Framework · The 4-Discipline Stack

The four disciplines that compound.

Enterprise Architecture · Platform Engineering & DevSecOps · Data Modernisation · Applied GenAI. Most organisations buy these as separate workstreams. The compound only emerges when they share the same operating substrate.

The 4-Discipline Stack · Uchit Vyas · v1.0

The compound is the moat.

Most enterprises buy these as four independent workstreams — a CTO sponsors EA, a VP Engineering sponsors platform, a CDO sponsors data, a Chief AI Officer (now) sponsors GenAI. Four budgets, four roadmaps, four reports. Four good capabilities, often delivered well in isolation. Almost no compound.

The compound only emerges when all four share a single operating substrate: encoded policy that the platform enforces, workload identity that data and AI inherit, observability defaults that span from a Terraform module to an LLM inference call, audit evidence that's generated at decision time rather than scrambled at audit time.

With the substrate in place, each discipline accelerates the next. Architecture decisions encode into platform defaults. Platform defaults propagate governance to data. Trusted data makes GenAI auditable. Auditable GenAI surfaces new capabilities that change the architecture. Without the substrate, you have four projects competing for the same engineers.

Each of the six diagnostics on this site measures one slice of the substrate. They are intentionally framed so the same organisation taking all six should see the same maturity gaps recur — because the gap is rarely in the discipline, almost always in the substrate beneath it.

The four disciplines

Each one has its own job. None of them work alone.

/ disciplines

The shape

Enterprise Architecture.

EA defines what the organisation does, separately from how it currently does it. A living capability model — not a slide pack — anchors investment decisions, vendor selection and the target-state architecture. Decisions are captured as ADRs not slide decks. Principles that aren't encoded in platform defaults or policy-as-code don't exist.

In 2026, EA's job is no longer the heroic five-year target diagram. It's running a small federated function that paves paths, encodes decisions, and stays mostly invisible because the platform enforces what the architecture decided.

Maps to TOGAF 10 · BIAN · ArchiMate · BIZBOK Diagnostic EA Operating Model

The substrate

Platform Engineering & DevSecOps.

The single capability that decides whether D1 decisions become real. Paved paths that take a new service from zero to audited production in minutes. Encoded policy via OPA/Kyverno that blocks non-compliant deploys before a human is involved. Workload identity (OIDC, SPIFFE) so static secrets stop being the largest breach vector. SBOM + signed provenance (SLSA L3+) so the supply chain isn't built on hope.

Post-XZ Utils, post-Snowflake, post-CrowdStrike: this is the discipline with the highest regulator visibility. APRA CPS 234, EU DORA, US EO 14028 and CISA's Secure Software Attestation all operate at this layer. The substrate's quality decides everything above it.

Maps to CNCF Platform Eng Maturity · Team Topologies · NIST SSDF · SLSA Diagnostics Platform Eng · DevSecOps · SRE

The truth

Data Modernisation.

Trusted, lineage-aware, analytics-ready data. Governed by domain with clear ownership and retention. Audit-grade for regulators (PII handling, right-to-erasure, residency). The data layer that the platform secures and the architecture decided was needed.

The discipline most underestimated in GenAI rollouts. Foundation models don't fix bad data — they amplify it. The GenAI Readiness diagnostic reliably scores Data Foundations as the highest-correlated gap with downstream failure modes.

Maps to Data mesh · Lakehouse · DCAM · DAMA-DMBOK · ISO 8000 Diagnostic Coming soon

The accelerant

Applied GenAI.

GenAI in production — with evals you trust, guardrails you've tested adversarially, governance encoded in the platform and audit evidence generated at decision time. Not the demo, the service. Not the prototype, the regulated feature with a sponsor and an SLO.

The discipline with the steepest 2026 regulatory clock: EU AI Act high-risk enforcement begins 2 Aug 2026. ISO/IEC 42001 certification is becoming a procurement requirement in B2B. The work isn't to build more agents — it's to make the platform safe for squads to build them on.

Maps to NIST AI RMF · ISO/IEC 42001 · EU AI Act · OWASP LLM Top 10 Diagnostic GenAI Readiness

Compound maturity

Five tiers. Where do you actually sit?

/ tiers

Compound maturity is not the average of the four disciplines. It's rate-limited by the weakest of the four and the maturity of the shared substrate between them.

Tier 1 · Siloed

Four projects.

Four budgets, four roadmaps, four reports. No shared substrate. Each discipline delivers in isolation; the compound never appears.

Tier 2 · Coordinated

Shared backlog.

The four functions talk monthly. Architecture has opinions on platform; data has opinions on AI. Coordination overhead is high; cycle times are long.

Tier 3 · Federated

Encoded principles.

Architecture principles encoded as policy-as-code. Platform defaults inherited by data and AI. Federated decision-making; standing decisions don't get re-litigated.

Tier 4 · Composed

Substrate-first.

The four disciplines share the same identity, observability, policy and audit primitives. A new GenAI use-case inherits data lineage, platform guardrails and architecture principles by default.

Tier 5 · Property

Invisible compound.

The disciplines are properties of how the organisation builds, not workstreams it runs. Squads consume the substrate; the compound is the moat. Reference customers; published practice.

How to use this framework.

Diagnose each discipline. Run the four corresponding diagnostics — EA, Platform Eng, DevSecOps, GenAI. Score honestly. Compound maturity is bounded by the weakest.
Find the substrate gap. Look across the capability breakdowns. The capabilities that recur as weak across multiple diagnostics (identity, observability, ownership, governance, policy-as-code) are the substrate gap. That's where investment compounds.
Sequence the work by substrate, not by discipline. A workload-identity (OIDC) programme improves DevSecOps, data, AI and platform simultaneously. A policy-as-code programme does the same. Pick substrate moves; let the disciplines benefit.
Map roles to disciplines, not to projects. If your EA function only writes about EA, your platform team only writes about platform, etc., the substrate has nobody. Name a substrate-aligned role — often the platform engineering leader.
Report compound metrics, not discipline metrics. Time-to-first-audited-deploy. Time-to-customer-facing-GenAI-feature. Percent of services with inherited observability + identity + governance. These force substrate investment.

Run the diagnostics EA Operating Model → Platform Engineering → DevSecOps → GenAI Readiness → Talk about your stack →