AITIR 2.0 · Seven-Plane Identity-Risk Decision Architecture
Evidence in, authority out · Analytics produce evidence · Authorized policy decides · Enforcement acts · Assurance verifies
VERSION 2.0.0
REFERENCE ARCHITECTURE
1
Governance, Risk & Policy
Mission context · lawful purpose · risk appetite · decision rights · T0–T3 authority · privacy/records/accessibility · policy, model & connector approval
Cross-plane constraints: accountability · minimization · provenance · separation of duty · release gates · independent assessment
UNTRUSTED / COLLECTION
ANALYTICS
DECISION AUTHORITY
ENFORCEMENT
2
Identity, Asset &Telemetry Fabric
• IdP · directory · MFA · PAM
• endpoint · network · cloud · apps
• people · workloads · sessions
• resources · entitlements · cases
• schema · time · integrity · retention
• source health · uncertain identity joins
OUTPUT · VERSIONED EVENT OBJECT
3
AITIR Analytics
• deterministic quality & rules
• role / peer / mission context
• point & sequence analysis
• identity / attack graph analysis
• supervised models where justified
• calibration · uncertainty · abstention
OUTPUT · EXPIRING EVIDENCE
4
Risk Decision &Authorization
• evidence + impact + mission context
• policy version + named authority
• T0 observe · T1 verify
• T2 contain · T3 consequential
• 12 guards · approval · rollback
• deny · abstain · authorize · expire
OUTPUT · BOUNDED DECISION
5
Response Orchestration
• least-privileged connector
• decision validity + precondition
• idempotency + bounded retry
• evidence preservation
• partial-failure detection
• rollback + independent verification
OUTPUT · ACTION + VERIFIED OUTCOME
6
Assurance, Model Risk & Audit
Model/data/policy cards · chronological validation · calibration & drift · review burden
Policy/state/mutation tests · SBOM · release evidence · immutable decision records
Unauthorized-action count · fault injection · explanation stability · rollback · assessment
FEEDBACK IS QUARANTINED · VALIDATED · VERSIONED · APPROVED BEFORE RELEASE
7
Resilience & Continuity
Source · model · policy service · IdP · network · connector failure modes
Approved deterministic fallback · stronger verification · mission-specific recovery objectives
Bounded break-glass · backup & recovery · no fail-open or indiscriminate fail-closed defaults
DEGRADED OPERATION IS AN EXPLICIT AUTHORIZED STATE
Canonical name: Adaptive Identity-and-access Threat Intelligence and Response · Reference architecture, not production certification
github.com/sajjad47/AITIR-Framework