Modernisation proposal for review; durations are indicative.

Proposed Agent and Human Review Team

Status and operating boundary

This is an unapproved team design for the delivery slices in the modernisation proposal. It describes bounded roles that could support planning and evidence gathering; it does not imply deployed agents, committed staffing, funding, approval, or authority to change systems or data.

Agent roles are task personas, not autonomous owners. They may inspect supplied or explicitly accessible non-production material, prepare comparisons, generate test candidates, and report discrepancies. They must not approve business rules, select policy meanings, accept security risk, activate production changes, alter authoritative data, rotate credentials, contact suppliers, or make cutover and retirement decisions. Human reviewers remain accountable for interpretation, approval, execution authority, and risk acceptance.

A person may cover more than one human role where independence is not compromised. Availability, capacity, named ownership, and separation-of-duty requirements have not been established. Scarce specialists and shared environments must be identified during “Recover and Characterize the Executable Baseline,” rather than assumed.

Common team controls

Each task should have a delivery participant and an independent reviewer. The reviewer should not be the sole author of the implementation or evidence under review. High-impact authorization, finance, guarantee, migration, recovery, and cutover decisions require review by people with the relevant business or operational authority; an agent comparison cannot provide that approval.

Agents should work from approved, bounded task packets containing the delivery-slice title, accessible environment, permitted actions, expected evidence, compatibility constraints, stop conditions, and required human reviewers. Missing, malformed, contradictory, or inaccessible evidence must be reported as unresolved rather than completed by assumption.

Agent outputs should distinguish:

• observed implementation or runtime behaviour;
• confirmed requirements and accepted compatibility constraints;
• test expectations that may not reflect runtime behaviour;
• qualified findings and conditional risks;
• contradictions requiring a decision;
• unsupported claims;
• implementation candidates that remain unapproved.

No agent should treat compilation, test success, artefact processing, configuration presence, or broad inventory coverage as proof of production behaviour or semantic completeness. Any proposed mutation should be preceded by characterization of the current path and should remain inactive until its contract and acceptance evidence are approved.

Human and agent effort should be recorded separately from waiting time and elapsed time. After the first accepted delivery slice, the team should use observed effort, review delays, environment contention, and elapsed time to recalibrate the remaining planning ranges. No benefit, capacity, readiness, staffing, or schedule claim should be inferred before the relevant measures and owners are approved.

Coordination roles

Human delivery coordinator

The human delivery coordinator maintains the sequence and dependencies between the named delivery slices, arranges access and review, records blockers, and ensures that unresolved decisions remain visible. This role does not acquire authority to approve business, security, data, architecture, or production decisions merely by coordinating them.

Agent work coordinator

The agent work coordinator divides an accepted task packet into small, reversible assignments, checks that agents stay within their evidence boundary, and assembles outputs for human review. It may detect inconsistent conclusions across agent tasks but may not resolve those contradictions without accountable human input.

Compatibility custodian

The compatibility custodian maintains the human-readable catalogue of observed interfaces, behaviours, messages, status meanings, ordering, nullability, documents, reports, audit effects, event timing, and save behaviour. Agents may propose catalogue entries and comparisons. A human application or product reviewer accepts their interpretation and decides whether an item is to be preserved, changed, resolved, or deferred.

Independent assurance reviewer

The independent assurance reviewer challenges evidence sufficiency, test independence, unexplained exclusions, and claims of equivalence or readiness. The reviewer should sample underlying observations and failed cases, not only summaries. This role should remain independent of the implementation being assessed and should escalate unresolved security, financial, migration, recovery, or customer-continuity concerns to the relevant human authority.

Team for “Recover and Characterize the Executable Baseline”

Agent personas

The artefact inventory agent inventories accessible projects, configuration, routes, middleware, registrations, handlers, validators, persistence paths, database artefacts, migrations, templates, scripts, integrations, and operational material. It records omissions and contradictions without claiming fleet-wide coverage.

The baseline reproduction agent prepares repeatable non-production build and deployment steps, captures dependency and configuration failures, and compares repeated runs. It cannot infer production topology or modify production configuration.

The journey trace agent follows one human-approved representative journey through identity, authorization, validation, persistence, audit, events, files or external effects, response, and failure handling. It stops where access or evidence is absent and does not generalize one journey to all workflows.

The compatibility characterization agent generates tests and observations for successful, denied, malformed, and dependency-failure paths. It proposes compatibility entries but does not decide whether surprising behaviour is a requirement or defect.

The restore evidence agent prepares non-production backup and restore observation checklists and captures results from a human-authorized demonstration. It does not operate production recovery facilities.

Human roles

Application participants explain code and runtime composition. Platform and operations participants provide authorized environment, deployment, configuration, logging, backup, file-store, and topology evidence. Database participants confirm provider, schema, migration state, and restoration constraints. Security participants review authentication schemes, secret exposure, and access arrangements.

Acceptance should be performed jointly by accountable application, platform, database, security, and operations representatives. Independent assurance should sample deployment repetition, denied and dependency-failure observations, and restore evidence. Unknown callers, production-only behaviour, missing operational contacts, and inaccessible dependencies remain blockers for affected later work.

Team for “Establish Measures and Approval Evidence”

Agent personas

The measurement definition agent drafts precise candidate definitions for deployment frequency, change lead time, failed-change rate, restoration time, restore success, unresolved security findings, dead-letter age, reconciliation differences, authorization-test coverage, and incidents. It identifies required sources, exclusions, sampling periods, and calculation ambiguities.

The evidence collection agent prepares approved collection or instrumentation changes and separates agent runtime, human effort, waiting time, and elapsed time. It must not introduce production telemetry without authorization.

The scenario analyst agent applies accepted definitions to low, central, and high planning scenarios and exposes assumptions about access, suppliers, reviewers, representative data, and shared environments. It must not present scenarios as commitments.

Human roles

Product, security, data, architecture, platform, and operations representatives decide which measures are useful, approve definitions, nominate accountable owners, and set baselines or targets only when measured evidence supports them. Operations and incident owners validate operational records; delivery participants validate effort and waiting-time records.

Independent review should verify that reported values are measured rather than inferred, that calculations can be repeated, and that adverse or missing observations have not been excluded. Every adopted indicator requires an approved owner, source, baseline, target, sampling period, and calculation method; unknown values remain explicitly unestablished.

Team for “Resolve Identity, Relationships and Authorization”

Agent personas

The identity flow tracer maps bearer and cookie authentication, subject resolution, claims transformation, refresh, inactive-user handling, recovery, and failure responses across accessible paths.

The authorization matrix agent drafts action-resource-identity-relationship-state cases for notifications, movements, assessments, files, reports, finance, guarantees, sharing, administration, and account operations. It marks unobserved combinations rather than assuming deny or allow behaviour.

The tampering test agent generates bounded tests for posted ownership, hidden identifiers, memberships, facilities, authorities, routes, statuses, amounts, dates, selected users, and files. Tests run only in authorized non-production contexts.

The policy implementation agent implements narrowly approved centralized checks and secret-access integration behind controlled activation. It may not choose identity providers, exceptional-access rules, or relationship cardinalities.

Human roles

Security representatives decide acceptable authentication and authorization controls and assess anonymous reachability, default-allow behaviour, temporary-state deserialization, credential expiry, and key rotation. Product and application representatives define business ownership, membership, organization, authority, and exceptional-access meanings. Identity administrators provide approved provider and client evidence.

Independent security review should verify deny paths, server-side relationship reloads, malformed claims, inactive users, outage behaviour, and absence of reliance on client-side controls. Microsoft Entra ID, managed identities, and Key Vault remain candidates until baseline compatibility and accountable approval are established.

Team for “Formalize Lifecycles and Identifiers”

Agent personas

The lifecycle evidence agent extracts observed transitions, actor checks, editability, persistence timing, audit effects, events, and responses for notifications, assessments, movements, shipments, receipts, rejection, recovery, completion, cancellation, withdrawal, resubmission, unlocking, prohibition, closure, and archive.

The contradiction analyst presents conflicting evidence, including submitted versus awaiting-payment behaviour, rejection precedence, partial rejection, terminal states, and cancellation versus deletion. It offers consequences and test cases without selecting a rule.

The identifier behaviour agent characterizes normalization, visible formats, lookup failures, allocation, uniqueness assumptions, shipment bounds, and concurrent allocation behaviour.

The concurrency test agent prepares tests for duplicate, stale, repeated, and simultaneous commands, failed saves, bulk interruption, and event failure.

Human roles

Product and policy representatives decide lifecycle meanings and actor permissions. Movement specialists resolve movement, shipment, receipt, rejection, recovery, and completion rules. Finance and reporting representatives assess downstream consequences of status and identifier decisions. Data representatives decide identifier scope and database implications.

Independent review should reconcile approved contracts with authorization, persistence, audit, event, report, and failure behaviour at record level. No state machine, uniqueness control, or direct state-changing replacement should be activated while the underlying business decision remains unresolved.

Team for “Resolve Calculations and Reference Meanings”

Agent personas

The data profiling agent profiles approved non-production records for date boundaries, mixed units, decimal precision, overlapping prices, payment and refund patterns, multiple approved guarantees, route ordinals, facility cardinalities, and historical reference values. It reports distributions and anomalies without silently correcting them.

The boundary test agent generates workflow-specific date, calendar, quantity, rounding, finance, guarantee, route, and classification cases. It preserves distinctions between warnings, blocking validation, exceptions, and conversion failures.

The record comparison agent compares current and proposed calculations at record level and classifies differences by known rule, unresolved contradiction, data quality issue, or implementation defect candidate.

The reference-meaning preservation agent checks that obsolete, not-listed, not-applicable, sentinel, standard, and custom values remain distinguishable. It must not normalize or reclassify historical records.

Human roles

Policy and business representatives decide workflow-specific dates, calendars, warnings, blocking rules, lifecycle dependencies, and classification meanings. Finance representatives decide pricing, payment, refund, currency, precision, and precedence rules. Data representatives decide historical interpretation and preservation. Guarantee specialists decide cardinality, release, supersession, approval, and refusal semantics. Security representatives review separation of duty and self-approval concerns.

Independent review should sample source records and calculations, challenge aggregate-only comparisons, and verify concurrent financial and guarantee cases. Legal or policy conflicts remain with accountable human owners. No silent deduplication, conversion, reclassification, or new guarantee uniqueness constraint is within an agent’s authority.

Team for “Introduce Modular and Durable Mutation Boundaries”

Agent personas

The coupling discovery agent traces cross-boundary reads, writes, synchronous expectations, file effects, audits, caches, and event dispatch. It identifies candidate seams without presuming a service-per-domain architecture.

The compatibility seam agent implements one approved bounded interface while preserving characterized request, response, status, message, timing, and failure behaviour.

The transaction and concurrency agent prepares controlled changes and tests for authoritative writers, transaction boundaries, row conflicts, failed saves, and reconciliation.

The delivery durability agent prototypes approved outbox, replay, duplicate, ordering, poison-message, and dead-letter behaviour. A prototype is not authority to introduce asynchronous behaviour where synchronous completion is required.

The reversible release agent prepares controlled activation, rollback or forward-recovery steps, and feature-flag safeguards for the bounded capability.

Human roles

Architecture and application representatives approve authority boundaries and compatibility interfaces. Security representatives review privilege, feature-flag administration, and audit requirements. Operations representatives approve recovery, replay, alerting, and deployment procedures. Business owners decide whether timing or failure behaviour may change.

Independent review should test termination after commit, duplicates, out-of-order delivery, dependency timeout, poison messages, replay, and audit distinctions between attempted, denied, failed, and successful outcomes. Azure App Service, Container Apps, Functions, Service Bus, and an outbox remain conditional options whose suitability depends on baseline and contract evidence.

Team for “Secure Files and Preserve Generated Documents”

Agent personas

The file-flow characterization agent traces upload, scanning, storage, metadata, retrieval, authorization, generation, conversion, temporary files, and cleanup.

The file security test agent prepares cases for content type, signatures, active content, size handling, unsafe names and paths, interrupted transfers, scanner timeout, outage, unknown results, and unauthorized downloads.

The document comparison agent compares filenames, versions, ordered content, layouts, visible text, annexes, and repeated generation. It reports rendering differences for consumer review rather than declaring them acceptable.

The orphan reconciliation agent detects mismatches between relational ownership, stored files, scan state, generated outputs, and cleanup state.

Human roles

Security representatives decide quarantine, promotion, scanner-result, and active-content policies. Data and records representatives decide retention, legal hold, deletion, and restoration requirements. Operations representatives decide storage, cleanup, outage, and recovery procedures. Document consumers approve any visible or structural difference.

Independent review should verify authorization, protected storage, quarantine evidence, interrupted-transfer recovery, cleanup, and restoration from retained source material. Unknown, error, timeout, or unavailable scanning must not be treated as clean. Private Azure Blob Storage remains a candidate rather than an approved destination.

Team for “Establish Reporting and Operational Readiness”

Agent personas

The report fixture agent captures approved representative small, empty, and large result sets and records columns, aliases, ordering, null handling, status derivation, date boundaries, workbook structures, and authorization context.

The report comparison agent performs record-, field-, and presentation-level comparisons between current and proposed paths. It does not infer acceptability from equal row counts.

The telemetry correlation agent prepares approved correlation across requests, database work, durable delivery, messages, files, and dependencies while checking for sensitive logging.

The runbook exercise agent supports repeatable simulations of alerts, reconciliation, dependency failure, backup restoration, and recovery actions and records deviations.

Human roles

Report consumers and product representatives approve output compatibility and freshness expectations. Data representatives validate joins, derivations, null handling, and reconciliation. Operations representatives own accepted alerts, escalation paths, runbooks, and recovery actions. Security representatives review report authorization and sensitive exports.

Independent review should sample data lineage, large-result behaviour, refresh divergence, alert routing, and restoration evidence. Availability, performance, support hours, retention, report freshness, recovery-time, and recovery-point objectives remain human approval decisions. Azure Monitor, Application Insights, and Log Analytics remain candidates.

Team for “Rehearse Deterministic Migration, Cutover and Recovery”

Agent personas

The migration profiler runs approved preflight diagnostics for nulls, duplicates, orphans, invalid references, cardinalities, units, precision, business keys, migration state, and downstream consumers.

The deterministic transformation agent implements only approved mappings, survivor rules, rejected-record retention, checkpoints, and rerun behaviour. It must halt on unclassified discrepancies rather than improvise a correction.

The reconciliation agent compares source and target records, relationships, lifecycle history, finance, quantities, files, reports, and reference meanings using approved tolerances and rules.

The interruption and recovery agent exercises checkpoint restart, restore, message replay, dependency failure, rollback, or forward recovery in authorized rehearsal environments.

The controlled-routing agent supports approved coexistence and cutover rehearsals, detects uncontrolled dual writing, and records activation and recovery trigger evidence.

Human roles

Data representatives approve mappings and investigate discrepancies. Business representatives sample records and confirm preserved meanings. Security representatives review access and sensitive-data handling. Operations representatives conduct authorized backup, restore, routing, and recovery actions. Change authorities decide activation, rollback, forward recovery, and retirement after required evidence is accepted.

Independent migration assurance should inspect source-to-target reconciliation, rejected records, restart behaviour, restore evidence, caller coverage, scheduled work, retained history, and operational ownership. Azure SQL Database and Azure SQL Managed Instance remain conditional options. Agents cannot authorize production activation, downtime, legacy retirement, or deletion of historical data.

Review and escalation model

Routine evidence should receive peer review by a different agent persona where practical, followed by accountable human interpretation. Security-sensitive work should receive independent security review. Calculation, finance, guarantee, and reference-data work should receive independent business or data review. Migration, restore, and cutover evidence should receive independent operational and data assurance.

An agent must stop and escalate when it encounters credentials outside the approved mechanism, possible production access, personal or sensitive data outside the task boundary, destructive operations, an unapproved schema or interface change, unexplained reconciliation differences, contradictory acceptance rules, uncontrolled external effects, or evidence that the planned rollback or recovery path is not viable.

Disagreement should not be hidden by majority opinion. The delivery coordinator should retain the competing observations, affected compatibility constraints, decision owner, blocked slices, and evidence needed to resolve the issue.

Initial mobilization proposal

Mobilization should begin only with the roles needed for “Recover and Characterize the Executable Baseline.” That slice should identify actual access constraints, reviewer availability, operational ownership, scarce specialists, shared integration resources, and the amount of agent and human work required. The result should be used to revise the proposed role mix and all remaining ranges.

Later personas should be activated only when their prerequisite slices and task packets are accepted. This limits speculative work, avoids encoding unresolved business rules, and preserves the proposal’s incremental, independently verifiable delivery model.