# NORTHBRIDGE BANK — WELL-ARCHITECTED FRAMEWORK SCORECARD ## AI Credit Re-Scoring Platform — Gate 5 Runtime Assessment --- | Field | Value | |-------|-------| | **Document ID** | TKA-NB-WAF-001 | | **Engagement** | TKA-NB-20260702-001 | | **Reviewer** | Themis — Compliance & QA Agent, Talastron Kinetic AI | | **Date** | 2 July 2026 | | **Stage** | Gate 5 — Handover (Runtime / As-Built Assessment) | | **Prior assessment** | TKA-NB-ADR-001 §WAF Pillar Assessment (Vitruvius, design-time) | | **Scope reviewed** | `rg-northbridge-credit-scoring-prod` — 6 deployed Bicep modules | | **Classification** | RESTRICTED — FCA Consumer Credit // OFFICIAL-SENSITIVE | --- ## SCORING BASIS Vitruvius scored this platform against **design intent** at Gate 3. This scorecard re-scores it against **what is actually deployed** — the running resource group, its configuration, and its diagnostic wiring. A pillar can score lower here than at design time even with no design error, if the built artefact hasn't yet caught up with the design. Minimum passing score: **6/10** per pillar. Target: **8/10** per pillar. --- ## PILLAR SCORES | Pillar | Design-time (ADR-001) | As-built (Gate 5) | Delta | Status | |--------|:---:|:---:|:---:|:---:| | Security | 9/10 | **8/10** | −1 | 🟢 Above minimum | | Reliability | 7/10 | **6/10** | −1 | 🟡 At minimum | | Cost Optimization | 7/10 | **7/10** | — | 🟢 Above minimum | | Operational Excellence | 8/10 | **7/10** | −1 | 🟢 Above minimum | | Performance Efficiency | 7/10 | **7/10** | — | 🟢 Above minimum | **Composite score: 7.0 / 10 (70%)** --- ## SECURITY — 8/10 **Confirmed clean on inspection:** - Every deployed resource (`sql.bicep`, `keyvault.bicep`, `aml.bicep`, `aoai.bicep`) sets `publicNetworkAccess: 'Disabled'` and ships a private endpoint into `snet-data`. APIM is `virtualNetworkType: 'Internal'` — no public gateway surface. This is materially consistent with ADR-007. No gap found. - Key Vault uses RBAC authorisation only (`enableRbacAuthorization: true`), deny-by-default network ACLs, purge protection, and a single scoped `Key Vault Administrator` role assignment. No legacy access policies. No excess role grants found — ADR-005 least-privilege intent is honoured in the built artefact. - Azure SQL is Azure AD-only auth — `administratorLogin`/`administratorLoginPassword` are both `null`. No SQL password exists anywhere in this platform. **Deductions:** - APIM's `GatewayLogs` diagnostic category is enabled with no policy-level redaction of the `Authorization` / OAuth bearer header before export to Log Analytics. Once the AISP gateway policy is activated (Condition 1), the AISP OAuth token is at risk of appearing in gateway trace logs. No `set-header` / redaction policy is present in the module to prevent this. - Azure OpenAI's diagnostics include the `RequestResponse` log category, which persists full prompt and completion text — including SHAP-derived applicant feature values and generated rationale — into Log Analytics, outside the governed SQL/Blob audit tiers. Both are runtime configuration findings, not design flaws. See `northbridge-gate5-handover.md` findings H1–M2 for full detail. --- ## RELIABILITY — 6/10 **What's solid:** Azure SQL Hyperscale is deployed zone-redundant with zone-redundant backup storage and read-scale enabled. APIM Premium and AML Workspace both support zone-redundant configuration at their tier. Single-region-by-mandate (UK South only, no cross-region failover) remains an accepted client constraint, not a build defect — consistent with Vitruvius's original assessment. **Why the score dropped:** Reliability cannot be assessed end-to-end because the workload that actually processes a credit decision doesn't exist yet at runtime. There is no deployed Azure Functions app for the re-scoring API — APIM's `rescoring-api-base-url` named value points to `https://func-northbridge-prod.azurewebsites.net`, but no Function App resource exists in this resource group to serve it. There is also no Event Hubs namespace and no audit consumer Function. A platform cannot be scored for resilience on a decision path that isn't wired up yet. This pillar sits at the minimum passing score, not below it, because everything that *is* deployed is reliable — the gap is completeness, not fragility. --- ## COST OPTIMIZATION — 7/10 Azure SQL Hyperscale, AML auto-scale-to-zero compute, and consumption-based Azure OpenAI billing are all cost-conscious choices carried through from design into the build. No change from Vitruvius's design-time score — the missing components (Functions, Event Hubs) don't change the cost posture of what has been deployed, they simply aren't billing yet. See the projected run-cost estimate in the Gate 5 handover report. --- ## OPERATIONAL EXCELLENCE — 7/10 Bicep AVM modules throughout, environment tagging per CAF convention (ADR-008), and diagnostic settings wired to a single Log Analytics workspace on every resource. Score reduced by one point from design time because the Responsible AI Dashboard — mandatory per ADR-002 — has not yet been configured (it is a post-deployment AML pipeline step, and no training pipeline has run, since no training dataset has been ingested — AMB-01 remains open). Operational tooling for a workload that hasn't started training isn't yet exercised. --- ## PERFORMANCE EFFICIENCY — 7/10 AML and Azure OpenAI are deployed with sensible capacity settings (GPT-4o at 30k TPM, AML Basic workspace ready for compute attach). No change from design time — the target end-to-end decision latency (sub-2 seconds) cited in the HLD cannot yet be measured because the orchestrating Function App does not exist to generate a real request. Infrastructure-level performance characteristics of what is deployed are sound. --- ## SUMMARY All five pillars clear the minimum threshold of 6/10. None reach the target of 8/10 at runtime, primarily because two components central to the platform's actual purpose — the re-scoring API compute layer and the FCA three-tier audit trail — have not yet been deployed. This is not a design failure; it is an incomplete build. Full detail and remediation ownership is in the Gate 5 handover report. --- *Issued by: Themis — Compliance & QA Agent, Talastron Kinetic AI* *Engagement ID: TKA-NB-20260702-001* *Talastron BMAD Pipeline: Stage 5 of 5 — Handover (WAF Runtime Scorecard Complete)* *This scorecard is binding. Findings are not advisory.*