Most Data Architects Work in 2D.
PRISM Works in Three Dimensions.

A five-layer deterministic framework for enterprise architecture assessment, integration mapping, and migration planning. Built across real engagements — not adapted from a textbook.

Start a Conversation →See the Methodology
0
Years Experience
0
Projects Delivered
0
Deterministic Rules
// The Problem

Most Data Architecture Work Is Two-Dimensional.

Structure without risk.

A diagram lists what exists. It cannot tell you which integrations will break, what the impact costs, or in what order to cut things over.

Detail without judgement.

Adding more lines and labels to a 2D map does not change the questions it can answer. The gap is methodology, not effort.

Commitment without evidence.

A programme commits to a sequence it cannot execute. A cutover discovers three undocumented systems depend on the one being retired. A financial integration drops records silently.

// The consequence

A PRISM assessment delivered before programme planning begins is not a cost. It is the document that prevents the programme from committing to a plan that cannot be executed.

The cost of getting this wrong is not a failed sprint. It is an AI component that modifies production data without a review gate because nobody asked whether one existed. It is a financial integration that drops records silently because nobody defined what happens when it fails.

// What PRISM Actually Does

The Answer to Every Question a Diagram Cannot.

Five layers. Five pipeline zones. Fifty deterministic rules. The same input always produces the same output.

No error goes unhandled.

Every integration must define its failure disposition, escalation threshold, escalation owner, and recovery procedure. An integration without this documentation does not pass the assurance gate.

No AI output is acted upon without human authorisation.

AI generates, analyses, and recommends. Humans decide, approve, and execute. Without exception — regardless of how sophisticated the AI system is or how urgent the use case feels.

No system is trusted by default.

Zero Trust: every access request is authenticated, authorised, and continuously validated. Every integration authenticates explicitly. Every data asset is classified. Every access event is logged.

What a standard architecture review does not produce:

Error handling specification for every integration — failure disposition, escalation threshold, escalation owner, and recovery procedure
AI governance assessment for every AI component — human review gate status, action scope definition, drift monitoring, evaluation strategy
Endpoint security registry — every API endpoint assessed for authentication, encryption, input validation, rate limiting, and credential handling
Blast radius analysis — what breaks downstream AND what breaks upstream, to depth three, severity-rated
Data contracts — versioned schema agreements between every producer and consumer, with SLA obligations and validation rules
Operational runbooks for high-risk integrations — failure modes, diagnostic steps, escalation path, recovery procedure
Testing specifications per integration — acceptance criteria, data validation tests, performance thresholds, rollback triggers
Accepted risk log — every gap that cannot be resolved before go-live is formally owned, documented, and reviewed on a defined schedule
// Who This Is For

You Have Been Handed a Complex Engagement. You Need a System.

A migration, a replacement, an estate nobody fully understands. The risk is in the architecture — find it, quantify it, present it.

Data architects on enterprise migrations

Programmes with 40–100 integrations, many undocumented, several carrying PII or financial data. PRISM finds them before the cutover.

Integration architects on platform replacements

Which integrations change, stay, or retire — classified by risk, documented with error handling, and sequenced for cutover.

Technical consultants assessing data estates

Ungoverned AI components, undocumented security gaps, endpoints not reviewed in years. Fifty rules produce a findings report on day one.

Programme leads and CTOs

A quantified risk score, a priority action list, and a phased migration plan you can take to the steering committee. Not a whiteboard diagram.

// The Methodology

Three Dimensions. One Assessment.

Where a 2D diagram shows you what you have, PRISM shows you what it means. Five layers. Five zones. Fifty rules. One complete assessment.

1

System Landscape

What exists. Every system catalogued by category and zone.

Input
Transform
Loop
Output
Interface
2

Change Impact

What moves, what breaks, what stays. 50 deterministic rules across 5 groups.

Payment creditChange
Gateway verifyNo Change
Daily file transferAutomation
Identity callbackChange
3

Architecture Health

What is missing, what is fragile, what should be automated.

Automation gapHigh
Endpoint auth gapHigh
AI human-gatingHigh
Logging coverageMedium

The Five Pipeline Zones

Where data sits in the flow. Refracted from a single beam into five distinct zones.

Z1
Input
Data enters the system
Web apps · payment gateways · identity providers
Z2
Transform
Processed and routed
APIs · middleware · core platforms
Z3
Loop
Intelligence feeds back
Analytics · AI/ML · monitoring
Z4
Output
Results delivered
Reports · notifications · exports
Z5
Interface
Data reaches users
Dashboards · reports · alerts

The Five Data Layers

The role data plays at each stage. A second independent dimension that runs across the zones.

L1
Generation
Data is created
Source systems · events · IoT · user actions
L2
Movement
Data is transported
Pipelines · ETL · messaging · file transfers
L3
Operational
Data is in active use
Transactional databases · operational stores
L4
Processing
Data is transformed
Bronze-Silver-Gold · analytics engines · ML
L5
Consumption
Data is delivered
Reports · dashboards · downstream systems

Every system is classified by both a zone and a data layer — two independent dimensions that together define its role in the architecture.

What Each Layer Produces

L1

Platform Assessment

Systems registry: every platform catalogued by category, zone, data layer, API capability, status, and ownership. AI systems carry governance fields — human review gate, action scope, evaluation strategy, rollback capability.

L2

Risk Classification

Risk-scored integration register. Each integration gets a change type (Change / No Change / Retired / TBD), a complexity rating, and a contribution to the 0–100 migration risk score weighted across complexity, PII, financial risk, automation gaps, and TBD items.

L3

Integration Mapping

Interface specs, data contracts, error handling, and the endpoint registry. Blast radius analysis downstream and upstream to depth three. Compliance mapping across PCI-DSS, GDPR, SOX, HIPAA, ISO 27001 and others.

L4

Systems Analysis

Architecture health report against 50 rules covering change impact, platform governance, automation, AI governance, observability, security, and endpoint security. Every finding severity-rated with remediation guidance.

L5

Migration Planning

Phased sequencing, testing specs per integration, runbooks for high-risk integrations, RTO/RPO profiles, cost summary, decision log, accepted risk log. Output split: executive summary for the board, full technical spec for delivery.

// The Rules Engine

50 Rules Across 9 Groups.

Rule 37 fires on every PII or financial integration without encryption in transit, every time, regardless of who runs the assessment. That is the difference between an opinion-based review and a rules-based assessment.

10Integration Assessment
+
01

System replacement

A system is being directly replaced by another system in the target architecture. Triggers change impact and cutover sequencing analysis.

02

Dual replacement

Two source systems are being consolidated into a single target. Migration must reconcile both feeds and prove parity before cutover.

03

Manual process detection

An integration relies on a manual or file-based process rather than an automated data flow. Flagged for automation in the migration plan.

04

PII data

An integration carries personally identifiable information. Requires elevated handling controls, encryption in transit, and compliance mapping.

05

Financial transaction

An integration carries financial data. Triggers parallel run, reconciliation requirements, and Phase 1 migration sequencing.

06

Real-time with replacement

A real-time integration sits on a system being replaced. Cutover risk is high and sequencing must protect the live flow.

07

Multiple targets

A single source distributes to multiple targets. Change impact propagates further and must be traced through every downstream consumer.

08

External-to-external

An integration runs between two external systems with no internal hand-off point. Limited visibility, limited control during migration.

09

Middleware retained

Middleware is being retained while connected systems change. Schema and contract assumptions on the middleware must be re-verified.

10

System retirement

A system is being retired. All downstream consumers must be redirected or stood down before the source can be decommissioned.

4Platform Governance
+
11

Single source of truth

Data of the same kind lives in multiple systems with no designated authoritative source. Reconciliation drift is inevitable until ownership is assigned.

12

Right-sizing

An enterprise-grade platform is in use for a workload that does not require it, or a simpler platform is straining under enterprise load. Architecture cost-fit is wrong.

18

Medallion architecture

A data pipeline does not follow the Bronze, Silver, Gold layering pattern. Raw, cleaned, and modelled data are not separated and lineage cannot be traced.

26

Uncosted enterprise platform

An enterprise platform is in use without documented commercial justification for the chosen tier. Spend has not been mapped to delivered value.

3Automation & Quality
+
13

Automation gap

A workflow that should be automated is being performed manually at scale. Error rate, cost, and recovery time all suffer.

17

Process consolidation

Multiple redundant processes perform the same function across the organisation. Consolidation reduces surface area and operational cost.

22

High-volume manual process

A manual process operates at a volume where human error becomes statistically inevitable. Automation is no longer optional.

6AI Governance
+
14

AI usage audit

AI Agent or AI/ML Component systems are present in the landscape. Every AI component must be enumerated and assessed against the governance rules that follow.

31

No human review gate on AI component

An AI Agent or AI/ML Component is present without a technically enforced human review gate. Policy documentation alone does not satisfy this rule — the gate must be in code.

32

AI agent without action scope definition

An AI Agent has no documented boundary on what actions it can take at runtime. An agent with no scope has no technical constraint on what it can do.

33

AI component without drift monitoring

An AI Agent or AI/ML Component has no audit logging enabled. Without monitoring, model drift cannot be detected until it causes an incident.

34

Runtime AI on structured integration

An integration calls an AI API at runtime against structured data sources. Structured data does not require probabilistic interpretation — deterministic code is more reliable.

45

AI output evaluation strategy absent

An AI Agent or AI/ML Component has no documented evaluation strategy. May use AI-as-a-judge, human evaluation, automated metrics, or a combination — but it cannot use nothing.

3Observability & Resilience
+
15

Feedback loop coverage

A pipeline lacks a Loop-zone component that returns operational signal back into the system. Without feedback, anomalies pass unnoticed.

16

Logging coverage

A system or integration is not emitting operational logs sufficient for diagnosis or audit. When it breaks, there is nothing to investigate from.

21

Bidirectional dependency

Two systems write to and read from each other, creating cyclic data flows. Change impact and ordering analysis become non-trivial.

3Migration & Compliance Risk
+
19

Regulatory risk

An integration carries data under a regulatory regime (PCI-DSS, GDPR, SOX, HIPAA, ISO 27001) without documented compliance controls.

20

Cutover sequencing risk

The migration sequence places a dependent system ahead of its source, risking cascading failure at cutover. The order must be re-derived from the dependency graph.

23

Data layer gap

A system has no assigned data layer or sits between two layers without a defined hand-off. Its role in the architecture is ambiguous.

10Security
+
35

MFA not documented

A system has no documented multi-factor authentication policy for its administrative interface. Account takeover risk is unconstrained.

36

Undocumented service account

A service account is in use without documented purpose, owner, or rotation policy. When credentials need to change, no one knows what breaks.

37

Sensitive data without encryption in transit

A PII or financial integration transmits data without encryption in transit. Interception during transport is a credible compromise vector.

38

Sensitive data without encryption at rest

A system storing PII or financial data has no documented encryption at rest. A storage compromise yields data directly.

39

Missing access controls documentation

A system has no documented access control model. Who can do what is undefined, which means it cannot be audited.

40

Patch status undocumented

A system's patch level or update cadence is not documented. Known-vulnerability exposure cannot be assessed.

41

No audit trail on sensitive system

A system holding PII or financial data has no audit trail for access or modification events. Incident reconstruction is impossible after the fact.

42

Backup not documented for critical system

A system classified as Critical has no documented backup strategy. Recovery from a destructive event is unbounded.

43

Backup RTO-RPO gap

A system's backup configuration cannot meet its declared Recovery Time and Recovery Point Objectives. The DR plan does not match the technical reality.

44

Data retention policy absent

A system holding regulated data has no documented retention policy. Compliance posture cannot be demonstrated.

6Architecture Health
+
24

Data contract gap

An integration carries structured data without a versioned schema agreement between producer and consumer. A schema change anywhere breaks the chain.

25

Missing runbook

An integration has no operational runbook covering normal operation, failure modes, diagnostics, escalation, and recovery. Operations is flying blind.

27

No RTO on high-risk integration

A high-risk integration has no defined Recovery Time Objective. The cost of downtime has not been quantified against the cost of resilience.

28

No RTO on critical classification

A system classified as Critical for DR has no defined RTO. The classification is decorative without the target.

29

Error handling gap

An integration has no documented failure disposition — what happens when it fails is undefined. Silent drop, retry, escalation: none of it is specified.

30

Silent drop on sensitive integration

A PII or financial integration has a failure mode that silently discards records. Reconciliation will eventually expose the loss, but only long after the fact.

5Endpoint Security
+
46

Endpoint without authentication

An API endpoint exposes functionality without an authentication scheme (SEC.AUTH.NONE.HIGH).

47

Endpoint transmitting sensitive data without encryption

An API endpoint transmits PII or financial data over an unencrypted channel (SEC.TRANSPORT.HTTP.HIGH).

48

Endpoint without input validation

An API endpoint accepts input without a documented validation schema (SEC.SPEC.NOSECURITY.MEDIUM). Injection and malformed payload risks are not contained.

49

Credential passed in query parameter

An API endpoint accepts credentials in the URL query string, exposing them in server logs, browser history, and referrer headers.

50

Endpoint not reviewed in 12 months

An API endpoint has not been security-reviewed within the last twelve months. Drift between code and documented behaviour is likely.

// How It Works

Five Steps to a Complete Assessment.

1

Intake

Client name, size, engagement type, primary objective. Five questions that frame the entire assessment.

2

Discover

Every system in the landscape registered with its category, zone, API status, and replacement status.

3

Map

Every integration between systems defined: method, frequency, PII, financial flags, error handling disposition, and indirect dependencies. API endpoints registered and security-assessed per system.

4

Assess

50 deterministic rules fire automatically across change impact, architecture health, AI governance, cybersecurity, and endpoint security. Every finding ranked by severity with remediation guidance.

5

Deliver

Professional PDF report with executive summary, integration assessment, migration roadmap, and supplementary sections covering AI governance and security compliance. Suitable for programme boards and executive stakeholders.

// Beyond the Assessment

Assessment is Step One. Migration Planning is Step Two.

Most reviews stop at the assessment. PRISM produces the full planning toolkit — phased roadmap, risk scoring, dependency analysis, runbooks, endpoint registry, AI governance, and compliance mapping. All deterministic. All auditable.

Migration Risk Score

0High/ 100
LowMediumHighCritical
21/30
Complexity
12/15
PII Risk
14/15
Financial
6/10
Manual

A single number your steering committee can act on — weighted across complexity, PII exposure, financial risk, automation gaps, and architecture health.

Phased Migration Roadmap

P1
Core User Flows17
P2
Operational Files22
P3
Analytics9
⚠ Dependency warning: 2 Phase 1 integrations depend on systems with Phase 3 changes. Consider resequencing.

Architecture Diagram

Five-zone swim lane, current and future state side by side.

Blast Radius Analysis

Select any system; see exactly what breaks during cutover. BFS traversal, 3 levels deep, severity-rated.

RACI Matrix

Auto-generated from system ownership. Named R, A, C, I per integration.

Cutover Runbook

Sequenced by criticality with pre/post validation and rollback triggers for every integration.

Compliance Mapping

Every integration tagged by GDPR, PCI-DSS, SOX, HIPAA with exposure per framework.

Testing Checklist

Deterministic test requirements per integration. Exportable as PDF.

Error Handling Framework

Failure disposition, escalation threshold, escalation owner, and recovery procedure per integration.

Endpoint Security Registry

Every API endpoint assessed for authentication, encryption, input validation, rate limiting, and credential handling.

Governance Reporting (SUPP A + B)

SUPP A: AI governance for every AI component and autonomous agent. SUPP B: cybersecurity posture mapped to the ACSC Essential Eight.

// The Playbooks

Four Playbooks. One Consistent Standard.

Every rule traces to one of four documented playbooks. Not a consultant's opinion.

AI & Automation Governance Playbook

Deterministic first, AI second. Every AI component has a human review gate. Every AI agent defines its action scope. Six rules fire against AI systems.

Human review gatesDrift monitoringAudit loggingRollback capability

Cybersecurity Playbook

Zero Trust across eight security domains. Governs Rules 35–50 covering identity, encryption, patching, logging, backup, access, and the endpoint security registry. Mapped to the ACSC Essential Eight.

Zero TrustACSC Essential Eight16 rules8 security domains

Integration Error Handling Playbook

No error goes unhandled. Every integration defines its failure disposition, escalation threshold, escalation owner, and recovery procedure. Governs Rules 29 and 30.

Dead letter queuesEscalation pathsSilent drop detectionAssurance gates

Pipeline Coding Standards

One standard for every pipeline. Orchestrator-module architecture, Bronze-Silver-Gold layers, deterministic transformations, no runtime AI.

Medallion architectureOrchestrator patternBronze-Silver-GoldNo runtime AI
// The 10 Golden Rules

Non-Negotiable Principles.

01

No silos. All data lives in one system.

02

Deterministic first, AI second.

03

Every component belongs to one of five zones: Input, Transform, Loop, Output, Interface.

04

Every pipeline needs at least one feedback loop.

05

Right-size the platform. Snowflake is not the answer for a small business.

06

Consolidate redundant processes. Three payment portals doing the same job is one process waiting to be built.

07

No manual processes. Everything should be automated.

08

AI is never used unsupervised at runtime. Every AI component has a human review gate.

09

No error goes unhandled. Every integration defines its failure disposition, escalation path, and recovery procedure.

10

Every data pipeline follows the Bronze, Silver, Gold medallion pattern.

// Track Record

Built From Real Engagements. Not a Textbook.

25 years designing data systems across gaming, fitness, retail, and professional services. PRISM was built from the ground up across real engagements — not adapted from a generic framework.

Government Gaming

Provided consulting, advisory and documentation support to the solutions architect on a multi-year platform migration involving 32+ systems and 62+ integrations. PRISM methodology applied to integration mapping and risk classification.

32+

Systems

62+

Integrations

Advisory

Engagement

Fitness Analytics

Multi-tenant analytics platform serving 205+ studios across 9 countries and 350 active users. Deterministic reporting with zero AI at runtime, full data ownership per client, and automated content generation pipelines.

205+

Studios

9

Countries

350

Active users

Marketing Services

Deterministic reporting platform used by marketing agencies across Australia. Automated data ingestion, template-driven report generation, and client-facing dashboards built on first-party analytics.

Multiple

Agencies

Automated

Reports

Zero

AI at runtime

For Enterprise Programmes

You are about to spend $5–50M replacing a platform. Do you know what you are actually replacing?

Most organisations know their headline systems. Few have a complete picture of the 60, 80, or 120 integrations between them — many carrying PII, financial data, or compliance obligations nobody has documented.

PRISM finds them and classifies each by change impact, risk, and complexity. It identifies what breaks when a system changes, how far it propagates, and the cutover sequence that avoids cascading failure.

For Mid-Market Organisations

The same rigour a Big Four charges for, delivered by the person who built the methodology.

Mid-market estates face enterprise architectural problems — platform consolidation, legacy replacement, data estate modernisation — without the enterprise budget.

PRISM scales. The same methodology that supported a multi-year government migration of 32+ systems and 62+ integrations applies to a 15-system organisation replacing its CRM. Same output: risk score, findings report, migration plan.

For Recruiting Agencies

A data architect with a proprietary methodology is not the same as a contractor with experience.

Most architects on enterprise programmes apply experience and judgement — output quality is a function of who you placed. PRISM changes the equation: documented methodology, deterministic rules, consistent output regardless of landscape complexity.

For clients running platform migrations, transformations, or estate modernisations, PRISM is the differentiator between a diagram with observations and a quantified, auditable assessment.

// Questions

Frequently Asked Questions.

What exactly is PRISM?+
PRISM — Platform, Risk, Integration and Systems Methodology — is a five-layer deterministic framework for assessing enterprise data architectures. Layer 1 catalogues every system. Layer 2 risk-scores every integration. Layer 3 maps integrations end-to-end with data contracts, endpoints, blast radius, and compliance. Layer 4 fires 50 deterministic rules and produces a severity-rated findings report. Layer 5 turns the findings into a phased migration plan with runbooks, recovery profiles, and stakeholder-split reporting.
Why deterministic rather than AI?+
Five weeks of testing AI-generated executive summaries showed AI failed to apply rules reliably. Deterministic templates — the same conditional logic on the same structured data — produced better results at zero hallucination risk and a fraction of the cost. AI has a role at setup, proposing candidates and patterns under human review, but it never executes at runtime against assessment data.
What kind of engagements is PRISM designed for?+
Four. Migration: replacing a platform — full mapping, sequencing, and planning toolkit. New Build: future-state design with build sequence. Optimisation: gaps in an existing estate, driven by Layer 4 health rules. Assessment Only: advisory mode producing the health report and roadmap without delivery commitment.
What about AI systems in the architecture being assessed?+
Rule 14 detects every AI Agent and AI/ML Component. Rules 31–34 check for a technically enforced human review gate, defined action scope, audit logging, and no runtime AI on structured integrations. Rule 45 checks each component has a documented evaluation strategy. The test: if the AI produced a wrong output right now, what would happen before a human noticed? If the answer is "something would execute, send, change, or delete", the architecture has a governance gap.
What does the output look like?+
Two reports from the same data. The executive summary — risk score, plain-English findings, priorities, roadmap — is built for a programme board. The technical specification is the full package: systems registry, integration assessment, endpoint registry, blast radius, 50-rule findings, error handling, data contracts, runbooks, compliance mapping, RACI, cutover playbook, plus Supplementary A (AI governance) and Supplementary B (cybersecurity mapped to ACSC Essential Eight) when applicable.
How is this different from a standard architecture review?+
Standard reviews produce a diagram plus the reviewer’s observations — quality depends on who was placed. PRISM applies 50 deterministic rules to every component, integration, and endpoint. A financial integration without error handling fails Rule 29. A PII integration without encryption in transit fails Rule 37. An AI component without a human review gate fails Rule 31. Every finding traces to a rule; every rule traces to one of four playbooks.
What industries have you worked in?+
Enterprise gaming and lottery, fitness and wellness, financial services, marketing and advertising technology, and professional services. The most demanding engagement was a multi-year government gaming migration of 32+ systems and 62+ integrations, where I provided consulting, advisory and documentation support to the solutions architect; PRISM was applied to integration mapping and risk classification. The methodology was stress-tested at that complexity and now applies equally to a 15-system mid-market estate.

Ready to See Your Architecture in three dimensions?

Whether you are planning a migration, replacing a platform, or assessing an existing data estate, start with a conversation.

Start a Conversation →

Engagement rate: $960 + super per day

No pitch. No pressure. Just a conversation to see if PRISM fits your engagement.