Keep the Scope Stable
Re-running a design must never quietly grow the authorization boundary: the set of components your organization is signing up to build, operate, and defend. Generative models have an additive bias; left alone, every "improve this" pass finds one more thing to add. The scope guard turns boundary growth from a model habit into a governed, human decision.
The Contract
On every re-run, the previous design is presented to the model as the current boundary, and one rule is enforced deterministically afterward:
A component the re-run adds must cite the specific control, finding, or requirement that forces it. Additions without a recognizable driver are quarantined: they do not enter the design, its compliance scoring, or its diagrams.
Quarantined additions become proposals on the Architecture tab, waiting for you.
What is never gated, because it is not boundary growth:
- Gaps. A new gap is a flagged open question, not scope; it flows into the gap decision process.
- Technology changes on an existing capability, including a gap gaining its technology. Same slot, different answer.
- Your own edits. Locked components are architect decisions and pass untouched.
- Removals. Shrinking the boundary is reported, never blocked.
The Scope Guard Card
After any re-run, the card on the Design segment shows what actually happened:
| Row | Meaning |
|---|---|
| Added | New components that cited a valid driver, with the driver shown |
| Removed | Components the re-run dropped |
| Technology changes | Same capability, different technology (including resolved gaps) |
| Proposed additions | Quarantined components awaiting your decision |
For each proposal you choose:
- Accept into boundary: the component (and its data flows) joins the design, compliance re-scores immediately, and the acceptance is recorded in the audit log as your decision.
- Discard: the proposal is dropped, also audited.
Proposals Block Approval
An undecided proposal is an undecided boundary. The readiness board raises a blocker per open proposal, and the package cannot be approved until each is accepted or discarded.
Preserve Scope Mode
The Preserve scope checkbox next to the run button tightens the contract for that run: the model is told to add nothing unless a listed finding cannot be resolved by reconfiguring the existing set. Quarantine applies either way; the toggle just makes the model try harder before proposing.
Use it for remediation passes on a design you consider shape-complete, and leave it off for early iterations where growth is expected.
Revisions and the Bigger Picture
When a package is a revision of an approved one, the Review & Approval tab also shows the boundary delta versus the predecessor's approved baseline ("+2 / −1"), so the approver sees cumulative growth across revisions, not just the last run. A new external system added without citation is quarantined like anything else; integration surface is scope too.