About the Author

This book draws on the same decades of practice as the seven volumes of The Transformed Architecture, Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss, at the intersection of enterprise architecture, infrastructure engineering, information security and organisational change. It is written from the perspective of a practitioner who has watched architecture move from documents to code and AI move from pilots to agents, and who has spent as much time explaining that landscape to boards, politicians and colleagues outside the profession as building it.

Gunnar Nordqvist

Figure 26.1: Gunnar Nordqvist. Source: photograph supplied by Gunnar Nordqvist.

Gunnar Nordqvist is a self-employed certified Chief Architect and IT Architect consultant in the Kvadrat network, a Swedish consultancy network of independent specialists (54, Kvadrat, n.d.). As an IT generalist with a deep interest in technology, Gunnar has worked across diverse roles throughout his career, including IT architect, technical project manager, and systems technician.

Professional background

Gunnar's experience spans solution and enterprise architecture, IT infrastructure, and information security engagements for large enterprises and public authorities. His technical background encompasses network solutions, servers, virtualisation, cloud platforms, and IT security, and in recent years the architecture of data platforms and AI-enabled services in regulated settings.

Core areas of expertise:

• Solution and enterprise architecture
• Architecture as Code and Infrastructure as Code
• AI Architecture, model governance, and the European regulatory framework
• IT security, risk management, and compliance
• Cloud architecture, virtualisation, and digital sovereignty
• DevOps, CI/CD automation, and platform engineering

From the series to this book

Architecture as Code argued that architecture becomes trustworthy when it is codified, version-controlled and continuously validated (1, Nordqvist, 2025). AI Governance applied that argument to the risk, governance and assurance of AI (2, Nordqvist, 2026), AI Platform and Security to the platforms that run AI and the security that protects them (3, Nordqvist, 2026), AI Red Team to AI as an active part of cyber defence (4, Nordqvist, 2026), AI Threat to the question whether the dystopias of science fiction are coming true (5, Nordqvist, 2026), The Transformed Security Architect to the role of the person who designs the boundaries on which those volumes depend (6, Nordqvist, 2026), and AI Boss to what AI may do when it manages people (7, Nordqvist, 2026). Seven volumes, written for practitioners, left one thing undone: a picture that everyone else could read. Boards, elected officials, journalists and citizens decide about this landscape every week, and they decide from pictures that are decades old, one box labelled "AI", one line between manual and automated, one cloud. This book is the companion that gives them, and the practitioners who have to explain the landscape to them, one picture drawn the same way every time, the evidence that corrects the instincts that distort it, and a rule of thumb for each. The conviction behind all eight books is the same: that systems of consequence deserve engineering rigour, that governance works best when it is executable, and that accountable human judgement is what remains when everything else can be automated. In this book the conviction is turned towards perception: a landscape that cannot be seen clearly cannot be governed well.

About Kvadrat

Gunnar Nordqvist works as an independent consultant through Kvadrat, which describes itself as Sweden's largest network of self-employed consultants and has offices across Sweden (54, Kvadrat, n.d.). Kvadrat is the network the author belongs to; it is not the publisher of this book and owns nothing in it.

Swedish terminology reference

Terminology note: The Swedish names used in this section keep their native form to preserve accuracy.

• Kvadrat AB – AB stands for aktiebolag, Sweden's equivalent of a limited company. The firm's name translates literally to "square" but is always written as Kvadrat in branding.
• Nordqvist – A Swedish family name combining nord ("north") and qvist ("twig"), reflecting traditional Swedish surname construction.

How this book was made

The name on the cover is accurate, but it calls for a qualification. Like the later volumes of the series, this book has been made differently from the way books are usually written. Most of the prose was drafted by a team of specialist AI agents, each configured for a single role: a writer that drafts chapters against a brief, a researcher that retrieves datasets and checks sources and legal texts, an editor that applies the style guide, a critic that reads as a general reader and probes arguments for weaknesses, an architect that validates the landscape models, and a designer that specifies the charts and views. Gunnar Nordqvist's part is less that of a writer at the desk than that of a conductor: setting the score, deciding who plays what, listening, stopping the orchestra and asking for a passage again.

The division of labour does not divide the responsibility. Four things remain the author's, and they are what a reader is entitled to hold a person to account for:

• The design of the book. The choice of subject, the notation, the table of contents, the brief for every chapter, the author persona, the style guide and the rules the agents work under are written by the author and kept in the repository alongside the manuscript.
• Review and approval. Every change reaches the manuscript through a pull request that the author reads and then redirects, rejects or approves. Nothing is published that the author has not accepted.
• Judgement. The positions the book takes, its rules of thumb and its projections are the author's, including the passages written in the first person, even where an agent found the words for them. Where a chapter would have been carried by a story from the author's own practice, the draft carries a marked note instead of an invented one, and the author supplies the story or removes the note.
• Sources and data. The author answers for the bibliography and for every dataset in the repository. Automated checks confirm that every citation points to an entry that exists, that every chart is rendered from a committed specification and a documented dataset, and that every figure of the two illustrative organisations is rendered from a committed model; the author checks, by sampling where the volume requires it, that the sources say what the text claims. Errors that remain are the author's, not the agents'.

The arrangement is itself a mark on the landscape this book draws: a person directing agents under written briefs at Level 1 Assisted and Level 2 Supervised, with a seat above every mark. The agents draft, and the author decides. The question that The Transformed Security Architect, Chapter 14, takes as its subject applies here with full force: how is AI-proposed change reviewed for soundness when the reviewer depends on the AI (6, Nordqvist, 2026)? The author's answer is partial and is offered as such. The briefs are written before the agents draft, a separate critic is set against the drafts, every number must trace to a dataset the author can open, and every change waits for the author's approval. Chapter 17 sets out what makes a decision right real rather than nominal. It is a fair question for the reader to put to this book.

The book's technical foundation

The book is produced with the same automated publishing pipeline as the series, extended for its figures: a Markdown manuscript, data charts rendered from declarative specifications and documented datasets, landscape views rendered from a machine-readable model, Mermaid for the few process diagrams, Pandoc and XeLaTeX for PDF, EPUB and DOCX, MkDocs for the website, and GitHub Actions for continuous validation. The pipeline is itself an example of Architecture as Code applied to publishing, and its structure is described in the repository documentation.