For practitioners
AI boundary assessment practice
Materials for architects and advisers who need to establish where an organisation's AI agents may send data, show what enforcement looks like, and report it to executives. Written for services firms and internal architecture teams to run. Nothing here is sold.
Shapes
Three shapes, all time-boxed.
Duration, effort in person-days, team, client dependencies, deliverables, and what "done" means are fixed per shape. Prices are not: the delivering firm sets its own.
Discovery workshop
One day. About three person-days including preparation and write-up. Delivers the AI Boundary Topology Map, the crossing inventory, and the five highest-risk gaps.
Boundary assessment
Three weeks. About twenty person-days. All six phases: discovery, evidence, scoring, contract review, roadmap, executive readout. Every score cites evidence.
Demonstration
Half a day. About one person-day including the same-day rehearsal. Twenty-two conformance scenarios green in the room, one denial shown, one receipt opened.
Entry criteria and when to decline are in Engagement Shapes. Declining is a normal outcome.
Start
Run it in this order.
Nothing to install beyond the reference gateway, nothing to sign up for. The kit is Apache-2.0 and lives in the ContextBoundary repository.
1. Run the proof
Clone contextboundary-gw and run the conformance suite yourself before you show it to anyone. About ten minutes from a clean clone.
2. Run the workshop
Use the workshop agenda and send the scoring worksheet's evidence request in week one. Score nothing without evidence.
3. Write the readout
Carry the worksheet's summary table into the executive readout template unchanged. Name the decisions the executives must make.
Questions from practitioners: open an issue on ContextBoundary with the label engagement. Say which shape, which phase, and what the room asked that the kit did not answer.
Materials
Read the kit at source.
The source of truth is the open repository. The website is the public doorway, not a second copy of the material.
-
Practitioner kit
Complete folder
Entry point. The README carries the claim limits that govern every document.
-
Engagement Shapes
Scope and effort
The three shapes: duration, effort, team, deliverables, acceptance, entry criteria, when to decline.
-
SOW Skeleton
Statement of work
Fill-in template built on the shapes. Its fixed sections carry the claim limits into the contract.
-
Scoring Worksheet
Working instrument
Interview questions, evidence request, scoring anchors per category, and the summary table that feeds the readout.
-
Workshop Agenda
Discovery runbook
Participants, pre-workshop inputs, and the six-step agenda that produces the topology map.
-
Egress Assessment
Maturity model
Five maturity levels and six scoring categories. Organisational maturity is scored separately from runtime configuration.
-
Demonstration Guide
Show the control
How to demonstrate the reference gateway without treating it as a product or a compliance certificate.
-
CLOUD Act Contract Checklist
Contract review
Prompts for reviewing whether vendor contracts support the technical boundary. Frames questions for counsel; does not replace counsel.
-
Stakeholder Playbook
Approval roles
Approval gates and stakeholder responsibilities by Egress Tier and Boundary Zone.
-
Executive Readout Template
Board-level summary
Structure for translating findings into risk, investment priorities, and the decisions executives must make.
-
Case Study: A Decision Without a Receipt
Real incident
Documented as it happened, on the project's own domain. Use it when a room needs a concrete example rather than a diagram.
Claim limits
Keep the room honest.
The kit is enablement material. It is not legal advice, a compliance certificate, vendor endorsement, or a hosted product offer.
- AARM is a Cloud Security Alliance standard, not a Context Stack standard.
- Context Stack is AARM-aligned. No conformance claim is made.
- Not listed on the CSA Builder Registry.
- No independent conformance review has been undertaken.
- Griha is a reference implementation, not a product.
ContextBoundary is a specification. contextboundary-gw is a reference implementation. Neither is a product, and neither is offered as a hosted service.
No engagement has yet been delivered with this kit. The shapes and estimates are a practitioner's best construction, not a record of what happened in a room. That sentence is removed when the first written readout exists.
The five statements above are the project-wide claim ceiling, gated byte-identical across six surfaces by scripts/verify_site.py. That gate enforces that the wording is the same everywhere; it cannot establish that a statement is true. The kit README states the same limits scoped to ContextBoundary, where Griha does not appear, and governs every document in the kit.