AI Architecture in Practice — ArcKit at the Perth AI User Group
Last night I had the pleasure of presenting to the Perth AI User Group on a topic I’ve spent much of the past year living inside: how to get the speed of AI-assisted architecture work without giving up the rigour, traceability and audit trail that enterprise governance demands.
The talk — AI Architecture in Practice — centred on ArcKit, the open-source enterprise architecture governance harness created by Mark Craddock (tractorjuice), and how I’ve used it end-to-end on real client engagements here in Australia.
The problem: “can AI draft it?” is the wrong question
Every architect in the room recognised the starting point:
- Scattered documents, no single source of truth. Requirements, risks, decisions and designs live across SharePoint, Confluence, email and slide decks — and drift apart.
- Weeks of expert effort per artefact. Business cases, risk registers and reviews queue behind delivery; the expert-drafting layer is what everyone waits for.
- No answer when the auditor asks “why?” Nothing links a decision back to a requirement, a risk, or a business driver. The audit trail gets reconstructed from memory.
- Raw GenAI makes it worse, not better. Fast, plausible drafts with no provenance, no gates and no audit trail. Speed without control is a new liability, not a productivity gain.
The framing I kept returning to all night: the question is not “can AI draft it?” — it is “can I defend it?”
What ArcKit is
ArcKit turns AI coding assistants into governed architecture engines. Instead of Word documents and stale Visio diagrams, every artefact — principles, business cases, requirements, risks, decision records, design reviews — is generated by slash commands, written as version-controlled Markdown, and stamped with provenance and traceability.
Four things make it different from just prompting a chatbot:
- Open source. MIT-licensed, with docs, playbooks and 40+ public example projects at arckit.org.
- It runs inside your AI assistant. A plugin for Claude Code (the premier experience), plus Codex CLI, Gemini CLI, GitHub Copilot and OpenCode. Slash commands, not a SaaS platform.
- Markdown + Git, not documents. Artefacts live in the repo alongside code — versioned, diffable, reviewable via pull request. Governance as code.
- Governed, not just generated. A harness intercepts every write: gates block unsafe changes, observers stamp provenance, and traceability links artefacts end-to-end. The AI never writes directly to the workspace.
That last point is why it’s called a harness. Every tool call is intercepted, checked, enriched and stamped — so speed never comes at the cost of control.
The Australian overlays
Because most of my work sits in Australian regulated sectors, I maintain the arckit-au overlay — community-contributed commands anchored on federal frameworks. Compliance becomes a slash command you run in week one, not a finding you receive in the final month:
| Command | What it produces |
|---|---|
/arckit:au-pia | Privacy Impact Assessment — Privacy Act 1988, APP-by-APP analysis |
/arckit:au-e8-posture | ASD Essential Eight maturity posture (ML0–ML3) |
/arckit:au-ism-controls | ISM Statement of Applicability across 17 control domains |
/arckit:au-ndb-playbook | OAIC Notifiable Data Breaches response playbook |
/arckit:au-ai-assurance | DTA AI Assurance Framework baseline; ISO 42001 readiness |
/arckit:au-pspf | Protective Security Policy Framework scorecard |
Plus sector packs for critical infrastructure (SOCI/CIRMP), OT security and energy (AESCSF). Install everything with:
claude plugin install arckit arckit-au
The live demo
A worked example of an architecture engagement, governed end to end by ArcKit rather than hand-written.
The whole demo workspace is public. Clone it and follow along:
👉 github.com/SmartTechVentures-au/arckit-demo
Two real engagements, same harness
The heart of the talk was two anonymised client examples showing ArcKit under genuinely different conditions.
Client Example 1 — community services provider (NDIS & aged care). Four concurrent mission-critical platform procurements under hard regulatory deadlines. The programme produced 96 governed artefacts across 5 project spaces, including 38 architecture decision records and 27 structured vendor profiles. A 000-global space held org-wide principles, business case and risks; each procurement ran as a numbered project inheriting from it. Structured vendor profiles plus requirements traceability gave the evaluation an auditable evidence base — decisions defensible to the board and to regulators.
Client Example 2 — ASX-listed industrial technology company. Governance for a new enterprise data platform, with a very different security posture: every artefact carries a PSPF-style classification marking (UNOFFICIAL → PROTECTED) enforced through profile configuration. Notably, this engagement ran on OpenAI Codex CLI while Example 1 used Claude Code — same artefacts, same governance, different AI harness. Assistant-agnostic in practice, not just in the brochure. The full artefact chain — PLAN → STKE → REQ → RISK → DATA → SOBC → HLD → HLDR → ADRs → AUPIA → TRAC → CONF — landed as 30+ governed, versioned, traceable artefacts.
What held across both engagements
Six patterns I’d stand behind for anyone starting out:
- The architect’s job changes, not disappears. AI drafts to templates; the architect interrogates, decides and signs off. Judgement, stakeholder context and trade-off thinking become the whole job — formatting effort drops to zero.
- Start with principles and a global space. Org-wide principles plus a
000-globalproject made every subsequent initiative faster and more consistent. It’s the highest-leverage first week you can spend. - Traceability changes conversations. When every requirement links to a driver and every decision to a requirement, procurement disputes and audit questions get resolved from the artefacts — not from memory.
- Overlays make compliance a starting point. Running the AU privacy, cyber and AI-assurance commands early surfaced obligations while the architecture could still absorb them cheaply.
- Git-native governance meets teams where they are. Pull-request review brought engineers into governance; publishing to DevOps Wiki, Confluence and GitHub Pages brought governance to executives.
- AI output still needs qualified owners. Community overlays are accelerators, not opinions of record — security, privacy and legal owners review before reliance. The harness makes that review easy, not optional.
Getting started
- Explore — arckit.org has guides, playbooks and 40+ public example projects across health, AI, cloud and data.
- Install —
claude plugin install arckit arckit-au. Free, open source. - Pilot — pick one live initiative, run
/arckit:init, follow the navigator, and put the eight essential artefacts in Git within a fortnight.
Thanks to the Perth AI User Group for hosting, and to everyone who stayed for the wine, pizza and the long tail of questions afterwards — the discussion on assistant-agnostic governance and the role of the human reviewer was the best part of the night.
If you’re wrestling with AI governance on a real programme and want to talk it through, you’ll find me at mckelt.com, smarttechventures.au or axurcio.com.
ArcKit is MIT-licensed open source by Mark Craddock (tractorjuice) — github.com/tractorjuice/arc-kit. Community AU overlays should be reviewed with qualified security, privacy and legal owners before reliance.