Drawing set · General arrangement AJAIA
PROJECTION First angle
UNITS Layers
STATUS Issued for build
A drawing of how AJAIA is put together, and of what it will not do. Plate A is the whole stack cut open, touch surface at the top, your Jira and Azure DevOps boards at the bottom. Plate B follows three journeys: a request that is allowed, one that is refused, and the trail left behind when something changes. The schedule at the foot lists what could go wrong and what stops it.
GENERAL NOTES
- All work to be read in conjunction with the exploded view, sheet 01.
- Every query carries an organization predicate. A result set that could cross a client boundary is a defect, not a preference.
- Rights are checked per resource, not per person. Running a standup is not the same as belonging to the organization that owns it.
- Production is refused by the test rig at load, before a browser opens. The guard is not a setting.
- The board remains the system of record. Nothing here becomes the place work quietly lives instead.
- Handlers are reachable only when registered. An unregistered module is not a hidden route, it is not a route.
LINE LEGEND
| Object line · shipped and running | |
| Hidden line · runs out of sight | |
| Construction · boundary, not a part | |
| Live path · request in flight |
SCHEDULE OF PARTS
SCHEDULE OF CONTROLS
| What could go wrong | What stops it | Where it lives |
|---|---|---|
| One client sees another client’s work | Every query carries an organization predicate | 08 · Data |
| Somebody does a thing that was never theirs to do | Rights are checked per resource, not per person | 07 · Guard layer |
| An endpoint nobody meant to expose | Only registered handlers are reachable at all | 06 · API surface |
| A test run reaches live client data | Refused when the run loads, before a browser opens | Test rig |
| Work quietly moves out of your tracker | The board stays authoritative, every write goes back to it | 09 · Boards |
AJAIA- DRAWING
- AJ-GA-02
- SCALE
- 1:1
- REV
- C
- SHEET
- 2 of 2
Sheet 02 of 02. The general notes are commitments, not decoration: organization scoping on every query, rights checked per resource, and a test rig that refuses production before a browser opens.
Exploded view · Blueprint · Security overview · Prompt injection defense