# Architecture review checklist

Use this to test a design, not score its diagram aesthetics.

## 1. Purpose & responsibility
- [ ] Business outcome and measurable success are stated
- [ ] Capability owners and system-of-record boundaries are explicit
- [ ] In/out-of-scope responsibilities are visible

## 2. Contracts & quality
- [ ] API/event contracts, change rules and versions exist
- [ ] Availability, latency/freshness, recovery and cost targets are measurable
- [ ] Ownership and release coupling between components are known

## 3. Security & control
- [ ] Identity, trust boundaries and authorization are enforced where actions execute
- [ ] Sensitive data handling and tenant isolation are assessed
- [ ] Agent/tool permissions are constrained and auditable, where applicable

## 4. State & failure
- [ ] Transaction, idempotency, retries and ordering semantics are described
- [ ] Partial failures and compensations have an owner
- [ ] Observability and actionable SLOs have been designed

## 5. Engineering & change
- [ ] Alternatives and trade-offs are recorded (ADR)
- [ ] Automated tests independently validate critical behavior
- [ ] Rollback / decommission strategy is credible
- [ ] Design has a named next review trigger