a standard treatment — objectives, approach, inputs, steps, outputs. The module entries below follow the same discipline, adapted to what IRGF actually needs a practitioner to know.
Table 87. How to read a module entry
| Field | What it tells you |
|---|---|
| Purpose | The one thing the module exists to achieve |
| Inputs | What must exist before the module can run |
| Mechanics | The steps, in order |
| Outputs | What the module produces that something else consumes |
| Accountable | The single role answerable for the output |
| Tier variation | How the module changes with risk tier; “none” means it is tier-invariant |
| Depends on / Feeds | Module dependencies, by identifier |
| Failure signal | The observable sign that this module is not working |
| In depth | The narrative chapter that explains how to run it |
Twenty modules are grouped as they appear on the module map. The grouping is a reading aid, not a governance structure: nothing in the framework depends on a module’s group.
33.2 Module map at a glance
Table 88.
| Group | Modules |
|---|---|
| Foundations | M1 Core Model · M2 Architecture Domains · M3 Three Views |
| Classification | M4 Risk Dimensions · M5 Tiering Method · M6 Independent Verification |
| Lifecycles | M7 AI Build Lifecycle · M8 Transformation Lifecycle · M9 Architecture Lifecycle |
| Autonomy | M10 Agent Governance Chain · M11 Autonomy Change Control |
| Continuous Assurance | M12 Control Plane · M13 Drift Taxonomy · M14 Policy- and Evidence-as-Code |
| Operating Model | M15 Two Standing Bodies · M16 Decision Rights and RACI · M17 Escalation and Exceptions |
| Evidence | M18 Primary Records · M19 Derived Views · M20 Reference Pattern Library |
Which modules are load-bearing
Not all twenty carry equal weight. If you are sequencing adoption, three modules determine whether the rest function.
M4 and M5 together produce the tier, and almost every other module reads it. M6 is what makes the tier trustworthy, and the framework’s own review found unverified scoring to be its most confirmed weakness. M18 supplies the approved state that M12 compares against; without trustworthy records the Control Plane produces noise.
The Minimum Viable Framework in Chapter 27 is, in module terms, exactly M4, M5, M6, a reduced M7, and three records from M18.
33.3 Foundations
M1 — Core Model
Table 89.
| Field | Specification |
|---|---|
| Purpose | Provide the minimal entity set through which every governance question is answered, so that one AI system has one connected record rather than fragments in separate functions |
| Inputs | Existing enterprise records: capability model, application portfolio, risk register, decision records |
| Mechanics | 1. Map each of the eight entities to whatever your organization already holds. 2. Identify which have no home, no owner, or no link to an AI system. 3. Establish stable identifiers so entities can reference each other. 4. Close the gaps in dependency order — Decision first, since everything downstream compares against it |
| Outputs | A connected entity set: Intent, Capability, AI System, Decision, Risk, Control, Outcome, Assurance |
| Accountable | Chief Enterprise Architect, or the equivalent architecture lead |
| Tier variation | None. The Core Model is tier-invariant; only the depth of what populates it varies |
| Depends on | Nothing. This is the foundation |
| Feeds | Every other module |
| Failure signal | You cannot answer the seventeen questions in Chapter 1 for a production system without manual reconstruction across three systems |
| In depth | Chapter 2 |
Status caveat. The eight entities are asserted rather than derived. No minimality test has been performed and no expert panel has validated the set. Record any case the model cannot express; those are what a future revision needs.
M2 — Architecture Domains
Table 90.
| Field | Specification |
|---|---|
| Purpose | Establish AI as a first-class architecture domain with real representation, rather than as one more application type folded into Application Architecture |
| Inputs | Existing domain structure and architecture review board composition |
| Mechanics | 1. Add AI as a fifth primary domain alongside Business, Data, Application, Technology. 2. Classify Integration, Platform and Security as cross-cutting disciplines, not peer domains. 3. Add AI architecture expertise to ARB membership as a standing requirement. 4. Apply the boundary test in Chapter 1 §1.3 to settle what the domain governs |
| Outputs | A domain structure with AI represented; an ARB whose mandate covers it |
| Accountable | Chief Enterprise Architect |
| Tier variation | None |
| Depends on | M1 |
| Feeds | M7, M9, M15, M20 |
| Failure signal | AI decisions are reviewed by people who cannot assess them, or are not reviewed at all because no domain claims them |
| In depth | Chapter 1, §1.3 |
The domain’s scope is deliberately bounded: AI Architecture governs the existence, connection, and authority boundary of a component, not its internal construction. Scope creep into model engineering is the most common way this module fails.
M3 — Three Views
Table 91.
| Field | Specification |
|---|---|
| Purpose | Let one metamodel serve three audiences without duplicating facts, by defining where each fact is authored and where it is merely read |
| Inputs | M1 |
| Mechanics | 1. Assign each entity attribute to exactly one authoring view. 2. Establish that the other views reference it. 3. Resist the pull to let a second view re-enter a fact for convenience |
| Outputs | Structural view (what exists), Lifecycle view (where it is in its progression), Control view (whether reality matches the record) |
| Accountable | Chief Enterprise Architect |
| Tier variation | None |
| Depends on | M1 |
| Feeds | M12, M18, M19 |
| Failure signal | The same fact — usually the risk tier — is maintained in two places and they disagree |
| In depth | Chapter 2, §2.4 |
33.4 Classification
M4 — Risk Dimensions
Table 92.
| Field | Specification |
|---|---|
| Purpose | Convert an AI system’s risk into five scored dimensions that a tiering method can act on, using anchors specific enough to be applied consistently |
| Inputs | Use-Case Canvas; architecture intent where known; data classification |
| Mechanics | 1. Convene sponsor, architect, data owner and risk lead. 2. Score D1 through D5 against published anchors, one line of justification each. 3. Record D5’s two sub-scores separately and take the composite as the higher, not the average. 4. Note any score sitting near a threshold |
| Outputs | Five scored dimensions with justifications, in the Risk Classification Record |
| Accountable | Risk and Compliance Lead |
| Tier variation | None — scoring is what determines the tier, so it cannot vary by it |
| Depends on | M1 |
| Feeds | M5, and through it almost everything |
| Failure signal | Justifications are absent or generic; D3 scored on rollback capability; scores cluster just below thresholds |
| In depth | Chapter 6 |
M5 — Tiering Method
Table 93.
| Field | Specification |
|---|---|
| Purpose | Combine five dimensions into a single tier without letting one catastrophic factor be averaged away by four benign ones |
| Inputs | M4 output |
| Mechanics | 1. Impact = average(D1, D4, D5), rounded up. 2. Control Deficit = average(D2, D3), rounded up. 3. Read the tier from the 4×4 matrix. 4. Apply the safety-override floor: D1 = 4, or D2 = 4 with D3 = 4, forces Tier 3 minimum. 5. Record whether the override fired |
| Outputs | A tier, 1 to 4, with the computation shown |
| Accountable | Risk and Compliance Lead |
| Tier variation | Not applicable — this module produces the tier |
| Depends on | M4 |
| Feeds | M7, M10, M12, M15, M16, M18 |
| Failure signal | Tier distribution does not track your incident distribution; almost everything lands at Tier 1 |
| In depth | Chapter 7, §7.1–7.5 |
Known limitation. The override floor catches extremes only. Mid-range judgment calls under delivery pressure remain the framework’s live gaming vector, which is why M6 exists.
M6 — Independent Verification
Table 94.
| Field | Specification |
|---|---|
| Purpose | Make the tier trustworthy by separating the person who scores from the person who is accountable for delivery |
| Inputs | M5 output |
| Mechanics | 1. Route every score to a countersigner independent of delivery. 2. Review justifications, not the whole assessment. 3. Test the two or three scores nearest a threshold. 4. Adjust with a recorded reason, or accept. 5. Separately, sample Tier 1–2 self-certifications quarterly, weighted toward boundary cases |
| Outputs | A countersigned tier; a quarterly sampling rate |
| Accountable | Risk and Compliance Lead, with a countersigner independent of the scoring session |
| Tier variation | Countersignature applies at all tiers. Sampling targets Tier 1–2, since Tier 3–4 receives review anyway |
| Depends on | M5 |
| Feeds | Confidence in every tier-scaled decision |
| Failure signal | Countersignature adjustment rate near zero over a meaningful volume, which means either excellent scoring or a rubber stamp |
| In depth | Chapter 7, §7.6–7.8 |
This is the highest-leverage module in the framework and the one most often dropped during adoption because it costs a person’s time. Dropping it does not remove the cost; it moves the cost to whatever the mis-tiered system eventually does.
33.5 Lifecycles
M7 — AI Build Lifecycle
Table 95.
| Field | Specification |
|---|---|
| Purpose | Govern an AI system from the question of whether to build it through to evidenced decommissioning, with intensity proportional to its tier |
| Inputs | A capability need; M5 tier; M20 pattern library |
| Mechanics | Eleven stages, S0 to S10, with five gates. S0–S1 establish justification. S2 classifies. G1 qualifies. S3–S4 settle architecture and data. G2 assesses both together. S5 builds. S6 assures. G3 authorizes. S7–S8 deploy and monitor continuously. S9 classifies change; G4 re-authorizes. S10 and G5 retire |
| Outputs | A governed AI system with a complete decision and evidence chain |
| Accountable | Varies by stage; see the RACI in Chapter 21 |
| Tier variation | Extensive. Authority, evidence depth and automation eligibility all scale with tier at every gate |
| Depends on | M4, M5, M6, M20 |
| Feeds | M12 (approved state), M18 (records), M10 where the system is agentic |
| Failure signal | Gate lead times do not differ by tier; systems appear in production with no Deployment Authorization Record |
| In depth | Chapters 4 to 15 |
Adoption note. Gate consolidation reduced labeled checkpoints from eleven to five but did not reduce evidentiary burden proportionally. Do not introduce this module as a lighter process; introduce it as a proportionate one.
M8 — Transformation Lifecycle
Table 96.
| Field | Specification |
|---|---|
| Purpose | Connect transformation initiatives to architecture without claiming ownership of transformation delivery |
| Inputs | Strategic objectives; capability records; portfolio pipeline |
| Mechanics | Eight stages, T0 to T7. Architecture contributes mandatory input at T2 (the TG0 checkpoint), supplies the Architecture Input Package at T3, is accountable at T4 where the AI build lifecycle is spawned, and consumes outcome evidence at T6 |
| Outputs | TG0 records; Architecture Input Package; the T4-to-S0 handoff |
| Accountable | Portfolio and PMO, external to this framework, with named architecture inputs |
| Tier variation | Tier 3–4 AI-relevant initiatives require AI Governance Body funding concurrence at T3; everything else is advisory |
| Depends on | M2, M5 |
| Feeds | M7 at T4 |
| Failure signal | Architecture reviewing delivery plans, which means scope has crept; or repository entries with no TG0 record, which means the checkpoint is being bypassed |
| In depth | Chapter 23 |
Governance depth is deliberately non-uniform across this chain: deep at capability, architecture and outcome; shallow at theme, portfolio and delivery. The T5 stage is an external input interface with no architecture role at all.
M9 — Architecture Lifecycle
Table 97.
| Field | Specification |
|---|---|
| Purpose | Turn individual architecture decisions into reusable enterprise practice, so that the second system solving a familiar problem is cheaper to govern than the first |
| Inputs | ADRs from M7’s S3 stage; drift signals from M13 |
| Mechanics | Propose (ADR drafted) → Decide (ARB review, tier-scaled) → Adopt as pattern (promoted to M20 if reusable) → Govern and reuse (Tier 1–2 self-certify against the unmodified pattern) → Deprecate (retirement triggers re-review of dependent systems) |
| Outputs | Ratified patterns; deprecation notices with dependent-system re-reviews |
| Accountable | Architecture Review Board |
| Tier variation | Pattern promotion is tier-invariant; pattern-based self-certification is available at Tier 1–2 only |
| Depends on | M2, M20 |
| Feeds | M20, and through it the fast path in M7 |
| Failure signal | The pattern library has not changed in a year, while novel architectures keep arriving at G2 |
| In depth | Chapter 35 |
This lifecycle was implicit across the framework before being named. It is an organizing device rather than a new governance mechanism, and it is included because pattern maintenance is the activity most often left unowned.