Cortex enterprise architecture
Where the platform stands on the concerns an enterprise architecture review raises about software built by an AI-assisted platform: what is the deployable unit, how identity and authorization are enforced centrally, what happens when a developer edits generated code, how API contracts survive change, how one product serves many tenants, and what the platform is for. Each page takes one concern, describes what is in place, and names what is still to do.
The concerns
| Concern | Page | Standing in one line |
|---|---|---|
| What exactly is deployed, and can the customer build and run it alone | Deployment and runtime | In place One container image per application service, delivered as ordinary source with compose, Kubernetes, Container Apps, CI and a runbook. The platform is not needed at run time. |
| Central enforcement of authentication, authorization and identity for every generated service | Security and identity | Partial Identity, role and attribute access, tenant policies, secrets and audit are in place for everything that runs through the platform. A security profile stamped into every generated service, and end-user token exchange, are still to do. |
| A shared vocabulary | Terminology | In place One sheet, from the project to the deployment package. |
| Developer-written code next to generated code, and the source of truth afterwards | Developer code and generated code | Partial Edits made on the platform are the source the next change starts from, and requirement status is re-derived from the live code. Commits made in the exported repository do not flow back yet. |
| Changing behaviour without breaking the APIs other systems integrate with | API contracts and versioning | Partial Contracts are enforced as requirement-linked tests that gate every promotion. A schema-level breaking-change gate is still to do. |
| One generated product serving many tenants | Multi-tenancy | Partial Dedicated deployment per tenant, and a shared deployment with tenant row policies, are in place. A per-tenant connection map inside one application is the application's own design. |
| What the platform is, next to code generators and agent frameworks | Positioning | The platform governs the whole lifecycle; generation and agent execution are two stages of it. |
How to read the pages
Every page has the same shape: the concern, the short answer, the mechanism with a standing tag on each claim, and a closing section on what is still to do. The pages describe the platform at the architecture level and stay true across implementations, so they name no internal component, file or setting. The product documentation they build on and the trust center with the operational controls and policies are linked in the top bar.