Chapter 77 — Security architecture review: the senior-engineer playbook
In one sentence
A senior security review turns a vague design into assets, trust boundaries, attack paths, controls, residual risk, and specific engineering decisions.
The review flow
1. What are we building?
2. What data, identities, money, safety, or availability does it affect?
3. Who can reach it?
4. What are the trust boundaries?
5. What are the top abuse/misuse cases?
6. What attack paths matter?
7. Which controls break those paths?
8. How will we detect failure?
9. What is the residual risk and owner?
10. What must be true before launch?
Artifacts to ask for
- architecture diagram;
- data-flow diagram;
- identity/authorization model;
- deployment model;
- logging/monitoring plan;
- third-party/dependency list;
- operational runbook;
- rollback plan;
- privacy/data-retention notes.
Review output template
Decision: approve with required fixes
Critical launch blockers:
1. Tenant authorization is enforced only at API gateway; move object-level
checks into service/data layer before launch.
2. Production support role can export all customer data; split role and add
just-in-time approval.
Non-blocking follow-ups:
1. Add detection for bulk export by tenant.
2. Add quarterly access review for support tooling.
Accepted residual risk:
Search index contains denormalized customer metadata for 7 days after deletion.
Owner: Data Platform. Compensating control: deletion queue metrics + weekly audit.
Across the series
- Architecture decisions by layer (L4 vs L7, where TLS terminates, who owns what): OSI guide, Part 15. An end-to-end diagnosis of one URL across DNS, transport, TLS, HTTP, cache, browser, and security headers: HTTPS guide, Chapter 18. The whole request traced through every guide: HTTPS guide, Chapter 25.
Common mistakes
- Producing a long list of generic best practices instead of launch decisions.
- Reviewing too late, when architecture is already fixed.
- Ignoring operations: detection, rollback, key rotation, access review.
- Treating "encrypted" or "behind auth" as complete answers.