TECHNICAL ARCHITECTURE / SECURITY
Artiplane’s five layers: microservices, Control Plane, application integrations, identity, AI orchestration and enterprise security.
Artiplane enterprise architecture specification · 11 October 2026. This document defines product responsibilities and contracts; enabled services, integrations, SLAs and applied controls are recorded per installation. It is not a certification attestation.
01 · SCOPE & DEPLOYMENT
Ocra Group identifies Azure as the enterprise solution’s environment and private deployment as a product option. Application services, data, identity, connectors and operations are defined in an installation-specific topology.
The specification separates API ingress, Control Plane services, execution workers, event bus, transactional database, search index and object storage. An Azure profile can map these roles to API Management, AKS or Container Apps, Service Bus, managed databases, search and Blob Storage. Services are not implicit: region, SKUs, isolation, availability and dependencies belong in the installation dossier. Control Plane and runtime have separate authorisation boundaries.
The private profile preserves application contracts while replacing infrastructure dependencies with compatible container runtime, database, queue, index, storage, IdP and secrets manager. Versioned artefacts, configuration separate from secrets, controlled migrations and restore procedures define the release. Customer-network connectors use authorised VPN/private paths or a dedicated integration worker, not a publicly exposed ERP. Compatibility and operational ownership require environment-specific acceptance.
Private installation does not mean local inference. Claude, OpenAI and Bedrock routes are enabled only under approved classification and customer terms. Complete isolation requires approved local models/dependencies or disabled external inference. Private endpoints reduce network exposure but do not alone determine processing location or contractual terms.
02 · FIVE LAYERS
The layers describe software responsibilities. A layer may contain several services; a module is not automatically an independently deployed microservice.
Ingests authorised content and records, retaining source keys/versions, ACL metadata, classification and timestamps. Production parsing, indexing and retrieval are separate steps; the model receives evidence filtered for identity and purpose before generation.
Binds canonical Fashion objects—SKU, collection, order, return, store and market—to application fields. Mappings, units, currencies, KPI definitions and lineage are versioned. A semantic binding describes data but never grants source access.
The Process Engine models processes, roles, dependencies and gates. An Orchestrator decomposes a bounded objective into Process Engine missions and tasks, selects registered capabilities/workflows and requests human gates. The model holds no credentials and cannot assign itself authority.
Orchestration connects AI capabilities, workflows and applications. Adapters separate vendor transport, technical identity, mapping and allowed operations. REST/OData, webhooks or middleware depend on the actual system. Reads return evidence; writes require authorisation, version checks and reconciliation.
Chat, Admin and Worker Apps expose states, proposals and decisions. The browser is not an authorisation boundary: hiding a button does not secure an API. Sensitive requests must revalidate identity, object, tenant and operation server-side.
03 · SERVICE COMMUNICATION
Reference sequence: request → policy → evidence → proposal → approval → command → outcome check. Not every request crosses every layer.
Versioned contracts declare JSON Schema inputs/outputs, errors, timeouts and limits. An envelope carries correlationId, tenantId, subjectId, operation, purpose, schemaVersion and deadline. The server derives identity from a verified session, never an arbitrary browser tenantId. Trace IDs are not access tokens.
Production queues/events require eventId, aggregateId, sourceVersion and occurredAt; idempotent consumers, duplicate/out-of-order handling, transactional outbox where needed and authorised dead-letter replay. No end-to-end exactly-once guarantee: effects are reconciled against the system of record.
Bounded retries only for reads or documented idempotent operations; respect Retry-After, deadlines and circuit breakers. Read status before retrying an uncertain write. A saga uses defined compensations, not an invented global rollback; irreversible actions require exception procedures.
04 · ADMIN APPLICATION MAPPING
The Admin catalogue registers capabilities: application, environment, objects, operations and owner. Configuring a capability is separate from enabling it operationally.
Each capability binds applicationId, connectionId, environment, API version, vendor object, record key, field, transformation and semanticObjectId. Read, propose and write scopes are separate; propose never grants write. SAP interfaces depend on the installed edition and supported REST/OData or middleware; Salesforce applies OAuth scopes and tenant object/field permissions; Centric PLM requires vendor-confirmed interfaces and terms. Catalogue mapping does not imply licensing, certification or a live connection.
The specification keeps endpoints, scopes and secret references in a server registry outside the browser. An integration worker resolves secrets and validates destination, TLS, schema and permissions. Activation requires read/ACL tests, owner and verification date; credential expiry, schema drift or expired verification must suspend affected capabilities. Health checks and operation outcomes are distinct evidence: endpoint reachability does not prove a successful write.
Direct values retain application, object/field, record key, version and extractedAt. Derived values add inputs and formula/transformation version; AI results add runId, agent, workflow, provider/model and evidence references. Reported restrictions come from enforced policies, not view filters. Acceptance covers schema, pagination, deltas, duplicates, negative ACL tests and reconciled totals.
05 · LOGIN & AUTHORISATION
User identity, service identity and object-level permission are separate controls.
The SSO contract federates with the enterprise IdP using OIDC Authorization Code with PKCE, validating issuer, audience, signature, expiry, state and nonce where applicable; SAML is an alternative configuration profile. MFA and Conditional Access are IdP policies. Provisioning binds stable identity to tenant and administered roles; optional SCIM manages lifecycle without elevating user-editable attributes into privileges.
Organisation models central functions, Countries, brands, markets and multiple memberships; structure alone does not grant access. Effective permission intersects trusted role, tenant, authorised organisational scope, process, classification, tool scope and source ACLs. Server/row policies deny by default and constrain indexes and retrieval. Orchestrators cannot expand user authority; Admin operates within assigned delegation.
The specification requires expiring, revocable sessions; HttpOnly, Secure and flow-appropriate SameSite cookies, with CSRF protection for cookie-authenticated operations. Services use scoped workload identities, short-lived tokens where supported and dedicated audiences. User/role revocation must reach sessions, authorisation caches and queued jobs. Deferred actions recalculate permission rather than reusing stale decisions.
06 · NETWORK & DATA SECURITY
Enterprise controls must be applied to the actual environment and evidenced through configuration, logs and adversarial tests.
TLS transport; environment-specific WAF/ingress limits, egress allowlists and SSRF controls, segmentation and non-public databases where required. Shared-tenant testing covers APIs, caches, indexes, files and jobs. Private networking never replaces identity checks.
The baseline separates session keys, connector credentials and data keys. Secrets use a secrets manager or envelope encryption, never prompts, browser bundles or logs. An Azure profile can use Key Vault and managed identity; private profiles require equivalent services. AES-GCM requires per-key unique nonces and tag verification. At-rest encryption, rotation, key versions and backup restore are distinct configured and tested controls. TLS protects transport, not storage.
SHA-256 is hashing, not encryption or anonymisation. Alone it proves neither author, time nor immutability and can disclose equality. Tamper evidence needs append-only/WORM storage or signatures/HMAC with protected keys and reliable timestamps. Retention must cover content, indexes, logs and backups, including legal holds and deletion timelines.
07 · CLAUDE, OPENAI, AMAZON BEDROCK
Inference configuration identifies provider, model, region, service credential and contract. Catalogue selection enables a route only after tenant validation.
Claude may use Anthropic APIs or, for available models, Bedrock; contracts and APIs differ. OpenAI adapters use supported APIs, structured outputs and tool/function calling. A model proposes a call; the server validates schema, policy and arguments before execution. Proprietary weights, sessions and hidden agent state are not imported.
Bedrock requires account, region, model availability and IAM permissions. InvokeModel/Converse, Agents and Knowledge Bases are distinct capabilities. Guardrails and private endpoints are configured separately. Cross-region inference profiles may change geographic processing: verify them instead of assuming residency from a region label.
The Model Gateway contract enforces classification, minimisation/PII redaction, allowed regions/tools, token budgets, timeouts and quality before invocation. An agentId resolves a capability/workflow version; provider adapters translate the common contract without assuming API feature parity. Runs record provider/model ID, policyVersion, usage, evidence and validated results. Fallback is limited to already approved routes; exhausted quota cannot bypass residency or confidentiality. Training, retention and logging depend on the enabled service and agreement.
08 · N8N & EXTERNAL WORKFLOWS
Imported workflow configuration becomes a capability only after nodes, credentials, triggers and permissions are validated.
JSON exports transfer compatible definitions, not automatically secrets, licensing, runtime state or executions. Select versioned workflows/endpoints, authenticate webhooks and callbacks, record executionId/correlationId and restrict operations. Use signatures or protected tokens, replay checks and timestamps where supported.
The specification separates n8n editor, workers, queues and credentials per deployment. Validate inputs/outputs, egress, sub-workflows and node code under an operational owner. Authorised commands bind object, scope, version, approval and expiry; workers cannot expand them. Authenticated, deduplicated callbacks update Artiplane through executionId/correlationId. Timeouts and uncertain outcomes open reconciliation, not a second irreversible action.
09 · PROCESS ENGINE & HUMAN CONTROL
An AI task, an approval and an application write are different operations.
A production gate binds authorised approver, inputs, amount, object, version and expiry. Material changes invalidate approval. Recheck permissions and source version before writing to reduce time-of-check/time-of-use risk; segregation-of-duties actions cannot self-approve.
CRM captures the case, commerce/ERP validate order/payment, WMS records receipt and quality. Semantics bind return ID, SKU and market; AI summarises evidence and proposes an outcome. Finance/Quality approve exceptions; adapters execute only granted operations and reconcile refund/stock. Thresholds and systems must be customer-confirmed, not invented.
The specification separates draft, validation, published version and process instance. Designer defines typed tasks, gateways, lanes, semantic bindings and gates; publishing requires ownership, authorised capabilities, policies and acceptance tests. Orchestrators govern objectives/missions while registered agents/workflows operate individual tasks. Runtime retains durable state, timers, attempts and events by caseId/processVersion. Performance, conformance and root-cause analyses use validated event logs; forecasts and economic assumptions remain separate from measured results.
10 · AI-SPECIFIC THREATS
Instructions inside emails, documents or tool results cannot change policy or permissions.
Separate system instructions from retrieved content; enforce tool allowlists, parameter validation, retrieval-time ACLs and egress controls. Never put secrets in context. Detectors and prompts alone cannot stop every injection; server execution boundaries are essential.
Validate JSON Schema/business constraints, sanitise HTML/links and treat generated code/SQL as untrusted; prohibit arbitrary execution. Citations improve verifiability but do not guarantee correctness. Test missing/conflicting/stale evidence, excessive cost and cross-tenant attempts.
11 · COMPLIANCE & OWNERSHIP
An architecture, a hash or a cloud certification does not make the whole application automatically compliant.
GDPR requires controller/processor roles, lawful basis, purpose, minimisation, DPA, subprocessors, transfers, rights and DPIA where necessary. AI Act obligations depend on the specific use, actor role and risk classification. Human gates are not legal certification.
Ocra Group owns supplied code/components; customers govern identity, data, agreed policies/configuration; cloud and AI providers cover their services contractually. Formalise RACI, SLA and DPA. A provider’s ISO 27001/SOC 2 status does not automatically transfer to Artiplane.
12 · TECHNICAL CHALLENGE & ACCEPTANCE
The review links each concern to an acceptance criterion and required evidence. It does not replace an independent installation audit.
Test expired tokens, wrong issuer/audience, revoked roles, foreign objects, shared caches and index ACL deletion. Expected result: refusal before data return or tool invocation. Revocation must also reach deferred sessions/jobs.
Inject malicious document instructions, change approved amounts, duplicate callbacks, simulate post-write timeout, exhausted quota and disallowed providers. Expected: no privilege escalation, double write or prohibited fallback, with reconcilable exception states.
Production acceptance needs as-built topology/service inventory, threat model, access matrix, SBOM, scans/pentest with remediation, encryption/rotation evidence, restore tests, measured RPO/RTO, audit logs, DPA and provider settings. Without proof, a control remains a requirement or statement—not a verified guarantee.