I · Module reference

Chapter 33. Module Reference: Foundations, Classification, Lifecycles

Modules M1 to M9, each specified to a uniform template. This part is written for reference rather than reading: when you need to know what a module consumes, produces, and depends on, look here; when you need to know how to run it well, follow the cross-reference to the narrative chapter.


33.1 How to read a module entry

TOGAF gives each ADM phase a standard treatment — objectives, approach, inputs, steps, outputs. The module entries below follow the same discipline, adapted to what IRGF actually needs a practitioner to know.

Table 87. How to read a module entry

Field What it tells you
Purpose The one thing the module exists to achieve
Inputs What must exist before the module can run
Mechanics The steps, in order
Outputs What the module produces that something else consumes
Accountable The single role answerable for the output
Tier variation How the module changes with risk tier; “none” means it is tier-invariant
Depends on / Feeds Module dependencies, by identifier
Failure signal The observable sign that this module is not working
In depth The narrative chapter that explains how to run it
The IRGF module map: twenty modules in seven groups, and what each depends on
Figure 7. The IRGF module map: twenty modules in seven groups, and what each depends on

Twenty modules are grouped as they appear on the module map. The grouping is a reading aid, not a governance structure: nothing in the framework depends on a module’s group.

33.2 Module map at a glance

Table 88.

Group Modules
Foundations M1 Core Model · M2 Architecture Domains · M3 Three Views
Classification M4 Risk Dimensions · M5 Tiering Method · M6 Independent Verification
Lifecycles M7 AI Build Lifecycle · M8 Transformation Lifecycle · M9 Architecture Lifecycle
Autonomy M10 Agent Governance Chain · M11 Autonomy Change Control
Continuous Assurance M12 Control Plane · M13 Drift Taxonomy · M14 Policy- and Evidence-as-Code
Operating Model M15 Two Standing Bodies · M16 Decision Rights and RACI · M17 Escalation and Exceptions
Evidence M18 Primary Records · M19 Derived Views · M20 Reference Pattern Library

Which modules are load-bearing

Not all twenty carry equal weight. If you are sequencing adoption, three modules determine whether the rest function.

M4 and M5 together produce the tier, and almost every other module reads it. M6 is what makes the tier trustworthy, and the framework’s own review found unverified scoring to be its most confirmed weakness. M18 supplies the approved state that M12 compares against; without trustworthy records the Control Plane produces noise.

The Minimum Viable Framework in Chapter 27 is, in module terms, exactly M4, M5, M6, a reduced M7, and three records from M18.


33.3 Foundations

M1 — Core Model

Table 89.

Field Specification
Purpose Provide the minimal entity set through which every governance question is answered, so that one AI system has one connected record rather than fragments in separate functions
Inputs Existing enterprise records: capability model, application portfolio, risk register, decision records
Mechanics 1. Map each of the eight entities to whatever your organization already holds. 2. Identify which have no home, no owner, or no link to an AI system. 3. Establish stable identifiers so entities can reference each other. 4. Close the gaps in dependency order — Decision first, since everything downstream compares against it
Outputs A connected entity set: Intent, Capability, AI System, Decision, Risk, Control, Outcome, Assurance
Accountable Chief Enterprise Architect, or the equivalent architecture lead
Tier variation None. The Core Model is tier-invariant; only the depth of what populates it varies
Depends on Nothing. This is the foundation
Feeds Every other module
Failure signal You cannot answer the seventeen questions in Chapter 1 for a production system without manual reconstruction across three systems
In depth Chapter 2

Status caveat. The eight entities are asserted rather than derived. No minimality test has been performed and no expert panel has validated the set. Record any case the model cannot express; those are what a future revision needs.

M2 — Architecture Domains

Table 90.

Field Specification
Purpose Establish AI as a first-class architecture domain with real representation, rather than as one more application type folded into Application Architecture
Inputs Existing domain structure and architecture review board composition
Mechanics 1. Add AI as a fifth primary domain alongside Business, Data, Application, Technology. 2. Classify Integration, Platform and Security as cross-cutting disciplines, not peer domains. 3. Add AI architecture expertise to ARB membership as a standing requirement. 4. Apply the boundary test in Chapter 1 §1.3 to settle what the domain governs
Outputs A domain structure with AI represented; an ARB whose mandate covers it
Accountable Chief Enterprise Architect
Tier variation None
Depends on M1
Feeds M7, M9, M15, M20
Failure signal AI decisions are reviewed by people who cannot assess them, or are not reviewed at all because no domain claims them
In depth Chapter 1, §1.3

The domain’s scope is deliberately bounded: AI Architecture governs the existence, connection, and authority boundary of a component, not its internal construction. Scope creep into model engineering is the most common way this module fails.

M3 — Three Views

Table 91.

Field Specification
Purpose Let one metamodel serve three audiences without duplicating facts, by defining where each fact is authored and where it is merely read
Inputs M1
Mechanics 1. Assign each entity attribute to exactly one authoring view. 2. Establish that the other views reference it. 3. Resist the pull to let a second view re-enter a fact for convenience
Outputs Structural view (what exists), Lifecycle view (where it is in its progression), Control view (whether reality matches the record)
Accountable Chief Enterprise Architect
Tier variation None
Depends on M1
Feeds M12, M18, M19
Failure signal The same fact — usually the risk tier — is maintained in two places and they disagree
In depth Chapter 2, §2.4

33.4 Classification

M4 — Risk Dimensions

Table 92.

Field Specification
Purpose Convert an AI system’s risk into five scored dimensions that a tiering method can act on, using anchors specific enough to be applied consistently
Inputs Use-Case Canvas; architecture intent where known; data classification
Mechanics 1. Convene sponsor, architect, data owner and risk lead. 2. Score D1 through D5 against published anchors, one line of justification each. 3. Record D5’s two sub-scores separately and take the composite as the higher, not the average. 4. Note any score sitting near a threshold
Outputs Five scored dimensions with justifications, in the Risk Classification Record
Accountable Risk and Compliance Lead
Tier variation None — scoring is what determines the tier, so it cannot vary by it
Depends on M1
Feeds M5, and through it almost everything
Failure signal Justifications are absent or generic; D3 scored on rollback capability; scores cluster just below thresholds
In depth Chapter 6

M5 — Tiering Method

Table 93.

Field Specification
Purpose Combine five dimensions into a single tier without letting one catastrophic factor be averaged away by four benign ones
Inputs M4 output
Mechanics 1. Impact = average(D1, D4, D5), rounded up. 2. Control Deficit = average(D2, D3), rounded up. 3. Read the tier from the 4×4 matrix. 4. Apply the safety-override floor: D1 = 4, or D2 = 4 with D3 = 4, forces Tier 3 minimum. 5. Record whether the override fired
Outputs A tier, 1 to 4, with the computation shown
Accountable Risk and Compliance Lead
Tier variation Not applicable — this module produces the tier
Depends on M4
Feeds M7, M10, M12, M15, M16, M18
Failure signal Tier distribution does not track your incident distribution; almost everything lands at Tier 1
In depth Chapter 7, §7.1–7.5

Known limitation. The override floor catches extremes only. Mid-range judgment calls under delivery pressure remain the framework’s live gaming vector, which is why M6 exists.

M6 — Independent Verification

Table 94.

Field Specification
Purpose Make the tier trustworthy by separating the person who scores from the person who is accountable for delivery
Inputs M5 output
Mechanics 1. Route every score to a countersigner independent of delivery. 2. Review justifications, not the whole assessment. 3. Test the two or three scores nearest a threshold. 4. Adjust with a recorded reason, or accept. 5. Separately, sample Tier 1–2 self-certifications quarterly, weighted toward boundary cases
Outputs A countersigned tier; a quarterly sampling rate
Accountable Risk and Compliance Lead, with a countersigner independent of the scoring session
Tier variation Countersignature applies at all tiers. Sampling targets Tier 1–2, since Tier 3–4 receives review anyway
Depends on M5
Feeds Confidence in every tier-scaled decision
Failure signal Countersignature adjustment rate near zero over a meaningful volume, which means either excellent scoring or a rubber stamp
In depth Chapter 7, §7.6–7.8

This is the highest-leverage module in the framework and the one most often dropped during adoption because it costs a person’s time. Dropping it does not remove the cost; it moves the cost to whatever the mis-tiered system eventually does.


33.5 Lifecycles

M7 — AI Build Lifecycle

Table 95.

Field Specification
Purpose Govern an AI system from the question of whether to build it through to evidenced decommissioning, with intensity proportional to its tier
Inputs A capability need; M5 tier; M20 pattern library
Mechanics Eleven stages, S0 to S10, with five gates. S0–S1 establish justification. S2 classifies. G1 qualifies. S3–S4 settle architecture and data. G2 assesses both together. S5 builds. S6 assures. G3 authorizes. S7–S8 deploy and monitor continuously. S9 classifies change; G4 re-authorizes. S10 and G5 retire
Outputs A governed AI system with a complete decision and evidence chain
Accountable Varies by stage; see the RACI in Chapter 21
Tier variation Extensive. Authority, evidence depth and automation eligibility all scale with tier at every gate
Depends on M4, M5, M6, M20
Feeds M12 (approved state), M18 (records), M10 where the system is agentic
Failure signal Gate lead times do not differ by tier; systems appear in production with no Deployment Authorization Record
In depth Chapters 4 to 15

Adoption note. Gate consolidation reduced labeled checkpoints from eleven to five but did not reduce evidentiary burden proportionally. Do not introduce this module as a lighter process; introduce it as a proportionate one.

M8 — Transformation Lifecycle

Table 96.

Field Specification
Purpose Connect transformation initiatives to architecture without claiming ownership of transformation delivery
Inputs Strategic objectives; capability records; portfolio pipeline
Mechanics Eight stages, T0 to T7. Architecture contributes mandatory input at T2 (the TG0 checkpoint), supplies the Architecture Input Package at T3, is accountable at T4 where the AI build lifecycle is spawned, and consumes outcome evidence at T6
Outputs TG0 records; Architecture Input Package; the T4-to-S0 handoff
Accountable Portfolio and PMO, external to this framework, with named architecture inputs
Tier variation Tier 3–4 AI-relevant initiatives require AI Governance Body funding concurrence at T3; everything else is advisory
Depends on M2, M5
Feeds M7 at T4
Failure signal Architecture reviewing delivery plans, which means scope has crept; or repository entries with no TG0 record, which means the checkpoint is being bypassed
In depth Chapter 23

Governance depth is deliberately non-uniform across this chain: deep at capability, architecture and outcome; shallow at theme, portfolio and delivery. The T5 stage is an external input interface with no architecture role at all.

M9 — Architecture Lifecycle

Table 97.

Field Specification
Purpose Turn individual architecture decisions into reusable enterprise practice, so that the second system solving a familiar problem is cheaper to govern than the first
Inputs ADRs from M7’s S3 stage; drift signals from M13
Mechanics Propose (ADR drafted) → Decide (ARB review, tier-scaled) → Adopt as pattern (promoted to M20 if reusable) → Govern and reuse (Tier 1–2 self-certify against the unmodified pattern) → Deprecate (retirement triggers re-review of dependent systems)
Outputs Ratified patterns; deprecation notices with dependent-system re-reviews
Accountable Architecture Review Board
Tier variation Pattern promotion is tier-invariant; pattern-based self-certification is available at Tier 1–2 only
Depends on M2, M20
Feeds M20, and through it the fast path in M7
Failure signal The pattern library has not changed in a year, while novel architectures keep arriving at G2
In depth Chapter 35

This lifecycle was implicit across the framework before being named. It is an organizing device rather than a new governance mechanism, and it is included because pattern maintenance is the activity most often left unowned.