Architecture Governance

Architecture governance is the set of decision rights, review processes, and standards that keep individual projects aligned with the enterprise architecture over time.

At a glance

• What it is: Principles/standards, an architecture review board (ARB), and a waiver process for tracked exceptions.
• Why it matters: Standards nobody enforces are just suggestions — governance is what gives the enterprise view teeth.
• For developers: an ARB review is a design review with formal decision rights — bring the same design doc you’d bring to a peer review, plus which standard(s) you need a waiver from, if any.
• When to use it: Any new solution design, or a proposed change to an existing architecture standard.
• When not to use it: For decisions with no cross-team impact and no standards implication — over-applying governance slows delivery without adding value.
• Prerequisites: Reference Architectures & Technology Standards, since that’s what governance checks proposals against.

Mental model

flowchart LR
    P[Team proposes a design] --> R[ARB review]
    R -->|Meets standards| A[Approved]
    R -->|Deviates, justified| W[Waiver granted & recorded]
    R -->|Not ready| X[Returned for rework]

Step-by-step walkthrough

1. Draft a solution design that references applicable standards.
2. Submit it to the architecture review board (ARB) at a defined checkpoint (e.g. before funding, before build).
3. The ARB checks the design against principles and standards.
4. Outcome: approved, approved with conditions, a waiver (tracked deviation with justification), or returned for rework.
5. Record the decision — including any waiver — in the architecture repository.

Worked example

A team wants to use a NoSQL database that isn’t on the approved technology standards list.

• Input: a design proposal citing a business reason (e.g. workload doesn’t fit the approved relational standard).
• Process: the ARB reviews the risk and justification.
• Output: a time-boxed waiver is granted, with a condition to re-review the decision in 12 months, recorded in the architecture repository.

Common use cases

Use case	When to use	Notes
New solution design	Before funding or before build	Standard checkpoint for ARB review
Deviating from a standard	A standard doesn’t fit a specific case	Request a waiver instead of silently ignoring the standard
Changing a standard itself	The standard needs to evolve	Governance applies to architecture changes, not just individual projects
Bypassing a network-isolation standard (e.g. public database endpoint)	A team wants to expose a database directly instead of via private endpoint + Front Door/gateway	Default should be denial; require an ARB-reviewed, time-boxed waiver, not a silent exception

Advanced details

• Governance also covers changes to the standards themselves, not only individual project designs.
• Balancing agility and control matters: over-applying governance to low-risk decisions makes teams route around it entirely.
• Waivers should always be time-boxed and revisited — an untracked, permanent exception defeats the purpose of having a standard.

Quick reference

Term	Meaning
Principle/standard	An agreed rule a solution should follow
ARB (Architecture Review Board)	Recurring forum that checks proposed designs against standards
Waiver	A tracked, justified exception to a standard

Troubleshooting

Symptom	Likely cause	Fix
Teams route around governance	Review process seen as a slow blocker	Streamline checkpoints; delegate low-risk decisions away from full ARB review
Standards drift out of date	No process for changing standards themselves	Apply the same governance process to standard changes, not just projects
Same waiver requested repeatedly	Underlying standard doesn’t fit a common case	Revisit and update the standard instead of re-granting the same waiver
A database ends up with a public endpoint in production	No standard (or unenforced standard) requiring private endpoints for data stores	Add “no public data-store endpoints” as an enforced standard, checked at ARB review

Check your understanding

• Why can a standard that’s never enforced be considered equivalent to having no standard at all?
• Describe a situation where a waiver, rather than a rejection, is the right governance outcome.

Related pages

Part of Introduction to Enterprise Architecture. See Reference Architectures & Standards for what governance actually enforces, EA Frameworks for how TOGAF formalizes governance as part of the ADM cycle, and the Glossary for term definitions.