How to Configure the Deployment-Ownership Engineering Profile for Production Architecture Reviews in Archify

To configure Archify's deployment-ownership engineering profile, add meta.engineering_profile: "deployment-ownership" to your Architecture JSON and ensure all six validation constraints—owner tags, region membership, boundary existence, database placement, shared region rules, and cross-boundary labels—are satisfied.

Archify's deployment-ownership engineering profile transforms a standard architecture diagram into a fail-closed production deployment review. This optional validator enforces strict ownership and boundary rules that capture who owns each component, how systems partition into regions and security groups, and how data flows cross those boundaries. The feature adds zero new renderers, viewers, or dependencies—it purely augments the existing validation pipeline as implemented in tt-a1i/archify.

Enabling the Deployment-Ownership Profile

Activation requires a single field addition to your Architecture's metadata object.

In archify/schemas/architecture.schema.json, the meta.engineering_profile field accepts "deployment-ownership" as its only current value:

{
  "meta": {
    "engineering_profile": "deployment-ownership"
  }
}

Once present, the validator switches from permissive to fail-closed mode. Any violation of the six constraints below halts validation and rejects the architecture.

The Six Validation Constraints

The deployment-ownership profile enforces these requirements on the authored Intermediate Representation (IR). The validator performs no live cloud or IaC inspection—all checks run against the static JSON only.

1. Owner Tags on All Non-External Components

Every component not marked as external must carry a non-empty tag identifying its owner team or individual.

{
  "id": "payment-gateway",
  "type": "service",
  "tag": "platform-team"
}

2. Single Region Membership Per Component

Each non-external component must belong to exactly one region boundary. Duplicate or missing region assignments trigger validation failure.

{
  "id": "cache",
  "type": "redis",
  "region": "eu-west-1"
}

3. Mandatory Region and Security-Group Boundaries

The diagram must contain at least one region boundary and one security-group boundary. Architectures with only services and no enclosing boundaries are invalid under this profile.

4. Database Components Require Security-Group Assignment

Every database type component must be explicitly assigned to a security-group via the security_group field.

{
  "id": "primary-db",
  "type": "database",
  "security_group": "sg-production-data",
  "region": "us-east-1"
}

5. Security-Groups Cannot Span Multiple Shared Regions

Each security-group may contain members from exactly one shared region. This prevents accidental cross-region data exposure through misconfigured security boundaries.

6. Cross-Boundary Connections Require Mechanism Labels

Any connection that changes region or security-group membership must carry a non-empty mechanism label describing how the crossing is implemented.

{
  "source": "api-gateway",
  "target": "analytics-db",
  "mechanism": "cross-region read replica"
}

Valid mechanism labels include "VPC route", "cross-region WAL", "transit gateway", or any descriptive string that audit reviewers can trace.

Complete Working Example

The file archify/examples/production-deployment.architecture.json demonstrates all constraints in a valid configuration:

{
  "meta": {
    "engineering_profile": "deployment-ownership"
  },
  "components": [
    {
      "id": "frontend",
      "type": "service",
      "tag": "frontend-team",
      "region": "us-east-1"
    },
    {
      "id": "db",
      "type": "database",
      "security_group": "sg-data",
      "region": "us-east-1"
    }
  ],
  "boundaries": [
    {
      "id": "region-us-east-1",
      "type": "region",
      "members": ["frontend", "db"]
    },
    {
      "id": "sg-data",
      "type": "security-group",
      "members": ["db"]
    }
  ],
  "connections": [
    {
      "source": "frontend",
      "target": "db",
      "mechanism": "VPC‑private‑link"
    }
  ]
}

Reference: archify/examples/production-deployment.architecture.json#L11-L14

Validating and Consuming Results

Run validation via CLI:

npx archify validate --json path/to/your.architecture.json

Successful validation produces a receipt containing engineeringProfile: "deployment-ownership" as documented in docs/deployment-ownership-profile-acceptance-2026-07-23.md:

{
  "valid": true,
  "engineeringProfile": "deployment-ownership"
}

The Gallery viewer renders this as a compact "DEPLOYMENT OWNERSHIP · PASS" badge for quick status identification during reviews.

Backward Compatibility Guarantees

Per CHANGELOG.md, the deployment-ownership profile introduces no breaking changes:

• Existing v1 architectures without meta.engineering_profile continue functioning unchanged
• No new product surfaces, telemetry, or hosted services are added
• The validation pipeline alone is augmented

This design lets teams opt into stricter production reviews without disrupting existing workflows.

Summary

• Enable the profile by setting meta.engineering_profile: "deployment-ownership" in your Architecture JSON
• Satisfy all six constraints: owner tags, region membership, boundary existence, database security-group placement, single-region security-groups, and labeled cross-boundary connections
• Validate using npx archify validate to receive a machine-readable receipt
• Display results in the Gallery viewer with the deployment-ownership pass badge
• Preserve backward compatibility—opt-in only, no forced migrations

Frequently Asked Questions

What happens if I omit the engineering_profile field?

Archify runs standard validation without deployment-ownership constraints. Your architecture validates against base schema rules only, producing no profile-specific receipt or badge. This is the default behavior for all pre-existing v1 architectures.

Can I use multiple engineering profiles simultaneously?

Currently no. The meta.engineering_profile field in archify/schemas/architecture.schema.json accepts a single string value. Only "deployment-ownership" is defined; future profiles would require schema updates and are not combinable in the current implementation.

Does the validator check actual cloud infrastructure?

No. All validation operates on the authored Intermediate Representation. The validator does not perform live cloud API calls, IaC state inspection, or repository provenance inference. This keeps reviews fast, deterministic, and free of external dependencies.

Where is the source of truth for validation rules?

The canonical specification lives in docs/deployment-ownership-profile-acceptance-2026-07-23.md, with schema enforcement defined in archify/schemas/architecture.schema.json. The example file archify/examples/production-deployment.architecture.json provides a tested reference implementation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}