ADR Design Guardrails
Status: Accepted | Date: 2025-03-07 | Review: 2026-03-07
These six guardrails guide day-to-day technical design decisions in this repository. They help teams make consistent trade-offs when writing and reviewing Architecture Decision Records (ADRs).
They are not enterprise architecture principles, procurement policies, or technology standards for whole-of-government or agency-level use.
1. Establish secure foundations
Integrate security practices from the outset, and throughout the design, development and deployment of products and services, per the ACSC Foundations for modern defensible architecture.
2. Understand and govern data
Use authoritative data sources to ensure data consistency, integrity, and quality. Embed data management and governance practices, including information classification, records management, and Privacy and Responsible Information Sharing, throughout information lifecycles.
3. Prioritise user experience
Apply user-centred design principles to simplify tasks and establish intuitive mappings between user intentions and system responses. Involve users throughout design and development to iteratively evaluate and refine product goals and requirements.
4. Preference tried and tested approaches
Adopt sustainable open source software, and mature managed services where capabilities closely match business needs. When necessary, bespoke service development should be led by internal technical capabilities to ensure appropriate risk ownership. Bespoke software should preference open standards and code to avoid vendor lock-in.
5. Embrace change, release early, release often
Design services as loosely coupled modules with clear boundaries and responsibilities. Release often with tight feedback loops to test assumptions, learn, and iterate. Enable frequent and predictable high-impact changes (your service does not deliver or add value until it is in the hands of users) per the CNCF Cloud Native Definition.
6. Default to open
Encourage transparency, inclusivity, adaptability, collaboration, and community by defaulting to permissive licensing of code and artifacts developed with public funding.