← VAF·SA Framework
NDA NOTE: This case study draws on real engagement experience. All client names, organisation names, system names, vendor names, and individual names have been removed or fictionalised. The Authority is a composite representative of a major state infrastructure agency. The principles, practice, and outcomes are real.
Engagement Profile
Organisation
The Authority — major state infrastructure agency
Engagement Type
Legacy database decommission — enterprise-scale
Primary Archetype
Institutional Paralysis + Obfuscation
Prior History
24+ months stalled. Multiple failed attempts. No handover.
Monthly Cost
Five-figure ongoing operational spend. Nothing delivered.
Delivered In
90 working days from engagement start to first artefact sign-off
The initial brief described a straightforward decommissioning requirement — a legacy database no longer serving its original purpose. After two years and several failed attempts across different teams, the system was still running. Nobody owned the problem.
No prior attempt was mentioned in the briefing. The history existed. It had to be found.
What Happened
Engagement began with a briefing that described the engagement as straightforward. The database was no longer needed. Decommission it. The briefing contained no history of prior attempts and made no reference to the previous two years.
Day one: requested the complete document inventory — every report, every attempt, every decision made. The initial response was that there was not much. The inventory that arrived over the following three days told a different story. Three separate working groups. Two vendor assessments. One partial migration attempt. All of it quietly present. None of it volunteered.
Framework Applied
Intake Question 1: "What has already been attempted?" — received a non-answer verbally. The document inventory answered it instead. Three attempts. Zero handover between them.
Intake Question 3: "Who owns this on paper — and who actually owns it?" — five different names appeared across the documentation as owners. None of them still held the role. The actual owner was nobody.
Archetype confirmation: Institutional Paralysis was clear by day three. The secondary Obfuscation signal — documents existing but not being surfaced voluntarily — was noted and added to the operating posture.
The pressure started in week two. "You haven't moved yet." Correct. Three months of immersion in a simpler archetype would have been two weeks. This one required fifteen days minimum to map the decision landscape before any design could begin. Silence under pressure is not inaction. It is orientation.
→
Gate passed: Archetype confirmed. Stakeholder map complete — three categories, all named by role. Document inventory complete. Environment diagnostic across four domains flagged three red items before the first workshop.
What Happened
Workshop one: opened with a strawman current-state diagram built from the document inventory. The diagram was deliberately incomplete. Every blank was a question. The room began correcting it within five minutes.
The incumbent vendor was in the room for the second half of workshop one. Question 7 — data direction — produced the first significant conflict. The vendor described the solution as data ingress. The technical lead challenged it. The vendor maintained the position.
Post-workshop: went to the vendor's own published documentation. The published architecture showed data egress to a third-party hosting environment. The vendor had described the opposite of what their own documentation stated.
Framework Applied
Workshop opening: Strawman diagram placed. "This is wrong. Tell me how." Room corrected it. Silence in the first five minutes was broken with a direct closed question to the platform lead: "The data flow I've shown here goes from left to right. Is that correct?" One named person. One closed question. The room opened.
Vendor question 7: "My understanding from your published documentation is that data in this configuration exits the client environment to your hosting infrastructure. Can you confirm that is correct?" The vendor deflected. The question was returned twice more, each time simpler. The third time: "Yes or no — does data leave the client environment?" A non-answer was recorded as a non-answer.
Independent verification: The vendor's own documentation, accessed directly, confirmed egress. ADR-001 was drafted that day.
Before we left that session I said: "I need you to confirm in writing — where does this data sit, who can access it, and under what terms. I will note this as an open item with a response required before this week ends." They said they would follow up. I said: "I will send you the item in writing today so we have a record." They agreed.
→
Gate passed: Ten questions answered across two workshops. Vendor non-answer formally documented. Independent verification completed — vendor documentation contradicted verbal claim. Information gap map: Domain 02 Data Sovereignty — red. Domain 07 Vendor Commercial — red.
What Happened
Current state: a legacy relational database, enterprise-scale, sitting underneath fourteen dependent application systems — seven of which had not been mapped in any prior attempt. The database was not being used for its original purpose. Three of the fourteen dependent applications were using it as an unofficial data store. None of this was in the briefing.
Target state: decommission the database. Migrate the three unofficial data stores. Retire the remaining eleven application connections by confirmed cutover date. The solution architecture was not complex. Finding all the moving parts was.
The heat map placed in front of the vendor at workshop two produced the engagement's defining moment. Domain 02 was red. Domain 07 was red. The vendor was asked to address each cell. Each deflection was recorded. The meeting ended with two red cells still open, two ADRs written, and a formal written request for documentation sent before close of business.
Framework Applied
context-level diagram: Drew the current state at context level first. Fourteen named systems. Named connections. Named data flows — with direction. Every connection the prior attempts had missed was visible because the direction arrows were named. "Direction unknown" was not permitted. Every unknown became a red heat map cell.
Security embedded: Every connection in the context diagram diagram was assessed against Zero Trust posture — how is this connection verified, what is the minimum privilege, what is the blast radius if compromised. Three connections failed the assessment. They went red on the heat map before the design was presented to the room.
Heat map as forensic instrument: Placed on screen. Named every red cell aloud. "Domain 02 — data sovereignty — red. The question is: has written confirmation been received from the vendor that data remains within jurisdiction. The answer is no. Who owns this cell and by when?" The vendor representative could not deflect a named cell the way they had deflected an open question.
→
Gate passed: context-level diagram confirmed — 14 systems, all connections named and directional. Heat map: 9 domains assessed, 3 red with named owners and deadlines, 4 amber with owners, 2 green with independent verification. ADR-001 through ADR-004 written. Pattern locked: decommission sequence confirmed, no re-litigation without new technical information.
What Happened
The Customer Impact Statement was written in plain language. The problem: a legacy database costing five figures per month, delivering no current-value function, with fourteen downstream dependencies never previously mapped. The cost of inaction: ongoing operational spend with increasing technical debt and three red-rated security and data sovereignty risks. The decision required: approve the decommission programme and assign a named operational owner by a specific date.
The CIS was placed in front of the executive sponsor. Sixty seconds of silence. Then: "Why has nobody written it this clearly before?" No answer given. The CIS was signed the same day.
The Architecture on a Page was confirmed in three zones by three audiences across two sessions. The executive read the business zone and confirmed the objective. The platform lead read the architecture zone and marked up two corrections, both incorporated. The delivery lead read the roadmap zone and confirmed the phase sequence was achievable.
Framework Applied
CIS test: Handed to the most senior non-technical stakeholder in the engagement. They read it. They stated the decision required without prompting. The CIS passed.
AoaP zone confirmation: Each audience confirmed their zone independently. The executive did not need to read the architecture zone. The platform lead did not need to read the business zone. The document served all three simultaneously from one page.
Heat map as final artefact: Presented with all red cells named aloud. By this point, two of the three red cells had moved to amber — owners had engaged and progress was documented. One remained red. It was named, owned, and deadline-confirmed before the artefact review session ended.
→
Gate passed: CIS signed by executive sponsor. AoaP confirmed by all three zones — corrections incorporated. Heat map: 2 of 3 red cells moved to amber. ADR-001 through ADR-006 written, all accepted. All artefacts versioned and linked to delivery workstreams.
What Happened
The data sovereignty concern — Domain 02, red — was not resolved within the original deadline. The vendor produced a response that did not directly answer the question. The escalation protocol was activated.
Layer 1: the Domain 02 component was marked as provisional in the Architecture on a Page. The label was explicit. It appeared in every review.
Layer 2: the Design Authority was briefed. The concern was framed as a governance decision: "We cannot close this design without written confirmation that data remains within jurisdiction. The consequence of proceeding without it is policy breach. The decision belongs to the security authority."
The security authority reviewed the vendor's written response independently, confirmed it was insufficient, and issued a formal requirement to the vendor. Within five working days, the vendor produced a compliant written statement. Domain 02 moved from red to green. ADR-007 updated.
Framework Applied
Professional conduct: Throughout the escalation, no complaint was made about the vendor's behaviour. No accusation of deliberate misleading was made publicly. The concern was named precisely: "The written documentation provided does not confirm data sovereignty. We need a statement that does." The problem was named. Not the person.
Boundary statement prepared but not required: The boundary statement was drafted. It stated what could be confirmed and what could not without the vendor's response. When the response arrived, the boundary statement was not needed. It was kept on record.
Operations briefed: The operations team was briefed before delivery began. What changes from go-live. What the rollback position is. What the support model looks like post-decommission. Their concerns — two of them significant — were documented and added to the risk register.
→
Gate passed: All concerns raised in writing. Escalation Protocol Layer 2 activated and resolved — data sovereignty confirmed in writing by vendor. All five audience types briefed — executive, technical, vendor, project, operations. Professional conduct maintained throughout. No verbal-only concerns remaining.
What Happened
At week seven, new information arrived. One of the fourteen dependent application systems — listed in the context diagram as a read-only consumer of the database — was discovered to be writing to it. Not reading. Writing. The discovery came from a junior team member who had never been in a workshop. They mentioned it in passing during a delivery stand-up.
The information changed the decommission sequence. It did not change the target state. It changed the order of operations and added two dependencies to the gap analysis. The loop was re-run from Orient — not from the beginning. The context diagram diagram was updated. ADR-003 was superseded by ADR-008. The AoaP roadmap was updated. The delivery team was briefed within 24 hours.
The decommission programme completed its first phase on time. The database was offline within the committed window. The ongoing monthly operational cost stopped.
Framework Applied
Loop re-run from Orient: New information changed the orientation, not the design. The context diagram diagram was updated. The affected heat map cells were reassessed. The ADR was superseded. The pattern was re-locked with the corrected information. Total re-run time: three working days. No workshop was required because the new information was specific and the design change was contained.
What done meant: The engagement was not done when the database went offline. It was done when the delivery team had all artefacts, all ADRs, and the updated Architecture on a Page — and could answer every question without the solution architect in the room. That condition was reached on day ninety-one. The architect was no longer required for operational queries by day ninety-five.
→
Gate passed: All six module gates confirmed. Loop ran twice — second run from Orient, not from start. 8 ADRs written, all accepted or superseded in sequence. Delivery team operating independently. Monthly operational cost: stopped.
Stalled for: 24+ months
Previous attempts: three
Previous handover between attempts: none
Delivered in: 90 working days
Monthly cost stopped: day 91
DELIVERED
What the framework made possible — and what would have happened without it.
01
The immersion period was the entire engagement
The fifteen-day orientation period presented as inaction to those applying conventional project timeline expectations. The analytical value of that period became apparent only in retrospect. Each hour invested in mapping prior attempts, surfacing withheld documentation, and identifying undisclosed system dependencies constituted productive design preparation. The relative speed of the design phase was a direct product of the rigour applied during orientation.
02
The strawman opened every room
No workshop started with a blank page. The strawman — always incomplete, always partly wrong — gave the room something to react to. People who would not answer open questions would correct a diagram. The correction was the answer.
03
The heat map was the instrument that changed the vendor's behaviour
Verbal questions could be deflected. A named cell on a heat map, read aloud in a room containing all relevant parties, could not. Domain 02 going from red to green was the moment the engagement turned from adversarial to cooperative.
04
The loop re-run took three days because the artefacts were complete
The discovery in week seven could have restarted the engagement. It did not because the context diagram diagram, the heat map, and the ADRs were complete enough that the new information had a specific, named place to land. Incomplete artefacts would have required a full restart.
05
Professional conduct under pressure protected the outcome
The vendor was misleading. The organisation had withheld history. The pressure to proceed without resolving Domain 02 was real. None of it was confronted directly. All of it was documented, escalated through the correct channels, and resolved through the artefact. The outcome was better than a confrontation would have produced.
06
The junior team member's observation was the most important intelligence
The write dependency was not in any document. It was not raised in any workshop. It came from someone who had never been asked. The framework is designed for what is known. The practitioner must remain alert to what surfaces from unexpected sources throughout the entire engagement.