# NORTHBRIDGE BANK — ARCHITECTURE DECISION RECORD ## AI Credit Re-Scoring Platform --- | Field | Value | |-------|-------| | **Document ID** | TKA-NB-ADR-001 | | **Engagement** | TKA-NB-20260702-001 | | **Architect** | Vitruvius — BMAD Architect Agent, Talastron Kinetic AI | | **Date** | 2 July 2026 | | **Status** | DRAFT — Pending Themis Compliance Review | | **Classification** | RESTRICTED — FCA Consumer Credit // OFFICIAL-SENSITIVE | --- ## ARCHITECTURAL CONTEXT NorthBridge Bank requires an AI-augmented credit re-scoring layer that integrates open banking data with existing applicant records to recover approximately £2.3M/month in suppressed mortgage revenue. All decisions made by the AI layer are regulated credit decisions under FCA consumer credit rules. **Binding constraints on every decision in this record:** | Constraint | Source | Architectural Impact | |-----------|--------|---------------------| | UK sovereign data residency | Minerva G1 — GREEN | All compute, storage, and AI inference in UK South only | | FCA SYSC 6.3 / Consumer Duty explainability | Minerva G2 — GREEN | Interpretable model + plain-language rationale on every outcome | | Zero Trust | Minerva G4 — GREEN | No implicit trust; all access policy-driven | | Full audit trail | FCA statutory obligation | Immutable, queryable log of every decision and override | | Entra ID — corporate-managed devices | Minerva G4 — GREEN | Underwriter access via Conditional Access + compliant device policy | | 90-day MVP | Minerva G5 — CONDITIONAL | Architecture scoped to demonstrable MVP; production hardening deferred | **Delivery standards (Orion/Talastron):** Bicep-first IaC, Azure Verified Modules (AVM), Managed Identity throughout, GitHub Actions CI/CD, no credential-based auth. --- ## DECISIONS ### ADR-001 — All AI Services Deployed to UK South **Status:** Accepted **Context:** Orion default AI workload region is Sweden Central. NorthBridge data residency constraint prohibits any cross-border data movement, including AI inference calls that process or transmit applicant PII. **Decision:** Azure Machine Learning Workspace and Azure OpenAI Service are deployed to UK South. The Orion Sweden Central default is explicitly overridden for this engagement. **Rationale:** Azure OpenAI (GPT-4o) is available in UK South. AML is available in UK South. No technical blocker to full UK-sovereign AI deployment. The data residency constraint is non-negotiable and contractually binding under FCA authorisation. **Consequences:** Marginally reduced model availability during UK South regional events. Mitigated by zone-redundant AML compute cluster deployment within UK South. This decision is irreversible for the life of the NorthBridge engagement. --- ### ADR-002 — Azure Machine Learning with Responsible AI Dashboard (Mandatory) **Status:** Accepted **Context:** FCA SYSC 6.3 and Consumer Duty require that every AI-influenced credit decision is explainable and that the rationale is traceable to input features. A black-box model is contractually excluded per Minerva Gate 2. **Decision:** Azure Machine Learning is the re-scoring engine. The Responsible AI Dashboard is mandatory configuration, not optional. SHAP (SHapley Additive exPlanations) values are captured and stored for every inference call. Model cards are produced at training time and version-controlled in the Git repository. Gradient boosting (XGBoost or LightGBM) is the preferred model family — interpretability is prioritised over marginal accuracy improvement from deep learning. **Rationale:** SHAP provides per-decision, per-feature attribution in a form that can be translated to plain English. The Responsible AI Dashboard provides fairness metrics, error analysis, and model cards required for FCA model governance documentation. Gradient boosting models are well-understood by FCA examiners; neural network architectures are not, and would require additional model risk management overhead outside the 90-day window. **Consequences:** SHAP inference adds approximately 50ms latency per call. Model training pipeline requires Responsible AI component configuration. Both are accepted within MVP scope. --- ### ADR-003 — Azure OpenAI for FCA-Compliant Rationale Generation **Status:** Accepted — Flagged to Themis for Consumer Duty review **Context:** SHAP values are machine-readable feature attributions. FCA Consumer Duty requires that decline and conditional-approval rationale presented to consumers is in plain English, specific to the individual applicant, and actionable (i.e., the applicant can understand what to address). Manual authorship of rationale variants is not scalable. **Decision:** Azure OpenAI (GPT-4o, UK South deployment) is used to translate SHAP feature attribution vectors into structured natural language rationale. Prompts are strictly constrained to structured inputs derived from the SHAP output — the model does not reason or infer beyond the data provided to it. The rationale generation prompt template is version-controlled, audit-logged alongside every decision, and any change to the template triggers a formal re-validation gate before deployment. **Rationale:** Constrained prompting eliminates hallucination risk by design — Azure OpenAI operates as a structured text formatter, not a reasoning agent. This satisfies the human-readable rationale obligation without manual authorship. UK South deployment maintains data sovereignty. **Consequences:** Additional ~300ms latency and token cost per decision. Prompt template versioning adds operational governance overhead. Themis must validate that the rationale output format satisfies Consumer Duty obligations before the endpoint is activated in production. --- ### ADR-004 — Azure API Management as AISP Gateway (Single Ingress Point) **Status:** Accepted **Context:** Open banking feeds arrive via a third-party FCA-regulated AISP over OAuth 2.0 REST API. This is an external data dependency carrying consumer financial data under PSD2/PSR2017 authorisation. Minerva CONDITION 1 (AISP FCA authorisation number verification) is outstanding. **Decision:** Azure API Management (APIM, Premium tier) is the sole and exclusive ingress point for all AISP data. No component in the architecture calls the AISP endpoint directly. APIM enforces: OAuth 2.0 token validation, rate limiting, IP allowlisting for the AISP source ranges, WAF policy (OWASP CRS 3.2), and request/response logging to Log Analytics. The AISP FCA authorisation number is recorded as a named value in the APIM configuration before the endpoint is activated — this is the architectural enforcement of Minerva CONDITION 1. **Rationale:** APIM provides a controlled, auditable, policy-enforced gateway that satisfies the audit trail requirement for external data ingestion. Centralising AISP access through APIM means that revocation of the AISP (e.g., loss of FCA authorisation) can be actioned in a single policy change. **Consequences:** APIM Premium tier required for VNet integration and private endpoint in UK South. This is a dependency on the data ingestion path — APIM degradation blocks open banking enrichment. Mitigated by APIM zone-redundant deployment. --- ### ADR-005 — Managed Identity Throughout; No Credential-Based Authentication **Status:** Accepted **Context:** Orion delivery standard. All service-to-service communication must use Azure Managed Identity. No connection strings, no service account passwords, no secrets in code or environment variables. The sole exception is the AISP OAuth 2.0 client secret, which is an externally-issued credential outside NorthBridge's control. **Decision:** Every Azure resource uses Managed Identity for service-to-service authentication. RBAC role assignments to Managed Identities are declared explicitly in Bicep. Azure Key Vault stores only the AISP OAuth 2.0 client secret (retrieved by APIM at runtime via Managed Identity). No other secrets are stored outside Key Vault. **Rationale:** Eliminates credential rotation risk, secret leakage via logs or repositories, and operational burden of service account lifecycle management. Aligns with NCSC CAF Principle B4 (Identity and Access Control) and FCA SYSC 6.3 operational resilience requirements. **Consequences:** Each service requires explicit Managed Identity role assignment declarations in Bicep. Function App, AML Workspace, APIM, and Event Hubs consumer all require distinct assignments. This is a one-time configuration cost with no operational overhead thereafter. --- ### ADR-006 — Three-Tier Audit Trail: Event Hubs + Azure SQL + Immutable Blob Storage **Status:** Accepted — Flagged to Themis for FCA retention period review **Context:** FCA requires a full, tamper-evident audit trail on every credit decision. The record must include: input data state at time of decision, model version and SHAP attribution, generated rationale text, final decision outcome, and any subsequent underwriter override with the override reason and underwriter identity (Entra ID UPN). **Decision:** Decision events are streamed to Azure Event Hubs in real time at the point of decision. A dedicated consumer Azure Function writes structured decision records to an append-only Azure SQL audit table (row-level security prevents deletion; no DELETE permission granted to any application identity). Azure Immutable Blob Storage (WORM policy) retains raw event captures for the FCA-mandated retention period. Retention period to be confirmed by Themis review — placeholder is 7 years (standard FCA consumer credit). **Rationale:** Event Hubs provides ordered, durable, replay-capable event capture. Azure SQL provides indexed, queryable records for FCA examination requests (ad hoc queries within minutes). Immutable Blob provides cryptographic tamper-evidence for long-term retention. Three-tier architecture matches the three FCA examination scenarios: real-time (Event Hubs), historical query (SQL), and forensic review (Blob WORM). **Consequences:** Additional ~100ms write latency on the decision path due to Event Hubs publish. Accepted. SQL audit table partitioned by month for query performance. Immutable Blob retention lock is irreversible once set — Themis must confirm retention period before lock is applied in production. --- ### ADR-007 — Private Endpoints for All PaaS Services; Public Network Access Disabled **Status:** Accepted **Context:** UK sovereign data residency, Zero Trust architecture, FCA data protection obligations under UK GDPR. No data path may traverse the public internet. **Decision:** Every PaaS service (Azure SQL, Key Vault, AML, Azure OpenAI, Event Hubs, APIM internal tier, Storage) is accessible exclusively via private endpoint within the VNet. `publicNetworkAccess: 'Disabled'` is set at the resource level in Bicep and enforced via Azure Policy. Private DNS zones are deployed for each service type. **Rationale:** Eliminates public internet egress for any data path. Satisfies NCSC CAF Principle A2 (Service Protection Policies). Required for Zero Trust — no implicit trust based on network location alone. Azure Policy enforcement means infrastructure drift is detectable. **Consequences:** Private DNS zone configuration required per service type (9 zones). Bicep module complexity increases. Managed via AVM private endpoint sub-resource module pattern. Developer access requires VNet-connected jump host or Azure Bastion — documented in operational runbook. --- ### ADR-008 — CAF / ALZ Resource Organisation and Naming Convention **Status:** Accepted **Context:** NorthBridge deploys into their own Azure subscription. Architecture must be CAF-aligned to minimise future migration cost if NorthBridge adopts Azure Landing Zone governance. **Decision:** Resource naming follows CAF convention: `{resource-type}-{workload}-{environment}-{region}-{instance}`. Primary resource group: `rg-northbridge-credit-scoring-prod`. Mandatory tags on all resources: `environment`, `cost-centre`, `data-classification` (value: `fca-consumer-credit`), `compliance-scope` (value: `sysc-6-3`), `managed-by` (value: `talastron-kinetic-ai`). Management group structure is deferred to NorthBridge IT governance and is not in MVP scope. **Rationale:** CAF naming and tagging enables Azure Policy assignment at resource level, cost allocation by workload, and audit filtering by compliance scope. Consistent tagging is required for the Themis Gate 5 as-built review. **Consequences:** None — conventions only. Enforced via Bicep parameter validation. --- ## WAF PILLAR ASSESSMENT | Pillar | Score | Assessment | | -------------------------- | ----: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Reliability** | 7/10 | Zone-redundant deployment in UK South. Single region by client constraint — no cross-region failover permitted. AML inference endpoint with scale-out. Event Hubs with 7-day retention and consumer group replay. Azure SQL with zone-redundant configuration. | | **Security** | 9/10 | Managed Identity throughout. Private endpoints for all PaaS with public access disabled. Customer-managed keys via Key Vault. Zero Trust for underwriter layer (Conditional Access, compliant device policy). APIM WAF for AISP ingress. Entra ID as sole identity provider. No credential-based auth. | | **Cost Optimisation** | 7/10 | Azure Functions consumption plan for re-scoring API (scales to zero). AML compute cluster auto-scales to zero between batch runs. APIM Developer tier for dev/test environments. Azure SQL Hyperscale tier enables read scale-out without replica cost in production. | | **Operational Excellence** | 8/10 | Bicep AVM IaC — all infrastructure reproducible and version-controlled. GitHub Actions CI/CD with environment-gated deployments. Azure Monitor + Log Analytics with structured alerting on decision error rates and model drift. Responsible AI Dashboard for ongoing model governance. | | **Performance Efficiency** | 7/10 | AML real-time inference endpoint with auto-scaling replicas. APIM response caching for AISP data where data TTL permits. Functions Premium plan eliminates cold-start latency in production. End-to-end decision target: sub-2 seconds (APIM + AML + OpenAI rationale). | | **Sustainability** | 7/10 | Serverless and auto-scale compute minimises idle resource consumption. AML compute clusters deallocate when not in use. UK South has Microsoft carbon-matching commitments. No always-on VMs in the decision path. | **Composite WAF Score: 7.5 / 10** Five of six pillars at 7 or above. Security at 9. Target threshold (minimum 6, target 8) met across all pillars. Reliability is constrained by the client's single-region mandate — this is a documented accepted risk, not an architectural deficiency. --- ## BICEP IMPLEMENTATION PLAN ### File Structure ``` infra/ ├── main.bicep ├── parameters/ │ ├── northbridge-prod.bicepparam │ └── northbridge-dev.bicepparam └── modules/ ├── networking.bicep # VNet, subnets, NSGs, private DNS zones (9 zones) ├── keyvault.bicep # Key Vault, CMK, RBAC assignments, private endpoint ├── sql.bicep # Azure SQL Server + DB, TDE-CMK, audit, private endpoint ├── eventhub.bicep # Event Hubs namespace, audit hub, consumer group ├── aml.bicep # AML Workspace, compute cluster, inference endpoint ├── aoai.bicep # Azure OpenAI, GPT-4o deployment, UK South ├── apim.bicep # APIM Premium, AISP OAuth gateway, WAF policy ├── functions.bicep # Function App (re-scoring API), Managed Identity RBAC └── monitoring.bicep # Log Analytics workspace, Monitor, alert rules ``` ### AVM Module References | Module | AVM Path | |--------|---------| | Virtual Network | `br/public:avm/res/network/virtual-network` | | Key Vault | `br/public:avm/res/key-vault/vault` | | AML Workspace | `br/public:avm/res/machine-learning-services/workspace` | | Azure OpenAI | `br/public:avm/res/cognitive-services/account` | | API Management | `br/public:avm/res/api-management/service` | | Azure SQL Server | `br/public:avm/res/sql/server` | | Event Hubs Namespace | `br/public:avm/res/event-hub/namespace` | | Function App | `br/public:avm/res/web/site` | | Log Analytics Workspace | `br/public:avm/res/operational-insights/workspace` | ### Deployment Sequence ``` Phase 1 — Foundation 1. networking.bicep (VNet, subnets, private DNS zones) 2. monitoring.bicep (Log Analytics, Azure Monitor) 3. keyvault.bicep (CMK generation, RBAC assignments) Phase 2 — Data Layer 4. sql.bicep (TDE with CMK, audit → Log Analytics) 5. eventhub.bicep (audit stream namespace and hub) Phase 3 — AI Layer 6. aml.bicep (Workspace linked to Key Vault + Log Analytics) 7. aoai.bicep (GPT-4o, UK South, private endpoint) Phase 4 — Integration Layer 8. apim.bicep (AISP gateway, WAF, CONDITION 1 enforcement) 9. functions.bicep (re-scoring API, Managed Identity role assignments) ``` --- ## THEMIS HANDOFF NOTES The following decisions require Themis compliance cross-reference before Gate 3 closes: | ADR | Item | Themis Action Required | |-----|------|----------------------| | ADR-003 | Azure OpenAI rationale generation | Validate output format satisfies Consumer Duty obligation | | ADR-006 | Immutable Blob retention period | Confirm FCA retention period before WORM lock is applied | | ADR-006 | Audit trail scope | Confirm ISO 27001 Annex A.12.4 log management controls are met | | ADR-007 | Private endpoint configuration | Confirm NCSC CAF A2 alignment | --- *Issued by: Vitruvius — BMAD Architect Agent, Talastron Kinetic AI* *Engagement ID: TKA-NB-20260702-001* *Talastron BMAD Pipeline: Stage 2 of 5 — Architecture (ADR Complete)*