Phase A — Architecture Vision

What Schema-to-Screen is for, who it serves, and the one-picture solution concept the rest of the ADM elaborates. Outputs: solution concept diagram, stakeholder map, driver → outcome chain, business scenario, scope and constraints.

A0 · Vision statementThe architecture in one paragraph

Vision

Any legitimate business question over the enterprise's data becomes a governed, published screen in minutes — generated by agents that only ever see a retrieved subgraph of the schema, verified by deterministic gates, approved by a person, and served through one graph where authorization is compiled into every query.

In scope
  • Read-mostly business screens across ~12 archetypes (lists, 360s, queues, exceptions, reconciliations, dashboards…)
  • Write actions as proposals with platform-enforced approval
  • Thousands of tables across many databases; thousands of use cases
  • Hybrid UI: spec-driven by default, reviewed custom components by exception
Out of scope
  • Warehouse-scale aggregation and analytics (composed in from the warehouse, not generated)
  • Complex transactional business logic (stays in coded services, exposed as subgraphs)
  • Autonomous writes to systems of record
  • Free-form text-to-SQL for end users
Constraints & assumptions
  • Classification coverage is a prerequisite for enabling a domain
  • Generation runs against sample data only; never production
  • TypeScript end-to-end; provider-agnostic LLM access with pinned versions
  • Reference implementation over a scaled public sample database (≥3,000 tables, synthetic data)

A1 · Solution concept diagramDemand → governed generation → one graph → business users

The high-level shape a sponsor needs to agree to before Phases B–D elaborate it: two halves of one platform (generation and runtime) standing on two catalogs (schema and policy), between business demand and the systems of record.

Minutes per use casearchetypes + subgraph; review is the bottleneck Authorization compiled inentitlements in every query; policy per field Zero unreviewed codecontracts, not code; escape hatch reviewed once Computed blast radiusdrift re-verifies every affected use case BUSINESS DEMAND Requesters Product owners · business analysts Domain leads (CS, finance, ops, HR…) ~1,000 use cases approval queues · 360 views exception lists · reconciliations dashboards · wizards · audit trails Asked in prose "Accounts with overdue invoices and open high-priority tickets, with a credit-hold action." SCHEMA-TO-SCREEN PLATFORM GENERATION · AGENTIC, RAG-GROUNDED, GATED Intakeprose → typed spec Schema Scoutsubgraph ≤30 tables Composersslice + UI spec Nine gatesdeterministic Reviewhuman approves Sees catalog cards and sample data only · every artifact cites its sources · retries capped · parks for a human RUNTIME · ONE GRAPH, UI ON DEMAND Registry + gatewaysupergraph · persisted ops only Query compilerGraphQL → SQL + entitlements React spec runtimeregistry components · proposals GROUNDING · WHAT THE AGENTS ARE ALLOWED TO KNOW Semantic catalog (RAG)one reviewed card per table · join-path cards · versioned Policy catalogclassification · role → row/column scope SYSTEMS OF RECORD 3,000+ tables many databases, many owners read via compiled, scoped SQL only writes only via approved proposals crawled → next catalog version BUSINESS USERS Consume screens see only what their claims allow act through proposals every screen uniform in security, telemetry and accessibility publish scoped SQL crawler · schema, comments, profiles, query logs → next catalog version GUARDRAILS THAT HOLD AT EVERY STEP Subgraph, never the schema Contracts, not code Authorization declared once Reads publish · writes propose Release unit = whole tuple Human approves first publish + writes

A2 · Stakeholder mapWho cares about what — and which view answers them

Each stakeholder's concerns map to a view in this set. Power/interest classification drives who signs the architecture contract (Phase G).

StakeholderKey concernsPower / interestAnswered by
CISO / security architectureWhere authorization is enforced; PII exposure; prompt-injection blast radius; what the model can see; auditabilityHigh / High — signs offData security view · Runtime sequence · Gates
Data owners / stewardsCatalog quality; who reviews table descriptions; classification coverage; blast radius of schema changesMedium / HighData lifecycle · Change management
Product owners / domain leadsTime from request to screen; fit of generated screens; what they can and cannot ask forMedium / HighValue stream · Business scenario
Platform engineeringSupergraph composition at 1,000 slices; drift; runtime load; escape-hatch governanceHigh / HighApplication architecture · Technology
Compliance / internal auditEvidence: who approved what, against which release unit; reproducibility of any screen's SQLMedium / MediumRelease unit entity · Governance
FinOpsModel spend per use case; database load from generated queries; cache effectivenessLow / MediumTechnology catalog (cost notes)
Application developersWhen to use the escape hatch; how coded services compose in; DSL limitsMedium / MediumComponents · Capability map
Business usersScreens that answer the question; nothing they aren't allowed to see; actions that feel safeLow / HighBusiness scenario
Executive sponsorBacklog reduction; risk posture; cost; a defensible story for regulatorsHigh / MediumDriver → outcome chain · Roadmap

A3 · Motivation chainDrivers → goals → objectives → measurable outcomes

Drivers
  • Screen backlog grows faster than any team can clear it
  • Text-to-SQL and copy-paste RAG bypass the authorization model
  • Regulators ask "who could see this" and nobody can answer from a document
  • Schema changes break screens silently
Goals
  • Make the business data surface generative and governed
  • Enforce authorization structurally, once, for every generated artifact
  • Keep human judgment on approving, not writing
  • Make change computable
Objectives
  • Retrieval-selected subgraphs ≤30 tables regardless of schema size
  • 100% policy coverage of classified fields before publish; entitlements compiled into SQL
  • Deterministic gates + mandatory review on first publish and writes
  • Catalog versioning with automatic re-verification on drift
Outcomes (targets)
  • Minutes of machine time per use case; ~10 reviews/hour/reviewer
  • Zero unscoped queries reachable at runtime (measured in CI)
  • Escape-hatch rate below ~20% of screens
  • Every schema change yields a computed list of affected use cases within one crawl cycle

A4 · Business scenarioCustomer Success account-risk 360 — the worked case used across every phase

Situation

CS managers reconcile overdue invoices and open support tickets across three systems by hand. A screen was requested eighteen months ago. It never reached the top of any backlog.

Actors

Requester: CS operations lead. Users: cs.manager, cs.analyst. Reviewers: CS domain owner (read paths), Finance owner (the write path). Data owners of crm, finance, support.

Target flow

Prose request → typed spec (archetype detail-360-with-actions) → Scout returns 7 of 3,000+ tables with join paths → slice with policies on 6 classified fields + one proposal mutation → UI spec with two routes → nine gates pass → two approvals → published. Machine time in minutes; human time in two reviews.

What must be true

A CS analyst without pii:contact sees contact names but null emails. A manager sees only their territories — composed into the SQL, not filtered after. "Propose credit hold" creates a proposal Finance approves in its own queue; nothing is placed directly.

Measures

Time to published screen · gate report (policy coverage 100%, cost under ceiling) · zero PII exposure on sample scan · reviewer decisions recorded against the release unit · drift on finance.invoice re-verifies this use case automatically.