{ "version": "1.0.0", "source": { "name": "Internal Technology Taxonomy", "url": "https://mad.firstmark.com", "notes": "Internal taxonomy seeded from MAD FirstMark as a reference starting point. Technology concepts only; services and industry solution tracks excluded. Augmentation concepts are additive and informed by the revised hierarchy summary for governed AI runtime execution, security, validation, and operations." }, "categories": [ { "id": "data-knowledge-infrastructure", "title": "Data & Knowledge Infrastructure", "description": "The foundational layer for persisting, moving, and representing data as a governed enterprise asset. This category covers how data is stored across relational, object, graph, and vector stores; how it flows through pipelines and event streams; how its quality is assured; and how domain knowledge is formally modelled as ontologies and knowledge graphs. Every analytics and AI capability in the platform depends on the integrity and accessibility of this layer.", "concepts": [ { "id": "storage", "title": "Storage", "description": "Durable object and file storage for platform data, telemetry archives, and evidence retention.", "madCard": "https://mad.firstmark.com/card#rec7qoEwLE4qZJW4q", "technologyPage": null, "controls": [ "retention-policy", "provenance-capture" ], "vendors": [ { "id": "google-cloud-storage", "name": "Google Cloud Storage", "description": "Durable object storage for cloud-native analytics and AI data." }, { "id": "minio", "name": "MinIO", "description": "S3-compatible object storage often used in hybrid and private cloud deployments." } ], "industryDefinition": "Object and file storage provides durable, scalable persistence for raw data, artifacts, and archives. In Medallion patterns it commonly hosts raw and intermediate layers, while lifecycle controls move aging data across hot, cool, and archive tiers. For AI workloads it also stores model artifacts, evaluation assets, and embedding snapshots.", "usedFor": "Persist raw, curated, and archived platform data with retention, versioning, and provenance controls.", "industryBackground": [ { "name": "Amazon S3 API", "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html" }, { "name": "WORM Storage Overview", "url": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview" } ], "keyPrinciples": [ "Use immutability for raw record retention and audit evidence", "Lifecycle tiering lowers cost while preserving required retention", "Enable versioning for point-in-time restore on critical datasets", "Restrict access through private networking and identity policies", "Use storage events to trigger downstream processing" ], "diagramSuggestion": "Medallion storage flow with source ingestion into Bronze object storage, transformed Silver assets, and curated Gold analytics outputs plus archive lifecycle transitions.", "exampleUseCases": [ "ADLS Gen2 as Bronze landing zone for eLIMS-BPT and eQMS exports", "Delta files in Silver layer with schema evolution and time travel", "Model/evaluation artifact retention for reproducibility" ], "gxpRelevance": "High. Immutability and retention controls are key for Part 11 and Annex 11 evidence preservation.", "approvedVendors": [ { "id": "azure-storage", "name": "Azure Storage", "description": "Blob and storage services for governed cloud data workloads.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=5d3a13fb3b0ad61095e91764c3e45a4d&v=" }, { "id": "amazon-s3", "name": "Amazon S3", "description": "Scalable object storage for raw, curated, and archive tiers.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=5d3a13fb3b0ad61095e91764c3e45a4d&v=" } ] }, { "id": "event-brokers-messaging", "title": "Event Brokers & Messaging", "description": "Asynchronous event transport for integration, workflow triggers, and resilient decoupled systems.", "madCard": "https://mad.firstmark.com/card#recojswKUmpjErTIs", "technologyPage": null, "controls": [ "approved-edge-routing", "transport-telemetry" ], "vendors": [ { "id": "confluent", "name": "Confluent", "description": "Managed Kafka platform for durable event pipelines and streaming integration." }, { "id": "google-pubsub", "name": "Google Pub/Sub", "description": "Managed messaging and eventing for cloud-native systems." } ], "industryDefinition": "Event brokers and messaging systems provide asynchronous transport between producers and consumers. They enable temporal decoupling, fan-out, and back-pressure tolerance in distributed systems. Common patterns include queue-based point-to-point delivery and pub/sub topic distribution.", "usedFor": "Decouple services and trigger reliable downstream processing via event streams and queues.", "industryBackground": [ { "name": "Apache Kafka", "url": "https://kafka.apache.org/" }, { "name": "AMQP 1.0", "url": "https://www.amqp.org/resources/specifications" }, { "name": "CloudEvents", "url": "https://cloudevents.io/" } ], "keyPrinciples": [ "Design for at-least-once delivery with idempotent consumers", "Use partitioning and consumer groups for scale and ordered processing", "Route poison messages to dead letter queues for inspection", "Enforce schema contracts between producers and consumers", "Track end-to-end event provenance and replayability" ], "diagramSuggestion": "Fan-out event topology from one producer topic to multiple consumers with DLQ failure lane.", "exampleUseCases": [ "Event Hubs ingestion of instrument-result streams", "Service Bus queue for agent task dispatch and HITL handoffs", "CloudEvents envelope for cross-service interoperability" ], "gxpRelevance": "Medium. Delivery guarantees and DLQ governance reduce silent loss risk for regulated records.", "approvedVendors": [ { "id": "azure-event-hubs", "name": "Azure Event Hubs", "description": "High-throughput event ingestion and stream transport in Azure.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=4d3adfbb3b0ad61095e91764c3e45ad5&v=" }, { "id": "azure-service-bus", "name": "Azure Service Bus", "description": "Managed enterprise messaging service for queues and topics with durable delivery.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=953a13fb3b0ad61095e91764c3e45abe&v=" }, { "id": "rabbitmq", "name": "RabbitMQ", "description": "Queue-based messaging for service decoupling and workflow orchestration.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=346a537f3b0ad61095e91764c3e45a65&v=" } ] }, { "id": "vector-databases", "title": "Vector Databases", "description": "Embedding storage and nearest-neighbor retrieval for semantic search and RAG use cases.", "madCard": "https://mad.firstmark.com/card#recNGGOHMFGfSbJ3k", "technologyPage": "ai-retrieval-index.html", "diagramHref": "/technologies/diagram/?concept=vector-databases", "diagramTitle": "RAG with Vector Database", "diagramPreview": "Shows the full RAG flow from user query, embedding retrieval, vector search, and context assembly to grounded LLM response.", "approvedVendors": [ { "id": "elastic-search-enterprise", "name": "Elastic Search - Enterprise", "description": "Approved enterprise search platform with vector and hybrid retrieval capabilities.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=786a537f3b0ad61095e91764c3e45a6c&v=" }, { "id": "azure-ai-search", "name": "Azure AI Search", "description": "Managed retrieval and vector search service for semantic and RAG workloads.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=232ada772b5f9e5407f6f30dee91bf5b&v=" } ], "controls": [ "vector-search-governance", "approved-knowledge-source", "grounding-check" ], "vendors": [ { "id": "pinecone", "name": "Pinecone", "description": "Managed vector database for semantic retrieval and RAG workloads." }, { "id": "weaviate", "name": "Weaviate", "description": "Open-source vector database with hybrid search and metadata filters." }, { "id": "qdrant", "name": "Qdrant", "description": "Vector database with filtering and distributed deployment options." }, { "id": "chroma", "name": "Chroma", "description": "Developer-friendly embedding store for AI retrieval prototyping and production." }, { "id": "sql-2025", "name": "SQL 2025", "description": "Relational platform option with native vector capabilities for hybrid retrieval patterns." } ], "industryDefinition": "Vector databases store high-dimensional embeddings and answer nearest-neighbor similarity queries. They power retrieval-augmented generation by grounding model responses in approved retrieved context. Semantic matching is driven by distance metrics and is commonly combined with lexical and metadata filters for production quality.", "usedFor": "Support semantic search, grounded retrieval, and RAG context assembly for AI responses.", "industryBackground": [ { "name": "ANN Benchmarks", "url": "https://ann-benchmarks.com/" }, { "name": "Faiss", "url": "https://github.com/facebookresearch/faiss" }, { "name": "pgvector", "url": "https://github.com/pgvector/pgvector" } ], "keyPrinciples": [ "Embedding model and index are coupled and must be versioned together", "Hybrid retrieval (vector + lexical) outperforms single-mode search", "Metadata filters enforce scope, status, and governance constraints", "Chunking strategy strongly influences retrieval precision and recall", "Two-stage retrieval with re-ranking improves answer quality" ], "diagramSuggestion": "RAG pipeline with embed, retrieval plus metadata filters, optional re-rank, prompt assembly, and grounded answer generation.", "exampleUseCases": [ "Azure AI Search vector index for SOP retrieval", "Qdrant on AKS for approved GxP knowledge retrieval", "Hybrid retrieval filtered by approved document status" ], "gxpRelevance": "High. Retrieval must be constrained to approved, version-controlled sources and fully auditable." }, { "id": "graph-databases", "title": "Graph Databases", "description": "Entity and relationship stores for ontology-linked reasoning and connected data exploration.", "madCard": "https://mad.firstmark.com/card#reckl7lBcOjn9GF9l", "technologyPage": null, "controls": [ "ontology-mapping-required", "provenance-capture" ], "vendors": [ { "id": "neo4j", "name": "Neo4j", "description": "Property graph platform for relationship modeling and connected analytics." }, { "id": "arangodb", "name": "ArangoDB", "description": "Multi-model database supporting graph traversal and document workloads." }, { "id": "amazon-neptune", "name": "Amazon Neptune", "description": "Managed graph database for highly connected datasets." }, { "id": "tigergraph", "name": "TigerGraph", "description": "High-performance graph analytics platform for large-scale graph queries." } ], "industryDefinition": "Graph databases model entities as nodes and relationships as edges, enabling multi-hop traversal and relationship-centric reasoning. They are suited for ontology-backed knowledge representation, lineage traversal, and connected analytics where join-heavy relational patterns become brittle.", "usedFor": "Represent ontology and relationship-rich knowledge for connected reasoning and audit traversal workflows.", "industryBackground": [ { "name": "W3C OWL 2", "url": "https://www.w3.org/TR/owl2-overview/" }, { "name": "W3C SPARQL 1.1", "url": "https://www.w3.org/TR/sparql11-query/" }, { "name": "Allotrope Foundation Ontology", "url": "https://www.allotrope.org/" }, { "name": "Basic Formal Ontology", "url": "https://basic-formal-ontology.org/" } ], "keyPrinciples": [ "Align graph entities to ontology classes for semantic consistency", "Use bounded traversal depth for predictable query performance", "Prefer graph queries for relationship and path reasoning tasks", "Treat graph and vector stores as complementary retrieval layers", "Preserve provenance on relationships, not only entities" ], "diagramSuggestion": "Entity relationship subgraph showing test result linked to SOP, analyst, instrument, batch, and regulatory requirement path.", "exampleUseCases": [ "GraphDB hosting OntoEurofins aligned to AFO/BFO", "Rule graph traversal from failed result to governing SOP", "SPARQL reasoning chain for audit explanation paths" ], "gxpRelevance": "High. Ontology-backed traceability improves explainability and inspection readiness for regulated reasoning." }, { "id": "relational-databases", "title": "Relational Databases", "description": "Structured transactional data stores providing ACID-compliant storage for operational platform and application data.", "madCard": null, "technologyPage": null, "controls": [ "audit-access-control", "retention-policy", "provenance-capture" ], "vendors": [ { "id": "oracle-db", "name": "Oracle Database", "description": "Enterprise relational database widely deployed in regulated and ERP environments." } ], "industryDefinition": "Relational databases store structured data in tables with defined schemas and enforce ACID transaction guarantees — atomicity, consistency, isolation, and durability. They are the operational foundation for most enterprise applications including LIMS, eQMS, and ERP systems. Modern variants add columnar storage, JSON support, and vector extensions to support hybrid workloads.", "usedFor": "Store and retrieve structured operational records for platform applications, LIMS, and eQMS workloads.", "industryBackground": [ { "name": "ISO/IEC 9075 SQL Standard", "url": "https://www.iso.org/standard/76583.html" }, { "name": "ACID Properties", "url": "https://en.wikipedia.org/wiki/ACID" } ], "keyPrinciples": [ "ACID guarantees are the foundation of data integrity in transactional systems", "Index design and query patterns determine performance at scale", "Schema versioning and migration must be managed as code", "Row-level security enforces data access boundaries within a single database", "Audit columns and temporal tables support point-in-time record reconstruction" ], "diagramSuggestion": "Relational schema showing application tables, audit trail pattern, and row-level security enforcement layer.", "exampleUseCases": [ "Azure SQL Hyperscale hosting eQMS and RecordKPR operational data", "pgvector extension enabling hybrid relational and vector retrieval in PostgreSQL", "SQL Server 2025 as a candidate for native vector search alongside relational data" ], "gxpRelevance": "High. Relational stores hosting electronic records require audit trails, access controls, and validated change management under 21 CFR Part 11 and Annex 11.", "approvedVendors": [ { "id": "azure-sql", "name": "Azure SQL", "description": "Managed SQL Server platform for transactional and analytical workloads in Azure.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=453a13fb3b0ad61095e91764c3e45a27&v=" }, { "id": "postgresql", "name": "PostgreSQL", "description": "Open-source relational database with strong standards compliance and extension ecosystem.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=7e13816cfb965e5cec84f464aeefdcee&v=" }, { "id": "sql-server", "name": "SQL Server", "description": "Microsoft enterprise relational platform with deep Azure and BI integration.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=343a9fbb3b0ad61095e91764c3e45a99&v=" }, { "id": "azure-cosmos-db", "name": "Azure Cosmos DB", "description": "Globally distributed NoSQL database service for low-latency, high-availability applications.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=493adfbb3b0ad61095e91764c3e45ad9&v=" } ] }, { "id": "data-lakehouse", "title": "Data Lakehouse", "description": "Unified storage architecture combining data lake scale and flexibility with data warehouse ACID guarantees and query performance.", "madCard": null, "technologyPage": null, "controls": [ "retention-policy", "provenance-capture", "telemetry-schema" ], "vendors": [ { "id": "delta-lake", "name": "Delta Lake", "description": "Open table format providing ACID transactions and time travel on object storage." }, { "id": "apache-iceberg", "name": "Apache Iceberg", "description": "Open table format for large-scale analytics with schema evolution and snapshot isolation." } ], "industryDefinition": "The data lakehouse pattern combines the low-cost, schema-flexible storage of a data lake with the ACID transactions, versioning, and query optimization of a data warehouse. Open table formats such as Delta Lake and Apache Iceberg enable time travel, schema evolution, and concurrent reads and writes on top of object storage — the foundation of the Medallion architecture.", "usedFor": "Provide ACID-compliant, versioned, and queryable storage for Bronze, Silver, and Gold Medallion layers.", "industryBackground": [ { "name": "Delta Lake", "url": "https://delta.io/" }, { "name": "Apache Iceberg", "url": "https://iceberg.apache.org/" }, { "name": "Databricks Lakehouse Platform", "url": "https://www.databricks.com/product/data-lakehouse" } ], "keyPrinciples": [ "Open table formats decouple storage from compute and enable multi-engine access", "Time travel enables point-in-time query for audits and corrections", "Schema evolution support prevents brittle pipeline breaks on source changes", "ACID transactions enable concurrent writes without data corruption", "Partitioning and Z-ordering drive query performance at scale" ], "diagramSuggestion": "Medallion architecture layers — Bronze raw, Silver transformed, Gold curated — on open table format storage with time travel and ACID annotations.", "exampleUseCases": [ "Delta Lake Silver layer for dbt-transformed eLIMS and eQMS data", "Time-travel queries for retrospective audit reconstruction", "Microsoft Fabric as the unified lakehouse surface for BPT analytics workloads" ], "gxpRelevance": "High. Immutable history and time travel support point-in-time evidence reconstruction required for GxP audit trails.", "approvedVendors": [ { "id": "databricks", "name": "Databricks", "description": "Managed lakehouse platform built on Delta Lake with unified analytics and ML capabilities.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=d93a13fb3b0ad61095e91764c3e45a78&v=" }, { "id": "microsoft-fabric", "name": "Microsoft Fabric", "description": "Unified analytics platform integrating lakehouse, data engineering, and BI capabilities.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=b613c16cfb965e5cec84f464aeefdc74&v=" } ] }, { "id": "data-pipeline-etl-elt", "title": "Data Pipeline / ETL & ELT", "description": "Data movement and transformation patterns for ingesting, cleansing, and loading data across platform storage layers.", "madCard": null, "technologyPage": null, "controls": [ "provenance-capture", "telemetry-schema", "runtime-runbook" ], "vendors": [ { "id": "fivetran", "name": "Fivetran", "description": "Managed connector platform for automated data ingestion from SaaS and operational sources." } ], "industryDefinition": "Data pipelines move and transform data between systems. ETL (Extract, Transform, Load) applies transformations before loading; ELT (Extract, Load, Transform) loads raw data first and transforms in-place — the dominant pattern in modern lakehouses. Pipelines handle schema mapping, type coercion, incremental loading, deduplication, and lineage emission.", "usedFor": "Ingest raw source data, apply governed transformations, and populate Bronze, Silver, and Gold layers.", "industryBackground": [ { "name": "dbt Documentation", "url": "https://docs.getdbt.com/" }, { "name": "OpenLineage", "url": "https://openlineage.io/" }, { "name": "Apache Spark", "url": "https://spark.apache.org/" } ], "keyPrinciples": [ "ELT is preferred in lakehouse environments — transform after landing", "Pipelines should emit OpenLineage events for catalog integration", "Incremental loading patterns reduce cost and latency versus full refresh", "Schema contracts between source and target prevent silent corruption", "dbt tests embed data quality checks directly into transformation logic" ], "diagramSuggestion": "ELT pipeline from source system extraction through Bronze landing, Silver dbt transformation with tests, and Gold semantic output.", "exampleUseCases": [ "dbt Silver-layer transformation of eLIMS-BPT and eQMS exports with lineage emission", "ADF ingestion pipelines for instrument result data into ADLS Bronze", "Incremental dbt models for cost-efficient daily transformation runs" ], "gxpRelevance": "High. Transformation logic, test results, and lineage records are part of the data integrity evidence chain for regulated datasets.", "approvedVendors": [ { "id": "azure-data-factory", "name": "Azure Data Factory", "description": "Managed data integration service for ingestion, movement, and pipeline orchestration in Azure.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=113a13fb3b0ad61095e91764c3e45ac1&v=" }, { "id": "dbt", "name": "dbt", "description": "SQL-first transformation framework for governed, tested, and versioned ELT pipelines.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=be13c16cfb965e5cec84f464aeefdc6f&v=" }, { "id": "apache-spark", "name": "Apache Spark", "description": "Distributed processing engine for large-scale batch and streaming data transformation.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=513a13fb3b0ad61095e91764c3e45ac3&v=" } ] }, { "id": "data-quality-validation", "title": "Data Quality & Validation", "description": "Automated measurement, monitoring, and enforcement of data fitness across completeness, accuracy, consistency, and timeliness dimensions.", "madCard": null, "technologyPage": null, "controls": [ "provenance-capture", "telemetry-schema", "alert-rule-control" ], "vendors": [ { "id": "great-expectations", "name": "Great Expectations", "description": "Open-source data quality framework for defining, validating, and documenting data expectations." }, { "id": "soda", "name": "Soda", "description": "Data quality platform with monitoring, alerting, and governance integration." }, { "id": "monte-carlo", "name": "Monte Carlo", "description": "Data observability platform for automated anomaly detection and lineage-aware monitoring." }, { "id": "dbt-tests", "name": "dbt Tests", "description": "Built-in dbt test framework for inline schema and business rule validation in transformation pipelines." } ], "industryDefinition": "Data quality and validation measures and enforces the fitness of data for its intended use across six dimensions: completeness, accuracy, consistency, timeliness, validity, and uniqueness. Quality checks act as gates in pipelines and as continuous monitors in production, surfacing anomalies before they propagate to downstream analytics and AI consumers.", "usedFor": "Enforce data fitness rules at pipeline ingestion and transformation stages, and monitor ongoing quality in production datasets.", "industryBackground": [ { "name": "DAMA Data Quality Dimensions", "url": "https://www.dama.org/cpages/body-of-knowledge" }, { "name": "Great Expectations Documentation", "url": "https://docs.greatexpectations.io/" }, { "name": "ALCOA+ Data Integrity Principles", "url": "https://www.fda.gov/media/119267/download" } ], "keyPrinciples": [ "Define quality rules as code and version-control them alongside pipelines", "Gate pipeline promotion on quality check results", "Monitor quality continuously in production, not only at ingestion", "Classify issues by severity to separate blocking from warning conditions", "Link quality failures to lineage to identify upstream root causes" ], "diagramSuggestion": "Quality gate architecture in ELT pipeline with per-stage checks, pass/fail routing, and anomaly alert path to monitoring.", "exampleUseCases": [ "dbt tests enforcing completeness and referential integrity on Silver layer records", "Great Expectations suite validating instrument result ranges before AI consumption", "Monte Carlo anomaly detection alerting on unexpected volume or schema shifts" ], "gxpRelevance": "High. ALCOA+ data integrity principles require completeness, accuracy, and consistency controls directly satisfied by data quality gates." }, { "id": "streaming-analytics", "title": "Streaming Analytics", "description": "Real-time analysis of data in motion using stateful stream processing, window functions, and continuous query evaluation.", "madCard": null, "technologyPage": null, "controls": [ "transport-telemetry", "alert-rule-control", "telemetry-schema" ], "vendors": [ { "id": "apache-flink", "name": "Apache Flink", "description": "Stateful stream processing engine for real-time analytics and event-driven applications." }, { "id": "azure-stream-analytics", "name": "Azure Stream Analytics", "description": "Managed stream processing service for real-time event analysis in Azure." }, { "id": "kafka-streams", "name": "Apache Kafka Streams", "description": "Lightweight stream processing library for building stateful stream applications on Kafka." }, { "id": "spark-structured-streaming", "name": "Spark Structured Streaming", "description": "Unified streaming and batch processing built on the Spark engine with DataFrame API." } ], "industryDefinition": "Streaming analytics processes data in motion rather than at rest, applying windowed aggregations, stateful computations, and pattern detection with sub-second to second latency. It is the analytical complement to event brokers — while brokers transport events, streaming engines derive insight from them continuously.", "usedFor": "Detect anomalies, compute rolling metrics, and trigger alerts from live instrument and platform event streams.", "industryBackground": [ { "name": "Apache Flink", "url": "https://flink.apache.org/" }, { "name": "Azure Stream Analytics", "url": "https://learn.microsoft.com/azure/stream-analytics/" } ], "keyPrinciples": [ "Distinguish streaming transport (brokers) from streaming analytics (processing)", "Window functions define temporal scope for aggregations", "Stateful processing requires durable checkpointing for fault tolerance", "Watermarks manage late-arriving data in time-ordered streams", "Combine streaming and batch in a unified lakehouse for historical comparison" ], "diagramSuggestion": "Stream pipeline from event broker through stateful processing engine with windowed aggregations, alert path, and sink to analytics storage.", "exampleUseCases": [ "Real-time OOS detection on instrument result streams", "Rolling SLA compliance monitoring across active batch operations", "Live quality dashboard fed by continuous aggregation queries" ], "gxpRelevance": "Medium. Real-time quality monitoring supports proactive deviation detection, though stream processing infrastructure itself requires change control." }, { "id": "knowledge-representation-ontology", "title": "Knowledge Representation & Ontology Engineering", "description": "Formal modelling of domain concepts, relationships, and axioms as machine-readable ontologies that enable semantic reasoning and knowledge graph construction.", "madCard": null, "technologyPage": null, "controls": [ "ontology-mapping-required", "provenance-capture", "approved-knowledge-source" ], "vendors": [ { "id": "vocbench3", "name": "VocBench 3", "description": "Collaborative ontology and vocabulary editing platform supporting OWL, SKOS, and SPARQL." }, { "id": "protege", "name": "Protégé", "description": "Open-source ontology editor from Stanford with OWL reasoning and plugin ecosystem." }, { "id": "topbraid-composer", "name": "TopBraid Composer", "description": "Enterprise ontology and knowledge graph authoring platform with SPARQL and SHACL support." }, { "id": "ontotext-graphdb", "name": "Ontotext GraphDB", "description": "RDF triplestore and ontology storage platform with SPARQL endpoint and OWL reasoning." } ], "industryDefinition": "Knowledge representation and ontology engineering is the discipline of formally modelling domain entities, relationships, properties, and logical constraints in machine-readable form. Ontologies expressed in OWL enable automated reasoning, semantic interoperability, and grounded AI inference. In laboratory and life sciences contexts, domain ontologies like the Allotrope Foundation Ontology (AFO) and Basic Formal Ontology (BFO) provide standardized class hierarchies that align data from disparate instruments and systems.", "usedFor": "Build and maintain the semantic foundation that aligns lab domain concepts, enables knowledge graph reasoning, and grounds AI responses in controlled vocabulary.", "industryBackground": [ { "name": "W3C OWL 2 Web Ontology Language", "url": "https://www.w3.org/TR/owl2-overview/" }, { "name": "Allotrope Foundation Ontology", "url": "https://www.allotrope.org/" }, { "name": "Basic Formal Ontology", "url": "https://basic-formal-ontology.org/" }, { "name": "W3C SKOS", "url": "https://www.w3.org/TR/skos-reference/" } ], "keyPrinciples": [ "Build on upper ontologies (BFO) for interoperability with domain standards", "Use OWL axioms to enable automated reasoning beyond simple lookup", "Separate the ontology (TBox) from instance data (ABox) for maintainability", "Version and change-control ontology releases like software", "Validate ontology consistency with a reasoner before deployment" ], "diagramSuggestion": "Ontology layer stack showing BFO upper ontology, AFO domain ontology, OntoEurofins extension, and instance data binding in GraphDB.", "exampleUseCases": [ "OntoEurofins ontology built on AFO and BFO for lab domain alignment", "VocBench 3 on AKS for governed collaborative ontology authoring", "SPARQL reasoning chains linking instrument results to regulatory requirements" ], "gxpRelevance": "High. Ontology-grounded AI reasoning provides the semantic traceability required for explainable and inspectable decisions in regulated laboratory workflows." } ] }, { "id": "compute-runtime-infrastructure", "title": "Compute & Runtime Infrastructure", "description": "The execution substrate that provides the processing capacity, scheduling, and operational visibility required to run platform workloads reliably at scale. This category covers containerised and serverless compute environments, GPU-backed infrastructure for model workloads, workflow orchestration that coordinates multi-step job execution, model serving runtimes that host AI endpoints in production, and the observability discipline that monitors health, performance, and cost across all running systems.", "concepts": [ { "id": "compute", "title": "Compute", "description": "Container, serverless, and orchestrated compute platforms for backend and AI execution workloads.", "madCard": "https://mad.firstmark.com/card#recFneyBPhQVC3Kmx", "technologyPage": "backend-runtime.html", "controls": [ "backend-least-privilege", "runtime-registration", "runtime-runbook" ], "vendors": [ { "id": "amazon-eks-ecs", "name": "Amazon EKS / ECS", "description": "Managed AWS container orchestration services for scalable execution." }, { "id": "gke", "name": "Google Kubernetes Engine", "description": "Managed Kubernetes with integrated cloud operations." } ], "industryDefinition": "Compute is the execution substrate (CPU, memory, network, and runtime) where application and AI workloads run. Cloud-native compute combines containers, Kubernetes orchestration, and serverless event handlers. AI platforms typically segment compute by workload profile: CPU services for orchestration and APIs, GPU pools for inference, and serverless for lightweight triggers.", "usedFor": "Run backend APIs, orchestration workers, event handlers, and model-adjacent services.", "industryBackground": [ { "name": "Open Container Initiative (OCI)", "url": "https://opencontainers.org/" }, { "name": "Kubernetes", "url": "https://kubernetes.io/" }, { "name": "CIS Kubernetes Benchmark", "url": "https://www.cisecurity.org/benchmark/kubernetes" } ], "keyPrinciples": [ "Immutable infrastructure: build once and redeploy rather than patch in place", "Resource requests and limits prevent noisy-neighbor instability", "Scale-out for stateless services, scale-up for resource-bound services", "Namespace and workload isolation must align with trust boundaries", "Use workload identity instead of embedded credentials" ], "diagramSuggestion": "AKS topology showing CPU/GPU node pools, namespace isolation, ingress path, and pod-level managed identity.", "exampleUseCases": [ "AKS hosting Qdrant, VocBench 3, and agent runtime services", "Azure Functions for webhook-triggered automation", "Reserved GPU pool for future embedding or local inference workloads" ], "gxpRelevance": "Medium. Compute changes and image provenance should be change-controlled and auditable in validated environments.", "approvedVendors": [ { "id": "azure-aks", "name": "Azure Kubernetes Service", "description": "Managed Kubernetes for containerized backend and AI workloads.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=853adfbb3b0ad61095e91764c3e45ab6&v=" }, { "id": "azure-functions", "name": "Azure Functions", "description": "Serverless event-driven execution for lightweight automation paths.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=593a13fb3b0ad61095e91764c3e45abe&v=" } ] }, { "id": "orchestration", "title": "Orchestration", "description": "Workflow scheduling and dependency orchestration for data, model, and agent operations.", "madCard": "https://mad.firstmark.com/card#recuRxuhkjgRPZ7Hi", "technologyPage": null, "controls": [ "runtime-runbook", "safe-stop-and-escalation" ], "vendors": [ { "id": "prefect", "name": "Prefect", "description": "Developer-first workflow orchestration with hybrid cloud control." }, { "id": "dagster", "name": "Dagster", "description": "Asset-centric orchestration for data and AI pipelines." }, { "id": "temporal", "name": "Temporal", "description": "Durable execution and retries for long-running business workflows." } ], "industryDefinition": "Workflow orchestration coordinates dependent tasks, retries, schedules, and failure handling across distributed systems. It is the explicit control layer for sequence and execution state, distinct from event choreography. In AI/data platforms it spans batch, event-driven, and multi-step agent execution flows.", "usedFor": "Automate end-to-end job execution for ingestion, transformation, model operations, and agent workflows.", "industryBackground": [ { "name": "Apache Airflow", "url": "https://airflow.apache.org/" }, { "name": "OpenLineage", "url": "https://openlineage.io/" }, { "name": "Temporal", "url": "https://temporal.io/" } ], "keyPrinciples": [ "Use DAG models for explicit dependency and execution order", "Idempotent tasks are required for safe retries", "Backfill capability is essential for corrections and historical recompute", "Every run should emit structured telemetry and lineage", "Keep schedule/dependency logic separate from business transformations" ], "diagramSuggestion": "DAG diagram with ingest, validate, transform, load, and notify tasks; show retry path and trigger entry from schedule/event.", "exampleUseCases": [ "Bronze to Silver to Gold Medallion pipeline orchestration", "Event-triggered agent workflow when new instrument data arrives", "dbt transformation scheduling with lineage emission" ], "gxpRelevance": "Medium-High. Runs, failures, retries, and operator interventions must be fully auditable.", "approvedVendors": [ { "id": "apache-airflow", "name": "Apache Airflow", "description": "Open-source workflow orchestration for DAG-based batch and platform operations.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=b43a9fbb3b0ad61095e91764c3e45aba&v=" } ] }, { "id": "cloud-observability", "title": "Cloud Observability", "description": "Cross-layer telemetry capture, tracing, alerting, and operations observability.", "madCard": "https://mad.firstmark.com/card#recfwnGgxh21FFXVH", "technologyPage": "ai-observability-metering.html", "controls": [ "centralized-telemetry", "telemetry-schema", "alert-rule-control" ], "vendors": [ { "id": "datadog", "name": "Datadog", "description": "Application and infrastructure observability with metrics, logs, traces, and alerting." } ], "industryDefinition": "Cloud observability infers internal system state from external outputs: logs, metrics, traces, and events. It extends monitoring by supporting diagnosis of unknown failure modes through correlated high-fidelity telemetry. AI systems add model-behavior signals such as token latency, rejection rates, and groundedness proxies.", "usedFor": "Track health, performance, cost, and incident signals across platform and AI workloads.", "industryBackground": [ { "name": "OpenTelemetry", "url": "https://opentelemetry.io/" }, { "name": "W3C Trace Context", "url": "https://www.w3.org/TR/trace-context/" }, { "name": "Prometheus Exposition Format", "url": "https://prometheus.io/docs/instrumenting/exposition_formats/" } ], "keyPrinciples": [ "Logs, metrics, and traces are all required for effective diagnosis", "Control high-cardinality dimensions for cost without losing forensic value", "Structured logging is mandatory for machine-parsed analytics", "Alert on SLO impact and user symptoms, not only infrastructure heartbeat", "Trace and correlation IDs must propagate end-to-end" ], "diagramSuggestion": "Request path across gateway, runtime, LLM, tools, and storage, with span capture at each hop and centralized logs/metrics/traces sink.", "exampleUseCases": [ "Trace Semantic Kernel to Azure OpenAI to GraphDB in one execution graph", "Alert when P95 LLM latency breaches service objective", "Correlate AI cost spikes with specific workflow traces" ], "gxpRelevance": "High. Immutable, attributable telemetry is core operational evidence for regulated platforms.", "approvedVendors": [ { "id": "azure-monitor", "name": "Azure Monitor", "description": "Azure-native metrics, logs, alerts, and workbooks for cloud workloads.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=b03adfbb3b0ad61095e91764c3e45a4b&v=" }, { "id": "grafana", "name": "Grafana", "description": "Open observability dashboards with alerting and multi-source telemetry.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=313a93fb3b0ad61095e91764c3e45ab1&v=" }, { "id": "splunk", "name": "Splunk", "description": "Telemetry indexing and analytics for operations and security workflows.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=472a9bbb3b0ad61095e91764c3e45a67&v=" } ] }, { "id": "gpu-cloud-deployment-infra", "title": "GPU Cloud / Deployment Infra", "description": "GPU-oriented cloud and deployment infrastructure for training and high-throughput inference.", "madCard": "https://mad.firstmark.com/card#recdXXVaVN13DvHFk", "technologyPage": "ai-model-runtime.html", "controls": [ "runtime-registration", "cost-attribution", "alert-rule-control" ], "vendors": [ { "id": "coreweave", "name": "CoreWeave", "description": "GPU cloud platform focused on AI training and inference workloads." }, { "id": "lambda", "name": "Lambda", "description": "GPU infrastructure and managed services for AI workload execution." }, { "id": "aws-gpu", "name": "AWS GPU Instances", "description": "Cloud GPU instances for scalable model training and inference." } ], "industryDefinition": "GPU cloud deployment infrastructure provides accelerated compute for training and high-throughput inference workloads. Selection between managed APIs, managed GPU hosting, and self-managed GPU clusters depends on sovereignty, latency, and cost constraints.", "usedFor": "Provision GPU-backed environments for training and high-throughput inference workloads.", "keyPrinciples": [ "Use GPU only where latency/throughput profile requires it", "Leverage quantization to reduce memory and cost footprint", "Use parallelism strategies for models exceeding single-GPU capacity", "Balance spot/on-demand economics with interruption tolerance" ], "diagramSuggestion": "GPU deployment topology with managed API, managed GPU pool, and self-hosted AKS GPU node options.", "exampleUseCases": [ "GPU pool for local embedding and inference workloads", "Cost-aware inference placement by latency and sovereignty requirements" ], "gxpRelevance": "Low-Medium. Infrastructure used in regulated decision pathways must be change-controlled and documented.", "approvedVendors": [ { "id": "azure-nd", "name": "Azure ND / MI Series", "description": "Azure high-performance GPU compute families for AI deployments.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=bc3adfbb3b0ad61095e91764c3e45a32&v=" } ] }, { "id": "model-serving-inference-runtimes", "title": "Model Serving & Inference Runtimes", "description": "Inference servers and runtime engines for managed, scalable, and governed model execution.", "madCard": "https://mad.firstmark.com/card#recAuoK4Y58bqFWON", "technologyPage": "ai-model-runtime.html", "controls": [ "runtime-registration", "traceable-execution-plan", "safe-stop-and-escalation" ], "vendors": [ { "id": "vllm", "name": "vLLM", "description": "Open-source high-throughput inference runtime for large language models." }, { "id": "nvidia-triton", "name": "NVIDIA Triton", "description": "Production inference server for multi-framework model deployment." }, { "id": "together-ai", "name": "Together AI", "description": "Model hosting and inference platform for frontier and open models." }, { "id": "baseten", "name": "Baseten", "description": "Model serving and deployment platform with operational controls." } ], "industryDefinition": "Model serving runtimes expose trained models as scalable APIs with operational controls for concurrency, batching, rollout, and health. Modern runtimes optimize latency and throughput with dynamic batching and memory-efficient inference strategies.", "usedFor": "Serve model endpoints with throughput controls, rollout safety, and runtime observability.", "keyPrinciples": [ "Tune throughput and latency profiles per use case", "Support multi-version deployment with controlled rollout", "Expose health probes and circuit breakers to contain failures", "Apply serving-time quantization where quality and latency permit" ], "diagramSuggestion": "Inference serving path with queue, batched runtime, model registry, and resilient health/circuit controls.", "exampleUseCases": [ "vLLM runtime for high-throughput model serving", "Canary model rollout with health and latency gate checks" ], "gxpRelevance": "Medium. Serving runtime behavior in regulated decision pathways requires documented qualification and change control." } ] }, { "id": "security-identity", "title": "Security & Identity", "description": "The cross-cutting control plane that governs who and what can access platform resources, how trust is established and verified, how data and communications are protected, and how threats are detected and contained. This category treats security as a unified discipline spanning identity and access management, network security, and data privacy — rather than as isolated point controls scattered across infrastructure layers. In regulated environments, the controls in this category are directly traceable to compliance obligations under GxP, GDPR, and ISO 27001.", "concepts": [ { "id": "privacy-security", "title": "Data Privacy & Protection", "description": "Data privacy, security posture, policy enforcement, and governance controls for sensitive AI data flows.", "madCard": "https://mad.firstmark.com/card#recgWbMKo6jECiOPT", "technologyPage": null, "controls": [ "sensitive-data-redaction", "data-classification-check", "audit-access-control" ], "vendors": [ { "id": "securiti", "name": "Securiti", "description": "Privacy and security controls for structured and unstructured data estates." }, { "id": "onetrust", "name": "OneTrust", "description": "Privacy, compliance, and data governance control management." }, { "id": "privacera", "name": "Privacera", "description": "Fine-grained policy enforcement for cloud data platforms." }, { "id": "bigid", "name": "BigID", "description": "Data discovery, classification, and privacy risk management." } ], "industryDefinition": "Privacy and security govern who can access sensitive data, for what purpose, and under what controls. Privacy obligations focus on lawful use and minimization; security obligations focus on preventing unauthorized access, tampering, and exfiltration. In AI systems this extends to training-data provenance, inference-time redaction, and output safety filtering.", "usedFor": "Apply classification, minimization, redaction, and access governance to sensitive AI inputs and outputs.", "industryBackground": [ { "name": "GDPR", "url": "https://gdpr-info.eu/" }, { "name": "ISO/IEC 27001", "url": "https://www.iso.org/isoiec-27001-information-security.html" }, { "name": "NIST Privacy Framework", "url": "https://www.nist.gov/privacy-framework" }, { "name": "ICH E6(R3) GCP", "url": "https://www.ich.org/page/efficacy-guidelines" } ], "keyPrinciples": [ "Data minimization: collect and retain only what is needed", "Purpose limitation: prevent unauthorized secondary use", "Privacy by design and security by default", "Classification must precede access and handling policy", "Deletion/erasure obligations must propagate through pipelines" ], "diagramSuggestion": "Data flow from source to ingestion to transformation to AI inference, with per-stage classification and control gates.", "exampleUseCases": [ "Row-level security enforcement for confidential eQMS fields", "PII redaction before sending prompts to model endpoints", "DPIA workflow for new AI features using personal data" ], "gxpRelevance": "High. ALCOA+ aligned access and integrity controls overlap directly with GxP requirements.", "subcategory": "Data Privacy & Compliance" }, { "id": "network-segmentation-zero-trust", "title": "Network Segmentation & Zero Trust", "description": "Trust-zone architecture and microsegmentation controls that isolate AI components and reduce lateral movement risk.", "madCard": null, "technologyPage": "edge-transport-security.html", "controls": [ "default-deny-network-policy", "approved-edge-routing", "transport-telemetry" ], "vendors": [ { "id": "palo-alto-prisma", "name": "Palo Alto Prisma", "description": "Zero trust network security and segmentation controls for hybrid cloud estates." }, { "id": "zscaler", "name": "Zscaler", "description": "Zero trust access and traffic inspection platform for enterprise connectivity policies." }, { "id": "cisco-secure-workload", "name": "Cisco Secure Workload", "description": "Application dependency mapping and microsegmentation policy enforcement." }, { "id": "illumio", "name": "Illumio", "description": "Host-level segmentation platform to reduce attack propagation paths." } ], "industryDefinition": "Zero trust networking removes implicit trust based on location and requires continuous authentication, authorization, and inspection for every request. Segmentation enforces boundaries so compromised workloads cannot move laterally across unrelated systems.", "usedFor": "Define trust zones and explicit flow restrictions around AI runtimes, tools, and sensitive data services.", "industryBackground": [ { "name": "NIST SP 800-207 Zero Trust Architecture", "url": "https://doi.org/10.6028/NIST.SP.800-207" }, { "name": "CISA Zero Trust Maturity Model", "url": "https://www.cisa.gov/resources-tools/resources/zero-trust-maturity-model" } ], "keyPrinciples": [ "Default-deny network policy with explicit allow rules", "Microsegmentation between workloads and trust zones", "Identity-based policy is preferable to IP-based policy", "Continuous verification should be applied across sessions", "Assume breach and design containment boundaries" ], "diagramSuggestion": "Trust-zone architecture with enforcement points between internet, platform VNet, and GxP perimeter, with audited decision points.", "exampleUseCases": [ "Kubernetes network policies isolating agent runtime namespaces", "Identity-aware service-to-service allow-list policy", "Audited east-west enforcement in service mesh" ], "gxpRelevance": "High. Segmented and testable access boundaries are auditable controls in validated systems.", "subcategory": "Network Security" }, { "id": "secure-connectivity-encryption", "title": "Secure Connectivity & Encryption", "description": "Encrypted transport channels, mutual authentication, and certificate lifecycle controls for internal and external AI service calls.", "madCard": null, "technologyPage": "edge-transport-security.html", "controls": [ "mutual-tls-enforcement", "key-certificate-rotation", "transport-telemetry" ], "vendors": [ { "id": "cert-manager", "name": "cert-manager", "description": "Kubernetes-native certificate issuance and renewal automation." }, { "id": "aws-acm", "name": "AWS Certificate Manager", "description": "Certificate provisioning and renewal for secure cloud endpoints." } ], "industryDefinition": "Secure connectivity protects data in transit with strong encryption, authenticated endpoints, and managed certificate lifecycle operations. mTLS extends trust by requiring both client and server identity proof. Certificate issuance, rotation, and revocation are required operational controls.", "usedFor": "Enforce TLS/mTLS and certificate hygiene across AI gateways, tools, and backend integrations.", "industryBackground": [ { "name": "RFC 8446 TLS 1.3", "url": "https://www.rfc-editor.org/rfc/rfc8446" }, { "name": "NIST SP 800-52 Rev 2", "url": "https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final" }, { "name": "RFC 5280 PKIX", "url": "https://www.rfc-editor.org/rfc/rfc5280" } ], "keyPrinciples": [ "Prefer TLS 1.3 and retire legacy protocol versions", "Use short-lived certs and automate rotation", "Use private CA for internal service identity", "Keep key material in managed vault services", "Document certificate ownership and revocation process" ], "diagramSuggestion": "Service-to-service connectivity map with encrypted channels, mTLS trust chain, and certificate lifecycle controls.", "exampleUseCases": [ "mTLS between agent runtime and internal tools", "Automated cert rotation via cert-manager or vault PKI", "Private endpoint-only encrypted paths for sensitive data services" ], "gxpRelevance": "High. Protected transport and auditable certificate controls are required for regulated data in transit.", "subcategory": "Network Security", "approvedVendors": [ { "id": "hashicorp-vault", "name": "HashiCorp Vault", "description": "Secrets, PKI, and certificate automation for secure service connectivity.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=753ad3fb3b0ad61095e91764c3e45a2c&v=" }, { "id": "azure-key-vault", "name": "Azure Key Vault", "description": "Managed key and certificate services for encrypted cloud workloads.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=013adfbb3b0ad61095e91764c3e45ad3&v=" } ] }, { "id": "service-mesh-l7-policies", "title": "Service Mesh (mTLS, L7 Policies)", "description": "Cluster-level traffic control layer for policy-based routing, retries, telemetry, and workload identity enforcement.", "madCard": null, "technologyPage": "ai-gateway.html", "controls": [ "identity-based-traffic-policy", "approved-edge-routing", "alert-rule-control" ], "vendors": [ { "id": "istio", "name": "Istio", "description": "Open service mesh with mTLS, policy, telemetry, and advanced traffic management." }, { "id": "linkerd", "name": "Linkerd", "description": "Lightweight service mesh focused on secure and observable service communication." }, { "id": "cilium-service-mesh", "name": "Cilium Service Mesh", "description": "eBPF-powered service networking, policy enforcement, and observability." }, { "id": "consul", "name": "HashiCorp Consul", "description": "Service discovery and mesh capabilities for secure multi-runtime service connectivity." } ], "industryDefinition": "Service mesh adds a policy and telemetry layer to east-west service traffic through transparent proxies. It enables mTLS by default, L7 routing, retry/circuit-breaking behavior, and fine-grained traffic policy without modifying application logic.", "usedFor": "Apply identity-bound communication policies, resilience behavior, and telemetry across internal AI services.", "industryBackground": [ { "name": "Istio", "url": "https://istio.io/" }, { "name": "Linkerd", "url": "https://linkerd.io/" }, { "name": "Cilium Service Mesh", "url": "https://docs.cilium.io/en/stable/network/servicemesh/" } ], "keyPrinciples": [ "Mesh-level mTLS should be default for service traffic", "Express L7 routing and resilience policy declaratively", "Emit mesh telemetry for all inter-service calls", "Use circuit breakers to contain cascading failures", "Choose sidecar vs ambient model based on overhead profile" ], "diagramSuggestion": "Sidecar/ambient mesh request path showing mTLS tunnel, policy enforcement, and telemetry export.", "exampleUseCases": [ "Policy-based traffic routing between agent runtime and tool services", "Automatic retries with bounded backoff on transient failures", "Mesh-level span emission without per-service instrumentation" ], "gxpRelevance": "Medium. Mesh policy and logs provide inspectable communication controls between validated components.", "subcategory": "Network Security" }, { "id": "workforce-identity-sso", "title": "Workforce Identity & SSO", "description": "Enterprise workforce identity, directory integration, SSO, and adaptive access for internal users.", "madCard": null, "technologyPage": null, "controls": [ "sso-required", "conditional-access-policy", "audit-access-control" ], "vendors": [ { "id": "okta-workforce-identity", "name": "Okta Workforce Identity", "description": "Cloud workforce identity with centralized authentication and lifecycle controls." }, { "id": "ping-identity", "name": "Ping Identity", "description": "Identity federation and access controls for enterprise workforce environments." }, { "id": "keycloak", "name": "Keycloak", "description": "Open-source identity platform for SSO and centralized authentication management." } ], "industryDefinition": "Workforce identity centralizes enterprise authentication for employees and contractors through federated single sign-on and policy-driven session control. It reduces credential sprawl and provides a single control point for onboarding, offboarding, and conditional access decisions.", "usedFor": "Provide centralized sign-in, policy-based access, and secure session continuity across enterprise applications.", "industryBackground": [ { "name": "NIST SP 800-63 Digital Identity Guidelines", "url": "https://doi.org/10.6028/NIST.SP.800-63-4" } ], "keyPrinciples": [ "Directory is the source of truth for workforce identities", "Use federation assertions instead of local password replication", "Conditional access should include device and risk posture", "Automate account lifecycle with joiner/mover/leaver integration" ], "diagramSuggestion": "Workforce identity flow from directory and IdP through SSO and conditional access into internal applications.", "exampleUseCases": [ "Centralized Entra ID access to agent and analytics applications", "MFA step-up for sensitive data and privileged actions" ], "gxpRelevance": "High. Unique identity and attributable access are core Part 11 controls.", "subcategory": "Identity & Access Management", "approvedVendors": [ { "id": "microsoft-entra-id", "name": "Microsoft Entra ID", "description": "Enterprise identity platform for workforce SSO, conditional access, and policy enforcement.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=3d3ad3fb3b0ad61095e91764c3e45a34&v=" } ] }, { "id": "ciam-external-identity", "title": "Customer & Partner Identity (CIAM/B2B)", "description": "Identity management for external users, partners, and delegated tenant-aware access models.", "madCard": null, "technologyPage": null, "controls": [ "external-access-policy", "approved-edge-routing", "audit-access-control" ], "vendors": [ { "id": "auth0", "name": "Auth0", "description": "CIAM platform for customer sign-up, login, and extensible identity workflows." }, { "id": "okta-customer-identity", "name": "Okta Customer Identity", "description": "External identity platform for customer and partner authentication journeys." }, { "id": "entra-external-id", "name": "Microsoft Entra External ID", "description": "External user and B2B identity platform for secure federation and access control." }, { "id": "pingone", "name": "PingOne", "description": "Cloud identity services for CIAM, federation, and policy-driven external access." } ], "industryDefinition": "CIAM manages identity for users outside organizational boundaries, including partners and external collaborators. It supports invitation-based onboarding, delegated administration, and tenant-scoped access while maintaining controlled trust boundaries.", "usedFor": "Authenticate external users and partners while enforcing tenant boundaries and policy-scoped delegated access.", "industryBackground": [ { "name": "OpenID Connect Core", "url": "https://openid.net/specs/openid-connect-core-1_0.html" } ], "keyPrinciples": [ "Tenant isolation is mandatory for external organization access", "Prefer invitation-based onboarding over open self-registration", "Use delegated administration with bounded guardrails", "Grant least privilege aligned to integration purpose" ], "diagramSuggestion": "External tenant onboarding and delegated administration flow with policy boundaries.", "exampleUseCases": [ "Cross-division partner access to scoped collaboration portals", "B2B delegated access with per-tenant policy constraints" ], "gxpRelevance": "High. External access must remain attributable, scoped, and auditable in regulated environments.", "subcategory": "Identity & Access Management" }, { "id": "authentication-assurance-mfa", "title": "Authentication Assurance & MFA", "description": "Assurance-level authentication controls including phishing-resistant MFA, passkeys, and step-up policies.", "madCard": null, "technologyPage": null, "controls": [ "mfa-required", "phishing-resistant-auth", "step-up-authentication" ], "vendors": [ { "id": "yubico", "name": "Yubico", "description": "Hardware and passkey-based phishing-resistant authentication technologies." }, { "id": "duo", "name": "Cisco Duo", "description": "MFA and adaptive authentication platform with device trust checks." }, { "id": "microsoft-authenticator", "name": "Microsoft Authenticator", "description": "Authenticator app supporting push, TOTP, and passwordless sign-in patterns." }, { "id": "fido2-webauthn", "name": "FIDO2 / WebAuthn", "description": "Standards-based phishing-resistant authentication using public-key credentials." } ], "industryDefinition": "Authentication assurance defines confidence level in user identity verification, including MFA and phishing-resistant methods such as FIDO2 passkeys. Risk-adaptive controls and step-up authentication are used for higher-consequence operations.", "usedFor": "Apply strong and step-up authentication requirements for sensitive operations and privileged access.", "industryBackground": [ { "name": "NIST SP 800-63B Authentication and Authenticator Management", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html" }, { "name": "WebAuthn Specification", "url": "https://www.w3.org/TR/webauthn-2/" } ], "keyPrinciples": [ "Target phishing-resistant authenticators as baseline", "Enforce step-up authentication on high-risk operations", "Scale authentication requirements by contextual risk signals" ], "diagramSuggestion": "Risk-based login flow with conditional policy and step-up MFA for sensitive actions.", "exampleUseCases": [ "AAL2+ controls for privileged platform actions", "Passkey-based access for administrative operations" ], "gxpRelevance": "High. Strong multifactor identity proof supports electronic signature and accountability controls.", "subcategory": "Identity & Access Management" }, { "id": "federation-token-services", "title": "Federation & Token Services", "description": "Federated identity assertion and token management for delegated authorization and interoperable identity exchange.", "madCard": null, "technologyPage": null, "controls": [ "token-lifetime-policy", "token-introspection-required", "policy-as-code" ], "vendors": [ { "id": "keycloak", "name": "Keycloak", "description": "Open-source identity broker supporting OAuth2/OIDC and federation patterns." }, { "id": "pingfederate", "name": "PingFederate", "description": "Identity federation server for enterprise SSO and token orchestration." }, { "id": "auth0", "name": "Auth0", "description": "Developer identity platform supporting OAuth2, OIDC, and token lifecycle services." }, { "id": "microsoft-entra-id", "name": "Microsoft Entra ID", "description": "Token issuance and federation services for workforce and application identity." } ], "industryDefinition": "Federation and token services enable trusted identity and authorization exchange across systems and organizational boundaries using OAuth2/OIDC standards. Short-lived signed tokens with scoped permissions provide interoperable delegated access.", "usedFor": "Broker identity assertions, scoped tokens, and delegated permissions between clients, APIs, and identity providers.", "industryBackground": [ { "name": "OAuth 2.0 Framework", "url": "https://www.rfc-editor.org/rfc/rfc6749" }, { "name": "OpenID Connect Discovery", "url": "https://openid.net/specs/openid-connect-discovery-1_0.html" } ], "keyPrinciples": [ "Use short-lived tokens and rotate refresh credentials", "Validate token audience and issuer on every API", "Minimize scope claims to task-level permissions", "Use workload federation instead of static client secrets" ], "diagramSuggestion": "Token issuance and validation path from IdP to API resource servers with scope checks.", "exampleUseCases": [ "Cross-service delegated API access with auditable token claims", "Workload identity federation for non-human automation" ], "gxpRelevance": "High. Token subject and scope data are part of API access audit evidence.", "subcategory": "Identity & Access Management" }, { "id": "authorization-entitlement-policy", "title": "Authorization & Entitlement Policy", "description": "Fine-grained authorization policy, entitlement modeling, and decision enforcement for users and services.", "madCard": null, "technologyPage": null, "controls": [ "policy-as-code", "least-privilege-required", "approval-record-required" ], "vendors": [ { "id": "open-policy-agent", "name": "Open Policy Agent", "description": "Policy-as-code engine for centralized authorization decisions across systems." }, { "id": "openfga", "name": "OpenFGA", "description": "Relationship-based authorization engine for fine-grained access control." }, { "id": "oso", "name": "Oso", "description": "Application authorization framework for policy modeling and enforcement." }, { "id": "amazon-verified-permissions", "name": "Amazon Verified Permissions", "description": "Managed authorization service for policy evaluation and entitlement decisions." } ], "industryDefinition": "Authorization and entitlement policy determines what authenticated identities can do. Modern authorization externalizes decisions into policy engines supporting RBAC, ABAC, and relationship-driven models to enforce consistent least-privilege access.", "usedFor": "Enforce least-privilege access and auditable entitlement decisions across APIs, tools, and applications.", "industryBackground": [ { "name": "NIST Policy Machine Overview", "url": "https://csrc.nist.gov/projects/policy-machine" } ], "keyPrinciples": [ "Externalize authorization logic from application code", "Treat policy as versioned, testable code", "Default deny when no explicit allow rule matches", "Log every decision with input attributes and policy version" ], "diagramSuggestion": "Policy decision point and policy enforcement point flow for user and workload requests.", "exampleUseCases": [ "OPA/OpenFGA policy checks for tool and data access", "Recorded entitlement decisions for regulated records" ], "gxpRelevance": "High. Controlled and auditable authorization is foundational for regulated record access.", "subcategory": "Identity & Access Management" }, { "id": "privileged-access-management", "title": "Privileged Access Management (PAM)", "description": "Just-in-time elevated access, privileged session controls, and credential vaulting for high-risk operations.", "madCard": null, "technologyPage": null, "controls": [ "just-in-time-privilege", "privileged-session-recording", "break-glass-control" ], "vendors": [ { "id": "cyberark", "name": "CyberArk", "description": "Privileged access platform with vaulting, session controls, and JIT elevation." }, { "id": "delinea", "name": "Delinea", "description": "PAM platform for privileged account governance and access workflows." }, { "id": "teleport", "name": "Teleport", "description": "Identity-native infrastructure access with certificate-based privileged controls." } ], "industryDefinition": "Privileged access management governs elevated administrative operations through just-in-time elevation, vault-managed credentials, and session oversight. It minimizes standing privilege and improves forensic accountability.", "usedFor": "Restrict, broker, and audit privileged operations with temporary elevation and explicit approvals.", "industryBackground": [ { "name": "CISA Privileged Access Management Guidance", "url": "https://www.cisa.gov/resources-tools/resources/privileged-access-management-pam" } ], "keyPrinciples": [ "Eliminate standing privilege and use time-bound elevation", "Use documented break-glass paths for emergencies", "Separate requester and approver duties for privileged actions" ], "diagramSuggestion": "JIT elevation workflow with request, approval, vault checkout, session recording, and auto-revoke.", "exampleUseCases": [ "Time-bound admin access to production clusters", "Session recording for sensitive infrastructure changes" ], "gxpRelevance": "High. Privileged access controls are frequently inspected in regulated system audits.", "subcategory": "Identity & Access Management", "approvedVendors": [ { "id": "beyondtrust", "name": "BeyondTrust", "description": "Privileged access and remote support controls with session auditing.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=86ecb5672b4a6218e4a5f364b891bf23&v=" } ] }, { "id": "workload-machine-identity", "title": "Workload & Machine Identity", "description": "Non-human identity for workloads and services using short-lived credentials, trust domains, and machine-to-machine authentication.", "madCard": null, "technologyPage": null, "controls": [ "workload-identity-required", "mutual-tls-enforcement", "key-certificate-rotation" ], "vendors": [ { "id": "spiffe-spire", "name": "SPIFFE / SPIRE", "description": "Open standards and runtime for workload identity issuance and trust domain federation." }, { "id": "hashicorp-vault", "name": "HashiCorp Vault", "description": "Secrets and PKI platform for dynamic machine identities and credential rotation." }, { "id": "cert-manager", "name": "cert-manager", "description": "Kubernetes certificate lifecycle automation supporting service identity workflows." }, { "id": "azure-managed-identity", "name": "Azure Managed Identity", "description": "Cloud-native workload identity for service-to-service authentication without embedded secrets." } ], "industryDefinition": "Workload identity extends IAM to non-human actors such as services, agents, and pipelines. It replaces long-lived static secrets with short-lived cryptographically verifiable credentials issued by managed identity or trust-domain systems.", "usedFor": "Authenticate workload-to-workload traffic with short-lived credentials and trust-domain policy controls.", "industryBackground": [ { "name": "SPIFFE Overview", "url": "https://spiffe.io/docs/latest/spiffe-about/overview/" } ], "keyPrinciples": [ "No hardcoded credentials in code, images, or static config", "Issue short-lived credentials and rotate continuously", "Assign distinct identity per workload for attribution", "Use federation for cross-tenant non-human trust" ], "diagramSuggestion": "Service identity issuance and validation flow for workload-to-workload calls.", "exampleUseCases": [ "Managed identity for service-to-service API authentication", "SPIFFE-based workload identity across Kubernetes services" ], "gxpRelevance": "High. Per-workload attribution is required for reliable audit trails in regulated automation.", "subcategory": "Identity & Access Management" }, { "id": "identity-governance-administration", "title": "Identity Governance & Administration (IGA)", "description": "Identity lifecycle controls including joiner/mover/leaver automation, access certification, and segregation-of-duties governance.", "madCard": null, "technologyPage": null, "controls": [ "access-review-control", "segregation-of-duties-policy", "approval-record-required" ], "vendors": [ { "id": "saviynt", "name": "Saviynt", "description": "Cloud identity governance with risk-aware access controls and provisioning workflows." }, { "id": "microsoft-entra-id-governance", "name": "Microsoft Entra ID Governance", "description": "Identity lifecycle and access review governance integrated with Entra ID." }, { "id": "one-identity", "name": "One Identity", "description": "Identity governance and privileged governance controls for enterprise access risk." } ], "industryDefinition": "Identity governance and administration automates joiner/mover/leaver lifecycle events, access certification campaigns, and segregation-of-duties controls. It ensures access remains appropriate over time rather than only at onboarding.", "usedFor": "Automate provisioning, periodic recertification, and role governance with auditable approval evidence.", "industryBackground": [ { "name": "NIST SP 800-63C Federation and Assertions", "url": "https://pages.nist.gov/800-63-4/sp800-63c.html" } ], "keyPrinciples": [ "Automate lifecycle provisioning and deprovisioning", "Run recurring access certification for entitlement validation", "Enforce segregation-of-duties policies for incompatible roles" ], "diagramSuggestion": "Identity lifecycle state flow for joiner, mover, leaver, and periodic recertification.", "exampleUseCases": [ "Automated offboarding revocation across platform systems", "Quarterly entitlement recertification for regulated roles" ], "gxpRelevance": "High. Access review and SoD controls are common GxP inspection requirements.", "subcategory": "Identity & Access Management", "approvedVendors": [ { "id": "sailpoint", "name": "SailPoint", "description": "Identity governance platform for lifecycle automation and access certification.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=fe13c16cfb965e5cec84f464aeefdc74&v=" } ] }, { "id": "identity-threat-detection-response", "title": "Identity Threat Detection & Response (ITDR)", "description": "Monitoring and response controls for identity-centric attacks, token abuse, and account compromise scenarios.", "madCard": null, "technologyPage": null, "controls": [ "identity-anomaly-detection", "token-abuse-detection", "incident-response-runbook" ], "vendors": [ { "id": "microsoft-defender-for-identity", "name": "Microsoft Defender for Identity", "description": "Identity-focused threat detection for account compromise and lateral movement signals." }, { "id": "silverfort", "name": "Silverfort", "description": "Identity security platform for adaptive controls across legacy and modern authentication paths." }, { "id": "crowdstrike-falcon-identity", "name": "CrowdStrike Falcon Identity Protection", "description": "Identity attack path detection and response for credential abuse and privilege escalation." }, { "id": "semperis", "name": "Semperis", "description": "Directory and identity resilience platform for attack detection and recovery support." } ], "industryDefinition": "Identity Threat Detection and Response monitors identity telemetry for compromise indicators such as credential abuse, token misuse, and suspicious escalation behavior. It complements endpoint security by focusing on identity attack paths.", "usedFor": "Continuously monitor identity risk signals and trigger containment for account takeover and token abuse events.", "industryBackground": [ { "name": "NIST SP 800-207 Zero Trust Architecture", "url": "https://doi.org/10.6028/NIST.SP.800-207" } ], "keyPrinciples": [ "Detect anomalous identity behavior and token usage patterns", "Correlate identity events with privilege and resource access signals", "Contain rapidly with scoped credential and session revocation" ], "diagramSuggestion": "Identity signal pipeline from login/token events to detection, triage, and containment actions.", "exampleUseCases": [ "Detect abnormal service principal activity outside normal baseline", "Investigate suspicious access to regulated data domains" ], "gxpRelevance": "Medium-High. Suspicious access to regulated records must be detectable and investigable.", "subcategory": "Identity & Access Management" } ] }, { "id": "integration-connectivity", "title": "Integration & Connectivity", "description": "The mediation and interoperability layer that governs how systems, services, and data sources communicate across organisational and technical boundaries. This category covers API management for exposing and governing service interfaces, AI-specific gateways that broker and enforce policy on model traffic, external data acquisition through search and crawl interfaces, document intelligence for extracting structure from unstructured sources, and connectors that bridge the platform to enterprise systems such as LIMS, eQMS, and ERP.", "concepts": [ { "id": "ai-gateway-llm-control-plane", "title": "AI Gateway for LLMs", "description": "Centralized gateway for model provider abstraction, policy enforcement, response filtering, and cost-aware traffic shaping.", "madCard": null, "technologyPage": "ai-gateway.html", "controls": [ "policy-as-code", "content-safety-filtering", "cost-attribution", "output-validation" ], "vendors": [ { "id": "portkey", "name": "Portkey", "description": "AI gateway with routing, governance policy controls, and model telemetry." }, { "id": "litellm", "name": "LiteLLM", "description": "Model gateway abstraction with fallback routing and provider interoperability." }, { "id": "kong-ai-gateway", "name": "Kong AI Gateway", "description": "API gateway extensions for AI traffic control, governance, and policy enforcement." } ], "industryDefinition": "An AI gateway is the policy enforcement layer between applications and model providers. It centralizes provider abstraction, prompt and response controls, token budget enforcement, routing, and observability. It enables consistent AI governance without embedding controls in every application.", "usedFor": "Route LLM traffic through a governed control plane with quotas, filters, provider abstraction, and audit capture.", "industryBackground": [ { "name": "Azure API Management", "url": "https://learn.microsoft.com/azure/api-management/" }, { "name": "OWASP Top 10 for LLM Applications", "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/" } ], "keyPrinciples": [ "Applications should target gateway endpoints, not provider-specific APIs", "Policy and guardrails should be version-controlled as code", "Token budgets must be enforced to control runaway cost", "Gateway logs are authoritative records for AI request auditing", "Fallback routing should preserve availability under provider outages" ], "diagramSuggestion": "Client-to-gateway-to-multi-provider topology with policy engine, content filters, cost metering, and audit stream.", "exampleUseCases": [ "APIM-based centralized governance for Azure OpenAI traffic", "Per-agent token budget and quota policy", "PII redaction checks before prompt forwarding" ], "gxpRelevance": "High. Gateway-level input/output and model-call logging forms core AI audit evidence in regulated workflows.", "approvedVendors": [ { "id": "azure-api-management", "name": "Azure API Management", "description": "Policy-driven gateway that can govern AI API traffic, quotas, and access control.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=9d3a13fb3b0ad61095e91764c3e45a78&v=" } ] }, { "id": "web-search-crawl-apis", "title": "Web Search & Crawl APIs", "description": "External search and crawl interfaces used for retrieval, enrichment, and grounding workflows.", "madCard": "https://mad.firstmark.com/card#recVqBYIoPnPdYHzD", "technologyPage": null, "controls": [ "approved-knowledge-source", "provenance-capture", "grounding-check" ], "vendors": [ { "id": "bing-search", "name": "Microsoft Bing Web Search", "description": "Search API for web retrieval integrations and contextual grounding." }, { "id": "exa", "name": "Exa", "description": "AI-native web search API optimized for retrieval workflows." }, { "id": "tavily", "name": "Tavily", "description": "Search API purpose-built for LLM agents and contextual retrieval." }, { "id": "firecrawl", "name": "Firecrawl", "description": "Web crawl and extraction tooling for structured ingestion into AI pipelines." } ], "industryDefinition": "Web search and crawl APIs provide access to current external information beyond model pretraining cutoffs. Search returns ranked candidates while crawl/extract retrieves full page content for downstream grounding, indexing, and citation workflows.", "usedFor": "Acquire external knowledge with provenance for retrieval pipelines and grounded response generation.", "industryBackground": [ { "name": "CloudEvents", "url": "https://cloudevents.io/" } ], "keyPrinciples": [ "Use approved-domain allow lists for regulated grounding", "Capture provenance: URL, timestamp, and content hash", "Balance source freshness against source authority", "Respect robots.txt and publisher terms" ], "diagramSuggestion": "Search-to-crawl-to-grounding pipeline with source allow-list and provenance capture checkpoints.", "exampleUseCases": [ "Regulatory monitoring with approved source constraints", "External citation enrichment for agent-generated responses" ], "gxpRelevance": "Low-Medium. External web evidence should be constrained and attributable when used in regulated contexts." }, { "id": "api-management", "title": "API Management", "description": "Centralized governance, security, and lifecycle management for APIs exposing platform capabilities to internal and external consumers.", "madCard": null, "technologyPage": null, "controls": [ "api-specification-required", "audit-access-control", "policy-as-code" ], "vendors": [ { "id": "kong", "name": "Kong Gateway", "description": "Open-source and enterprise API gateway with plugin-based policy and observability controls." }, { "id": "apigee", "name": "Google Apigee", "description": "Full lifecycle API management platform with analytics and developer enablement." }, { "id": "aws-api-gateway", "name": "AWS API Gateway", "description": "Managed API service for REST, HTTP, and WebSocket APIs on AWS infrastructure." } ], "industryDefinition": "API management provides the lifecycle governance layer for service interfaces — from design and publication through versioning, security enforcement, rate limiting, and deprecation. It decouples API consumers from backend implementations and centralizes cross-cutting concerns such as authentication, logging, throttling, and SLA enforcement. Distinct from the AI gateway, which addresses LLM-specific concerns; API management governs all service interfaces.", "usedFor": "Govern, secure, version, and monitor APIs exposed by platform services to internal consumers and external integrations.", "industryBackground": [ { "name": "OpenAPI Specification", "url": "https://spec.openapis.org/oas/latest.html" }, { "name": "Azure API Management Documentation", "url": "https://learn.microsoft.com/azure/api-management/" } ], "keyPrinciples": [ "All public APIs should have OpenAPI specifications version-controlled in source", "Authentication and authorization enforcement belongs at the gateway, not in each service", "Rate limiting and quota enforcement protect backend services from overload", "API versioning policy should be explicit and communicated to consumers", "Gateway logs are the authoritative record for API access auditing" ], "diagramSuggestion": "API gateway topology with developer portal, policy enforcement (auth, rate limit, transform), backend routing, and audit log stream.", "exampleUseCases": [ "Azure APIM governing access to BPT platform service APIs", "Pre-authentication and token validation before requests reach backend services", "Developer portal for internal teams to discover and subscribe to platform APIs" ], "gxpRelevance": "Medium-High. API access logs from a managed gateway provide the access audit trail for regulated service interfaces.", "approvedVendors": [ { "id": "azure-apim", "name": "Azure API Management", "description": "Managed API gateway with policy enforcement, developer portal, and analytics for Azure workloads.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=9d3a13fb3b0ad61095e91764c3e45a78&v=" } ] }, { "id": "document-intelligence", "title": "Document Intelligence & Unstructured Data Processing", "description": "Automated extraction of structured information from unstructured documents including PDFs, scanned forms, Word files, and images.", "madCard": null, "technologyPage": null, "controls": [ "approved-knowledge-source", "provenance-capture", "sensitive-data-redaction" ], "vendors": [ { "id": "llamaparse", "name": "LlamaParse", "description": "Document parsing service optimized for PDF and complex layout extraction for RAG pipelines." }, { "id": "unstructured-io", "name": "Unstructured.io", "description": "Open-source and managed platform for ingesting and normalizing unstructured document content." }, { "id": "aws-textract", "name": "AWS Textract", "description": "Managed OCR and form extraction service for structured data from scanned documents." } ], "industryDefinition": "Document intelligence extracts machine-readable structure from documents that were designed for human reading. It combines OCR (optical character recognition), layout analysis, table extraction, and named entity recognition to produce structured outputs from PDFs, Word files, scanned forms, and images. The outputs feed downstream indexing, RAG pipelines, and knowledge base construction.", "usedFor": "Extract and normalize content from SOPs, batch records, deviation reports, and other unstructured GxP documents for indexing and AI consumption.", "industryBackground": [ { "name": "Azure AI Document Intelligence", "url": "https://learn.microsoft.com/azure/ai-services/document-intelligence/" }, { "name": "Unstructured.io", "url": "https://unstructured.io/" } ], "keyPrinciples": [ "OCR quality directly determines downstream retrieval and extraction accuracy", "Preserve structural metadata (headers, tables, sections) alongside extracted text", "Version-track extracted artifacts alongside source documents", "Apply PII detection to extracted content before indexing", "Evaluate extraction quality on domain-representative document samples" ], "diagramSuggestion": "Document ingestion pipeline from raw PDF/scan through OCR and layout extraction, structural chunking, and vector index population.", "exampleUseCases": [ "SOP and batch record ingestion pipeline for the Document Intelligence Agent", "Deviation report extraction for structured CAPA knowledge base", "PDF instrument manual parsing for equipment knowledge grounding" ], "gxpRelevance": "High. GxP environments are document-heavy; reliable extraction and version-tracked provenance are prerequisites for compliant AI-assisted document reasoning.", "approvedVendors": [ { "id": "azure-document-intelligence", "name": "Azure AI Document Intelligence", "description": "Managed document extraction service supporting OCR, layout analysis, and custom form models.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=232ada772b5f9e5407f6f30dee91bf5b&v=" } ] } ] }, { "id": "data-analytics", "title": "Data & Analytics", "description": "The layer at which raw, governed data is transformed into organisational insight and predictive intelligence. This category covers the governance and cataloguing disciplines that make data trustworthy and discoverable; the business intelligence and semantic modelling tools that translate data into governed metrics and dashboards; and the classical machine learning and MLOps capabilities that produce predictive and statistical models from structured data. It sits above the raw infrastructure of storage and pipelines, and below the generative AI and agent layer.", "concepts": [ { "id": "data-governance-catalog", "title": "Data Governance & Catalog", "description": "Cataloging, stewardship, policy, and lineage governance for governed AI and analytics data assets.", "madCard": "https://mad.firstmark.com/card#reccLdA0kDJN0yCzo", "technologyPage": null, "controls": [ "provenance-capture", "approved-knowledge-source", "telemetry-schema" ], "vendors": [ { "id": "collibra", "name": "Collibra", "description": "Enterprise catalog and governance workflows for ownership, glossary, and policy controls." }, { "id": "alation", "name": "Alation", "description": "Collaborative data catalog with stewardship and policy awareness." }, { "id": "atlan", "name": "Atlan", "description": "Modern data catalog and governance workspace with lineage and glossary." }, { "id": "microsoft-purview", "name": "Microsoft Purview", "description": "Cloud-native governance and cataloging aligned with Microsoft data services." } ], "industryDefinition": "Data governance and cataloging establishes who owns data, what it means, where it came from, and what rules govern its use. The catalog is the operational artifact: a searchable inventory of datasets, fields, pipelines, and business terms. Governance wraps cataloging with policy, access control, retention, and lineage so derived outputs remain auditable.", "usedFor": "Define ownership, glossary terms, policy controls, and lineage evidence for AI and analytics datasets.", "industryBackground": [ { "name": "DAMA-DMBOK2", "url": "https://www.dama.org/cpages/body-of-knowledge" }, { "name": "ISO/IEC 11179 Metadata Registries", "url": "https://www.iso.org/standard/35343.html" }, { "name": "FAIR Principles", "url": "https://www.go-fair.org/fair-principles/" }, { "name": "FDA 21 CFR Part 11", "url": "https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11" } ], "keyPrinciples": [ "Metadata over movement: govern data in place with semantic enrichment", "Active catalogs enforce policy; passive catalogs only index metadata", "Column-level lineage is preferred for regulated and audit-heavy contexts", "Data assets should be treated as products with owners, SLAs, and versions", "Business glossary control prevents semantic drift across systems" ], "diagramSuggestion": "Three-tier architecture with physical data sources, catalog/lineage layer, and governance policy layer; discovery flows up and enforcement flows down.", "exampleUseCases": [ "OntoEurofins terms synchronized into a governed glossary", "eLIMS-BPT and RecordKPR datasets registered with ownership and retention policy", "eQMS audit records linked to instrument-level provenance" ], "gxpRelevance": "High. Catalog lineage and access policy evidence support Part 11 and Annex 11 inspection readiness." }, { "id": "bi-analytics-platforms", "title": "BI & Analytics Platforms", "description": "Reporting and analytical consumption platforms for governed operational and management insights.", "madCard": "https://mad.firstmark.com/card#recCjW5VGRo9kP9rL", "technologyPage": null, "controls": [ "monthly-governance-report", "cost-attribution" ], "vendors": [ { "id": "tableau", "name": "Tableau", "description": "Visual analytics platform for enterprise reporting and insight workflows." }, { "id": "looker", "name": "Google Looker", "description": "Model-driven BI platform with governed semantic metrics." }, { "id": "thoughtspot", "name": "ThoughtSpot", "description": "Search-first analytics for business-friendly data exploration." } ], "industryDefinition": "BI and analytics platforms are the data consumption layer where governed datasets become dashboards, reports, and ad hoc analytical views. Modern platforms rely on semantic models so business metrics are consistently defined across reporting and API consumption channels.", "usedFor": "Publish KPI dashboards, governance reports, and operational analytics from governed semantic models.", "industryBackground": [ { "name": "Semantic Layer Concepts", "url": "https://www.getdbt.com/blog/semantic-layer" } ], "keyPrinciples": [ "Define metric logic in a governed semantic layer", "Apply row-level security at model/data layer", "Distinguish certified datasets from ad hoc exploratory sources", "Align NL query experiences to governed metric definitions" ], "diagramSuggestion": "Gold tables feeding semantic model and multiple consumption channels: dashboards, operational reporting, and ad hoc analysis.", "exampleUseCases": [ "Power BI KPI dashboards for compliance and throughput", "Division-scoped row-level security for controlled report access" ], "gxpRelevance": "Medium. Reports used in regulated decisions require traceable metric definitions and governed data lineage.", "approvedVendors": [ { "id": "power-bi", "name": "Microsoft Power BI", "description": "Enterprise BI platform for governed dashboards and semantic model consumption.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=023ad3fb3b0ad61095e91764c3e45abc&v=" } ] }, { "id": "semantic-layer-metrics-store", "title": "Semantic Layer & Metrics Store", "description": "Centralized business logic layer that translates raw data tables into governed, reusable metric definitions consumed by BI tools, APIs, and AI assistants.", "madCard": null, "technologyPage": null, "controls": [ "monthly-governance-report", "approved-knowledge-source", "telemetry-schema" ], "vendors": [ { "id": "dbt-semantic-layer", "name": "dbt Semantic Layer / MetricFlow", "description": "Metric definition and governance layer integrated with dbt transformation pipelines." }, { "id": "cube-dev", "name": "Cube", "description": "Semantic layer platform with caching, API, and multi-framework consumption support." }, { "id": "atscale", "name": "AtScale", "description": "Universal semantic layer with multi-BI tool connectivity and governed metric definitions." }, { "id": "microsoft-analysis-services", "name": "Microsoft Analysis Services", "description": "Tabular semantic model platform integrated with Power BI and Azure." } ], "industryDefinition": "A semantic layer centralizes business metric definitions — revenue, compliance rate, test throughput — so that every consumer (BI dashboard, API, AI assistant) computes the same value from the same logic. It sits between physical data tables and analytical consumers, encapsulating join logic, filters, aggregation rules, and row-level security. Without a semantic layer, metric definitions drift across tools and AI answers may conflict with official reporting.", "usedFor": "Centralize governed metric definitions to ensure consistent computation across dashboards, APIs, and AI-assisted analytical queries.", "industryBackground": [ { "name": "dbt Semantic Layer", "url": "https://docs.getdbt.com/docs/use-dbt-semantic-layer/dbt-sl" }, { "name": "Headless BI Concepts", "url": "https://www.semanticlayer.io/" } ], "keyPrinciples": [ "Define metrics once and consume from everywhere — no per-tool duplication", "Semantic models encode row-level security as a governance control", "Certified metrics are distinguished from exploratory or draft definitions", "AI natural language query surfaces must target the semantic layer to stay governed", "Version and test metric definitions alongside transformation pipelines" ], "diagramSuggestion": "Semantic layer sitting between Gold tables and multiple consumers: Power BI, REST API, and AI natural language query.", "exampleUseCases": [ "dbt MetricFlow definitions for compliance rate, test throughput, and SLA metrics", "Power BI semantic model with RLS for division-scoped KPI access", "AI assistant grounded in semantic layer for consistent analytical responses" ], "gxpRelevance": "Medium. Governed metric definitions ensure AI-assisted reporting uses the same logic as validated BI outputs, reducing interpretive discrepancy risk." }, { "id": "traditional-ml-statistical-modeling", "title": "Traditional ML & Statistical Modeling", "description": "Classical machine learning and statistical techniques for prediction, classification, anomaly detection, and forecasting on structured tabular and time-series data.", "madCard": null, "technologyPage": null, "controls": [ "model-registry-control", "approval-record-required", "telemetry-schema" ], "vendors": [ { "id": "scikit-learn", "name": "scikit-learn", "description": "Python ML library covering classification, regression, clustering, and feature engineering." }, { "id": "azure-ml", "name": "Azure Machine Learning", "description": "Managed ML platform for training, tracking, deploying, and governing ML models in Azure." }, { "id": "mlflow", "name": "MLflow", "description": "Open-source platform for ML experiment tracking, model registry, and deployment." }, { "id": "h2o-ai", "name": "H2O.ai", "description": "AutoML and model explainability platform for tabular and time-series workloads." } ], "industryDefinition": "Traditional machine learning encompasses supervised, unsupervised, and time-series modeling techniques that operate on structured tabular data without requiring large language models. Regression, classification, clustering, and anomaly detection algorithms are the primary tools. In laboratory environments these techniques are well-suited to numerical data from instruments, processes, and quality metrics where interpretability and auditability are required.", "usedFor": "Build predictive models for OOS detection, instrument drift forecasting, yield prediction, and anomaly identification from structured lab data.", "industryBackground": [ { "name": "scikit-learn Documentation", "url": "https://scikit-learn.org/stable/" }, { "name": "MLflow Documentation", "url": "https://mlflow.org/docs/latest/index.html" }, { "name": "GAMP 5 AI/ML Annex", "url": "https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition" } ], "keyPrinciples": [ "Traditional ML is often the right tool for numerical, tabular lab data", "Model interpretability is a design requirement in regulated decision contexts", "Track all experiments with versioned data, code, and hyperparameters", "Validate model performance on held-out test sets representative of production", "Register and version models before any production deployment" ], "diagramSuggestion": "ML workflow from feature engineering through training, evaluation, registry, deployment, and monitoring.", "exampleUseCases": [ "Out-of-specification prediction model on historical instrument result data", "Instrument drift detection using time-series anomaly detection", "Process yield forecasting from batch parameter inputs" ], "gxpRelevance": "High. ML models used in regulated quality decisions require validation, documented performance evidence, and change-controlled deployment." }, { "id": "feature-store", "title": "Feature Store", "description": "Centralized repository for storing, governing, and serving engineered ML features with consistency guarantees across training and inference.", "madCard": null, "technologyPage": null, "controls": [ "provenance-capture", "model-registry-control", "approved-knowledge-source" ], "vendors": [ { "id": "feast", "name": "Feast", "description": "Open-source feature store for managing and serving features for ML training and inference." }, { "id": "hopsworks", "name": "Hopsworks", "description": "Managed feature store with streaming ingestion, versioning, and training dataset support." }, { "id": "azure-ml-feature-store", "name": "Azure ML Feature Store", "description": "Managed feature store integrated with Azure Machine Learning for governed feature reuse." }, { "id": "databricks-feature-store", "name": "Databricks Feature Store", "description": "Integrated feature management within the Databricks lakehouse platform." } ], "industryDefinition": "A feature store is a centralized system for defining, storing, and serving ML features — the engineered inputs to models. It solves training-serving skew (where features computed at training time differ from those computed at inference) and enables feature reuse across multiple models and teams. Point-in-time correct retrieval ensures historical training datasets reflect only information available at the time of each event.", "usedFor": "Provide consistent, reusable, and point-in-time correct feature definitions for ML model training and real-time inference.", "industryBackground": [ { "name": "Feast Documentation", "url": "https://docs.feast.dev/" }, { "name": "Feature Store Overview", "url": "https://www.hopsworks.ai/post/mlops-concepts-feature-store" } ], "keyPrinciples": [ "Eliminate training-serving skew through shared feature definitions", "Point-in-time correctness is required for temporal ML problems", "Feature reuse reduces duplication and ensures model consistency", "Version features alongside model versions for reproducibility", "Separate online (low-latency) and offline (batch) serving stores" ], "diagramSuggestion": "Feature store architecture showing offline batch ingestion, online serving layer, and shared feature access for training and inference.", "exampleUseCases": [ "Shared instrument performance features reused across OOS and drift models", "Point-in-time batch record features for training on historical quality events" ], "gxpRelevance": "Medium. Feature versioning and point-in-time correctness support reproducibility requirements for validated ML models." }, { "id": "mlops-llmops", "title": "MLOps & LLMOps", "description": "Operational practices and tooling for reliably building, deploying, monitoring, and maintaining ML and LLM systems in production.", "madCard": null, "technologyPage": null, "controls": [ "model-registry-control", "approval-record-required", "release-gate-control", "alert-rule-control" ], "vendors": [ { "id": "mlflow", "name": "MLflow", "description": "Open-source experiment tracking, model registry, and deployment platform." }, { "id": "weights-biases", "name": "Weights & Biases", "description": "ML experiment tracking and model management platform with collaboration features." }, { "id": "azure-ml-pipelines", "name": "Azure ML Pipelines", "description": "Managed pipeline execution and model lifecycle management in Azure Machine Learning." }, { "id": "dvc", "name": "DVC", "description": "Open-source data and model versioning tool integrating with Git for reproducible ML." } ], "industryDefinition": "MLOps extends DevOps principles to machine learning, covering experiment tracking, data versioning, model registry, automated retraining, deployment pipelines, and drift monitoring. LLMOps extends this to large language model operations, adding prompt versioning, evaluation pipelines, token cost tracking, and behavioral monitoring. Together they close the gap between model development and reliable production operation.", "usedFor": "Automate and govern the ML and LLM lifecycle from experiment through deployment, monitoring, and controlled update.", "industryBackground": [ { "name": "MLflow Documentation", "url": "https://mlflow.org/" }, { "name": "Google MLOps Whitepaper", "url": "https://cloud.google.com/resources/mlops-whitepaper" } ], "keyPrinciples": [ "Track every experiment with versioned data, code, parameters, and metrics", "Register and gate every model before production deployment", "Automate retraining pipelines triggered by drift or scheduled cadence", "Apply CI/CD practices to prompt and model changes", "Monitor production behavior continuously for drift and degradation" ], "diagramSuggestion": "MLOps lifecycle from experiment and registry through CI/CD deployment pipeline to production monitoring and retraining trigger.", "exampleUseCases": [ "MLflow experiment registry for all BPT model and prompt evaluations", "Automated retraining pipeline triggered by quality drift signal", "Unified model and prompt versioning and release governance" ], "gxpRelevance": "High. Validated ML systems require documented, reproducible training, change-controlled release, and ongoing performance evidence." } ] }, { "id": "artificial-intelligence-agents", "title": "Artificial Intelligence & Agents", "description": "The applied intelligence layer where language models, reasoning systems, and autonomous agents are designed, deployed, evaluated, and governed. This category covers the foundational concepts of modern AI — large language models, embedding models, and the retrieval augmented generation pattern that grounds AI responses in enterprise knowledge — as well as the agent frameworks that enable multi-step autonomous execution, the safety and observability tools that make AI behaviour auditable, and the governance structures that ensure AI operates within defined policy and risk boundaries. In a GxP-regulated environment, every concept in this category carries a validation and oversight obligation.", "concepts": [ { "id": "agent-platforms", "title": "Agent Platforms", "description": "Frameworks and orchestration platforms for multi-step autonomous and semi-autonomous AI agent execution.", "madCard": "https://mad.firstmark.com/card#recoHDvnP88xqCeBm", "technologyPage": "agent-orchestration.html", "controls": [ "agent-registration", "tool-allow-list", "autonomy-level-control", "traceable-execution-plan" ], "vendors": [ { "id": "langgraph", "name": "LangGraph", "description": "Stateful agent workflow orchestration built on LangChain primitives." }, { "id": "microsoft-autogen", "name": "Microsoft AutoGen", "description": "Multi-agent conversation and orchestration framework for enterprise automation." }, { "id": "crewai", "name": "CrewAI", "description": "Role-based multi-agent coordination framework for task decomposition." }, { "id": "vertex-agent-builder", "name": "Vertex AI Agent Builder", "description": "Managed Google Cloud capability for building and deploying enterprise agents." } ], "industryDefinition": "Agent platforms provide runtime scaffolding for multi-step AI execution loops: reason, act, observe, and update context. They combine tool invocation, state handling, memory management, and guardrails to orchestrate bounded autonomy.", "usedFor": "Build multi-step agents that plan actions, call tools, and coordinate execution state.", "industryBackground": [ { "name": "LangGraph", "url": "https://www.langchain.com/langgraph" }, { "name": "Semantic Kernel", "url": "https://learn.microsoft.com/semantic-kernel/" } ], "keyPrinciples": [ "Bounded autonomy is preferred for high-consequence workflows", "Treat tools as explicit and auditable capability boundaries", "Capture traceable execution plans for each agent run", "Insert human checkpoints before consequential actions" ], "diagramSuggestion": "Agent loop showing reason, tool dispatch, result observation, optional human checkpoint, and completion logging.", "exampleUseCases": [ "Document intelligence and rule agents built on Semantic Kernel", "HITL-managed task escalation in multi-step workflows" ], "gxpRelevance": "High. Agent decisions and actions must remain reproducible, reviewable, and attributable." }, { "id": "agent-infra-tooling", "title": "Agent Infra / Tooling", "description": "Tool interfaces, protocol adapters, memory, and runtime utilities used by agent platforms.", "madCard": "https://mad.firstmark.com/card#recZhGLAJWfPmdizc", "technologyPage": null, "controls": [ "tool-manifest-control", "api-specification-required", "runtime-runbook", "traceable-execution-plan" ], "vendors": [ { "id": "model-context-protocol", "name": "Model Context Protocol", "description": "Open protocol for exposing tools and context to model runtimes and agents." }, { "id": "semantic-kernel", "name": "Semantic Kernel", "description": "SDK for structured tool/function orchestration with policy-ready abstractions." }, { "id": "fastmcp", "name": "FastMCP", "description": "Developer tooling for rapid MCP server and tool interface construction." }, { "id": "composio", "name": "Composio", "description": "Connector platform for integrating agent tool actions across SaaS systems." } ], "industryDefinition": "Agent infrastructure/tooling is the plumbing layer beneath agent frameworks, including tool protocols, context exchange, memory backends, and runtime utilities. MCP and structured tool contracts improve portability and governance across model runtimes.", "usedFor": "Expose governed tool APIs, context channels, and runtime controls used by agent frameworks.", "industryBackground": [ { "name": "Model Context Protocol", "url": "https://modelcontextprotocol.io/" } ], "keyPrinciples": [ "Use explicit tool manifests and versioned contracts", "Prefer schema-based structured outputs over free text parsing", "Manage context-window pressure with summarization/offload patterns", "Keep tool exposure bounded and auditable" ], "diagramSuggestion": "MCP client/server architecture with manifest exchange and multiple tool servers.", "exampleUseCases": [ "MCP server wrappers for data query, file access, and API actions", "Semantic Kernel plugin governance for approved tool surfaces" ], "gxpRelevance": "High. Tool manifests and capabilities are controlled system behavior in validated environments." }, { "id": "ai-observability-evaluation", "title": "AI Observability & Evaluation", "description": "Evaluation, tracing, and behavioral quality monitoring for models and agent workflows.", "madCard": "https://mad.firstmark.com/card#reckqeFOquPH2Q8Sg", "technologyPage": "ai-observability-metering.html", "controls": [ "centralized-telemetry", "telemetry-schema", "alert-rule-control" ], "vendors": [ { "id": "langfuse", "name": "Langfuse", "description": "Open-source LLM observability for traces, prompts, and evaluation analytics." }, { "id": "langsmith", "name": "LangSmith", "description": "Evaluation and observability tooling for LLM applications and chains." }, { "id": "arize-ai", "name": "Arize AI", "description": "Model and LLM observability platform for quality and drift monitoring." }, { "id": "braintrust", "name": "Braintrust", "description": "AI evaluation platform for prompt, model, and workflow quality gates." } ], "industryDefinition": "AI observability and evaluation measures runtime behavior and output quality using AI-specific telemetry and benchmarked test sets. It combines continuous production monitoring with periodic evaluation gates for release confidence and drift detection.", "usedFor": "Assess prompt/model quality, trace agent calls, and detect behavioral drift or regressions.", "industryBackground": [ { "name": "OpenTelemetry", "url": "https://opentelemetry.io/" }, { "name": "RAGAS", "url": "https://docs.ragas.io/" } ], "keyPrinciples": [ "Log prompt/response/model/latency/token fields for every call", "Use metric taxonomy: faithfulness, relevance, groundedness, safety", "Evaluate updates against golden sets before release", "Combine automated scoring with sampled human review" ], "diagramSuggestion": "Dual-track model with production telemetry monitoring and offline evaluation gate before release.", "exampleUseCases": [ "Langfuse traces for agent interactions", "Golden test sets for release gating of agent prompt/model updates" ], "gxpRelevance": "High. Ongoing qualification evidence is required for regulated AI-assisted operations." }, { "id": "ai-safety-security", "title": "AI Safety & Security", "description": "Prompt defense, guardrails, model risk controls, and policy enforcement around AI interactions.", "madCard": "https://mad.firstmark.com/card#recS11eK5hNpZF6E6", "technologyPage": "ai-gateway.html", "controls": [ "content-safety-filtering", "prompt-injection-defense", "output-validation" ], "vendors": [ { "id": "guardrails-ai", "name": "Guardrails AI", "description": "Guardrail framework for validating prompts and model outputs." }, { "id": "lakera", "name": "Lakera", "description": "Prompt attack detection and AI firewall-style protections." }, { "id": "nemo-guardrails", "name": "NVIDIA NeMo Guardrails", "description": "Runtime policy guardrails for conversational and agentic AI systems." }, { "id": "prompt-security", "name": "Prompt Security", "description": "Threat protection and governance controls for enterprise LLM usage." } ], "industryDefinition": "AI safety and security mitigates LLM-specific threats such as prompt injection, jailbreaks, unsafe output generation, and sensitive data leakage. Runtime guardrails should validate both inputs and outputs as independent enforcement points.", "usedFor": "Filter unsafe prompts/outputs, enforce policy checks, and reduce prompt injection or data exfiltration risk.", "industryBackground": [ { "name": "OWASP Top 10 for LLM Applications", "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/" } ], "keyPrinciples": [ "Apply both input and output guardrails", "Treat retrieved/tool content as injection-capable input", "Detect and redact sensitive data before response release", "Red-team systems before production cutover" ], "diagramSuggestion": "Request lifecycle with pre-model and post-model guard stages plus rejection and audit branches.", "exampleUseCases": [ "PII scanning on generated responses", "Prompt injection detection for retrieved context and tool output" ], "gxpRelevance": "High. Runtime safety controls are required when outputs influence regulated decisions." }, { "id": "routing-prompt-experimentation", "title": "Routing, Prompt Management & Experimentation", "description": "Model routing, prompt versioning, A/B decisions, and runtime optimization for quality and cost.", "madCard": "https://mad.firstmark.com/card#recQd6hGDWnh9DOT1", "technologyPage": "ai-gateway.html", "controls": [ "policy-as-code", "cost-attribution", "model-registry-control" ], "vendors": [ { "id": "openrouter", "name": "OpenRouter", "description": "Multi-model routing service for workload-based model selection." }, { "id": "portkey", "name": "Portkey", "description": "AI gateway and model routing with policy and observability controls." }, { "id": "litellm", "name": "LiteLLM", "description": "Unified model gateway abstraction with routing and fallback controls." }, { "id": "tensorzero", "name": "TensorZero", "description": "Routing and prompt optimization platform focused on performance and evaluation." } ], "industryDefinition": "Routing and prompt experimentation governs how requests are assigned to models and how prompt versions are tested, deployed, and rolled back. It optimizes for quality, latency, and cost using controlled experimentation.", "usedFor": "Route requests by policy and scenario, test prompt variants, and optimize cost/quality/latency tradeoffs.", "industryBackground": [ { "name": "A/B Testing Fundamentals", "url": "https://www.optimizely.com/optimization-glossary/ab-testing/" } ], "keyPrinciples": [ "Treat prompts as versioned software artifacts", "Route by task class to the least-cost model meeting quality thresholds", "Use canary rollout before full prompt/model promotion", "Maintain control group baselines for meaningful experiments" ], "diagramSuggestion": "Routing policy engine selecting models by task with prompt version canary and evaluation feedback loop.", "exampleUseCases": [ "Cost-aware model routing for summarization vs reasoning tasks", "Prompt canary rollout for selected traffic slices" ], "gxpRelevance": "Medium-High. Prompt changes affecting regulated outcomes require traceable change control." }, { "id": "ai-agent-governance", "title": "AI & Agent Governance", "description": "Governance systems for policy, risk, assurance, and lifecycle control of AI and agents.", "madCard": "https://mad.firstmark.com/card#reco4l6Qy3oNvVO8X", "technologyPage": "ai-gateway.html", "controls": [ "policy-as-code", "approval-record-required", "release-gate-control" ], "vendors": [ { "id": "validmind", "name": "ValidMind", "description": "Model risk and validation governance workflows for regulated environments." }, { "id": "credo-ai", "name": "Credo AI", "description": "AI governance platform for policy, risk, and compliance tracking." }, { "id": "ibm-watsonx-governance", "name": "IBM watsonx.governance", "description": "Enterprise governance controls for model lifecycle and risk management." }, { "id": "holistic-ai", "name": "Holistic AI", "description": "AI governance and assurance platform for risk and compliance operations." } ], "industryDefinition": "AI and agent governance defines risk controls, approval gates, accountability, and lifecycle oversight for AI systems. It aligns model and agent operations to policy, validation evidence, and continuous monitoring expectations.", "usedFor": "Control release approvals, policy conformance, and lifecycle assurance for agent and model deployments.", "industryBackground": [ { "name": "EU AI Act", "url": "https://artificialintelligenceact.eu/" }, { "name": "GAMP 5", "url": "https://ispe.org/publications/guidance-documents/gamp-5-guide-2nd-edition" } ], "keyPrinciples": [ "Apply risk-tiered governance by consequence class", "Use model/agent cards as governance artifacts", "Require human oversight at high-consequence boundaries", "Treat drift monitoring as ongoing qualification evidence" ], "diagramSuggestion": "Lifecycle flow from intake and risk assessment through validation, release gate, monitoring, and requalification/retirement.", "exampleUseCases": [ "Governance intake registry for new AI opportunities", "Model and agent cards documenting scope, limits, and controls" ], "gxpRelevance": "High. This maps directly to validation and controlled-release expectations in regulated systems." }, { "id": "foundation-models-llms", "title": "Foundation Models / Large Language Models", "description": "Pre-trained large-scale language models that serve as the generative reasoning core for AI applications, agents, and natural language interfaces.", "madCard": null, "technologyPage": null, "controls": [ "model-registry-control", "cost-attribution", "output-validation", "content-safety-filtering" ], "vendors": [ { "id": "anthropic-claude", "name": "Anthropic Claude", "description": "Safety-focused large language model family with strong reasoning and long-context capabilities." }, { "id": "meta-llama", "name": "Meta Llama", "description": "Open-weight language model family enabling on-premises and sovereign deployment options." }, { "id": "microsoft-phi", "name": "Microsoft Phi", "description": "Small language model family optimized for reasoning tasks at lower cost and latency." } ], "industryDefinition": "Foundation models are large neural networks pre-trained on broad data that serve as a general-purpose base for downstream tasks. Large language models (LLMs) are the language-specialised variant, capable of text generation, reasoning, summarization, classification, tool use, and instruction following. In enterprise AI, LLM selection involves trade-offs across capability, context window, cost, latency, data sovereignty, and fine-tuning options. The model is always paired with governance — what it can see, what it can do, and what audit trail it produces.", "usedFor": "Provide the generative reasoning core for agents, assistants, document intelligence, and natural language platform interfaces.", "industryBackground": [ { "name": "Azure OpenAI Service", "url": "https://learn.microsoft.com/azure/ai-services/openai/" }, { "name": "Anthropic Model Documentation", "url": "https://docs.anthropic.com/" }, { "name": "EU AI Act High-Risk AI Systems", "url": "https://artificialintelligenceact.eu/the-act/" } ], "keyPrinciples": [ "Model selection should be driven by task profile, sovereignty, and cost", "Context window size determines how much retrieved knowledge fits per call", "Frontier models and open-weight models serve different sovereignty trade-offs", "Model versions must be pinned and change-controlled in production", "Every model call in a regulated workflow requires logged input, output, and version" ], "diagramSuggestion": "Model selection decision tree by task type, sovereignty requirement, and cost tier, with gateway routing to appropriate provider.", "exampleUseCases": [ "Azure OpenAI GPT-4o as the primary model for BPT Phase 1 agents", "Phi-4 as a cost-efficient routing target for classification and summarization tasks", "Llama-3 on AKS for sovereign deployment of sensitive lab data workloads" ], "gxpRelevance": "High. Every LLM used in a regulated decision pathway requires a documented model card, versioned deployment, and gateway-level audit logging.", "approvedVendors": [ { "id": "azure-openai", "name": "Azure OpenAI", "description": "Microsoft-managed access to OpenAI GPT-4o and o-series models with enterprise compliance controls.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=4713056cfb965e5cec84f464aeefdcda&v=" } ] }, { "id": "embedding-models", "title": "Embedding Models", "description": "Models that convert text, documents, and structured data into dense vector representations capturing semantic meaning for retrieval and similarity tasks.", "madCard": null, "technologyPage": null, "controls": [ "model-registry-control", "approved-knowledge-source", "provenance-capture" ], "vendors": [ { "id": "azure-openai-embeddings", "name": "Azure OpenAI Embeddings", "description": "text-embedding-3-large and text-embedding-3-small models via the Azure OpenAI service." }, { "id": "cohere-embed", "name": "Cohere Embed", "description": "Embedding models optimized for retrieval with multilingual and domain adaptation support." }, { "id": "bge-models", "name": "BGE (BAAI General Embeddings)", "description": "Open-weight embedding models from BAAI suitable for on-premises and sovereign deployment." }, { "id": "sentence-transformers", "name": "Sentence Transformers", "description": "Open-source library for running and fine-tuning embedding models locally." } ], "industryDefinition": "Embedding models encode text or other content as dense numeric vectors in a high-dimensional space where semantic similarity corresponds to vector proximity. They are a distinct concept from LLMs — while LLMs generate text, embedding models produce representations used for retrieval, similarity search, and clustering. The choice of embedding model determines the semantic space in which all downstream vector search operates; the model and index are coupled and must be versioned together.", "usedFor": "Convert documents, queries, and records into embeddings for vector database indexing and semantic retrieval.", "industryBackground": [ { "name": "Azure OpenAI Embeddings", "url": "https://learn.microsoft.com/azure/ai-services/openai/concepts/understand-embeddings" }, { "name": "MTEB Benchmark", "url": "https://huggingface.co/spaces/mteb/leaderboard" } ], "keyPrinciples": [ "Embedding model and vector index are a coupled pair — version them together", "Domain fine-tuning improves retrieval quality for specialist vocabularies", "Dimensionality, context window, and throughput vary significantly across models", "Re-embedding all documents is required when switching models", "Evaluate embedding model quality on domain-representative queries before adoption" ], "diagramSuggestion": "Embedding pipeline from document chunking through model encoding to vector index population, with model version annotation.", "exampleUseCases": [ "text-embedding-3-large for SOP and batch record indexing in Azure AI Search", "BGE model for sovereign on-premises embedding of sensitive data", "Domain-fine-tuned embedding model for laboratory terminology retrieval precision" ], "gxpRelevance": "High. The embedding model version must be documented and controlled, as model changes invalidate existing indexes and affect retrieval behavior in regulated workflows." }, { "id": "retrieval-augmented-generation", "title": "Retrieval Augmented Generation (RAG)", "description": "Architectural pattern that grounds generative AI responses in retrieved enterprise knowledge by combining semantic search with language model generation.", "madCard": null, "technologyPage": null, "controls": [ "approved-knowledge-source", "grounding-check", "provenance-capture", "output-validation" ], "vendors": [ { "id": "azure-ai-search", "name": "Azure AI Search", "description": "Managed retrieval service with hybrid vector and keyword search for RAG grounding." }, { "id": "llamaindex", "name": "LlamaIndex", "description": "RAG framework for indexing, retrieval, and context assembly over enterprise knowledge sources." }, { "id": "langchain", "name": "LangChain", "description": "Framework with retrieval chain primitives for building RAG-based applications." }, { "id": "ragas", "name": "RAGAS", "description": "Evaluation framework for measuring faithfulness, relevance, and groundedness of RAG outputs." } ], "industryDefinition": "Retrieval Augmented Generation (RAG) is the dominant enterprise AI architecture pattern. Rather than relying solely on parametric knowledge baked into model weights, RAG retrieves relevant context from a governed knowledge base at query time and includes it in the prompt. This grounds model responses in current, approved, and attributable information — critical in regulated environments where hallucination on regulatory content is unacceptable. RAG is not a product; it is an architecture comprising retrieval, context assembly, prompt construction, generation, and citation.", "usedFor": "Ground AI responses in approved, current enterprise knowledge rather than model parametric memory alone.", "industryBackground": [ { "name": "RAG Original Paper (Lewis et al.)", "url": "https://arxiv.org/abs/2005.11401" }, { "name": "RAGAS Evaluation Framework", "url": "https://docs.ragas.io/" }, { "name": "Azure AI Search RAG Pattern", "url": "https://learn.microsoft.com/azure/search/retrieval-augmented-generation-overview" } ], "keyPrinciples": [ "Retrieval quality is the primary determinant of RAG answer quality", "Hybrid search (vector + keyword) consistently outperforms vector alone", "Metadata filters enforce approved-source governance at retrieval time", "Two-stage retrieval with re-ranking improves precision on complex queries", "Every response should cite retrieved sources for traceability" ], "diagramSuggestion": "RAG pipeline: query embed → hybrid retrieval with metadata filter → optional re-rank → prompt assembly with citations → LLM generation → grounded response.", "exampleUseCases": [ "Document Intelligence Agent using RAG over approved SOP knowledge base", "Regulatory query assistant grounded in approved guidance documents only", "CAPA recommendation system retrieving relevant precedent deviation records" ], "gxpRelevance": "High. RAG with governed knowledge sources is the primary mechanism for making AI responses attributable, inspectable, and constrained to approved content in regulated workflows." }, { "id": "fine-tuning-model-adaptation", "title": "Fine-Tuning & Model Adaptation", "description": "Techniques for adapting pre-trained foundation models to domain-specific tasks, vocabularies, and behaviors through continued training on targeted datasets.", "madCard": null, "technologyPage": null, "controls": [ "model-registry-control", "approval-record-required", "provenance-capture" ], "vendors": [ { "id": "azure-openai-fine-tuning", "name": "Azure OpenAI Fine-Tuning", "description": "Managed fine-tuning service for GPT models on custom datasets within the Azure platform." }, { "id": "huggingface", "name": "Hugging Face", "description": "Platform and library ecosystem for model hosting, fine-tuning, and open-weight model access." }, { "id": "axolotl", "name": "Axolotl", "description": "Open-source fine-tuning framework supporting LoRA, QLoRA, and instruction tuning workflows." }, { "id": "unsloth", "name": "Unsloth", "description": "Efficient fine-tuning library optimizing memory and speed for LoRA-based model adaptation." } ], "industryDefinition": "Fine-tuning adapts a pre-trained foundation model to a target domain or task by continuing its training on curated domain-specific data. Parameter-efficient techniques such as LoRA and QLoRA reduce the compute and memory cost by training only a small fraction of parameters. Fine-tuning improves performance on specialized vocabularies, task formats, and domain reasoning patterns that prompt engineering alone cannot fully address.", "usedFor": "Adapt foundation models to laboratory, regulatory, and scientific terminology and reasoning patterns for improved task performance.", "industryBackground": [ { "name": "LoRA: Low-Rank Adaptation of Large Language Models", "url": "https://arxiv.org/abs/2106.09685" }, { "name": "Azure OpenAI Fine-Tuning", "url": "https://learn.microsoft.com/azure/ai-services/openai/how-to/fine-tuning" } ], "keyPrinciples": [ "Fine-tune only when prompt engineering and RAG are insufficient", "Training data quality matters more than quantity", "Use parameter-efficient methods (LoRA/QLoRA) to reduce cost", "Version and register fine-tuned models with their training data provenance", "Evaluate fine-tuned model on held-out domain benchmarks before deployment" ], "diagramSuggestion": "Fine-tuning workflow from curated domain dataset through LoRA adapter training, evaluation, registry, and deployment.", "exampleUseCases": [ "Fine-tuning for Allotrope/AFO terminology recognition in lab document extraction", "Instruction-tuned adapter for eQMS procedure classification tasks", "Domain-adapted embedding model for improved laboratory term retrieval" ], "gxpRelevance": "High. Fine-tuned models require documented training data provenance, validation evidence, and change-controlled deployment in regulated contexts." }, { "id": "multimodal-ai", "title": "Multimodal AI", "description": "AI systems that process and reason across multiple data modalities including text, images, tables, documents, and structured data in a single inference context.", "madCard": null, "technologyPage": null, "controls": [ "content-safety-filtering", "approved-knowledge-source", "output-validation" ], "vendors": [ { "id": "azure-openai-gpt4o", "name": "Azure OpenAI GPT-4o", "description": "Multimodal frontier model supporting text, image, and document input via the Azure OpenAI service." }, { "id": "anthropic-claude-vision", "name": "Anthropic Claude", "description": "Multimodal model supporting image, document, and text reasoning with strong analytical capabilities." }, { "id": "google-gemini", "name": "Google Gemini", "description": "Multimodal model with native audio, video, image, and text processing capabilities." }, { "id": "llamaparse", "name": "LlamaParse", "description": "Document-to-structured-text extraction optimized for complex PDF layouts and embedded tables." } ], "industryDefinition": "Multimodal AI systems accept and reason over multiple input types — text, images, structured tables, PDFs, and audio — within a single model call. In laboratory environments this enables AI to interpret chromatography charts, read instrument images, extract data from scanned forms, and reason over complex PDF SOPs alongside natural language queries. Multimodal capability reduces the need for separate OCR and extraction preprocessing for many document types.", "usedFor": "Interpret instrument images, analyse chromatography outputs, and reason over mixed document types containing text, tables, and visual data.", "industryBackground": [ { "name": "GPT-4o System Card", "url": "https://openai.com/research/gpt-4o-system-card" }, { "name": "Anthropic Claude Vision", "url": "https://docs.anthropic.com/claude/docs/vision" } ], "keyPrinciples": [ "Multimodal input removes many preprocessing steps for document-heavy workflows", "Image and table interpretation quality varies significantly across model families", "Validate multimodal outputs on domain-representative samples before production use", "Apply content safety filtering to image inputs as well as text", "Track modality type in audit logs alongside prompt and response" ], "diagramSuggestion": "Multimodal inference pipeline accepting PDF, image, and table inputs alongside text queries into a unified model context.", "exampleUseCases": [ "GPT-4o reading chromatography output images for peak identification", "Document Intelligence Agent processing mixed PDF SOPs with embedded tables", "Instrument calibration certificate interpretation from scanned image input" ], "gxpRelevance": "High. Multimodal AI outputs used in regulated decisions require the same audit logging, source attribution, and validation as text-only AI outputs." }, { "id": "ai-assisted-development", "title": "AI-Assisted Development", "description": "AI tooling integrated into the software development lifecycle for code generation, test authoring, documentation, and automated code review.", "madCard": null, "technologyPage": null, "controls": [ "runtime-runbook", "api-specification-required", "approval-record-required" ], "vendors": [ { "id": "claude-code", "name": "Claude Code", "description": "Agentic coding tool from Anthropic for autonomous and assisted software development tasks." }, { "id": "cursor", "name": "Cursor", "description": "AI-native IDE with codebase-aware chat, edit, and agent modes for software development." }, { "id": "amazon-q-developer", "name": "Amazon Q Developer", "description": "AI developer assistant integrated with AWS toolchain for code, security, and infrastructure tasks." } ], "industryDefinition": "AI-assisted development integrates language model capabilities directly into the software development workflow. Use cases span code completion, code generation from natural language, test case authoring, documentation generation, code review, refactoring, and agentic autonomous coding. In enterprise environments it accelerates delivery of platform components while requiring governance over AI-generated code quality and review requirements.", "usedFor": "Accelerate BPT platform development through AI-assisted coding, test generation, and documentation authoring.", "industryBackground": [ { "name": "Claude Code Documentation", "url": "https://docs.anthropic.com/claude/docs/claude-code" }, { "name": "GitHub Copilot Documentation", "url": "https://docs.github.com/copilot" } ], "keyPrinciples": [ "AI-generated code requires the same review standards as human-authored code", "Treat AI coding tools as accelerators for engineers, not replacements", "MCP server integrations extend coding agents to repository and pipeline tooling", "Audit AI tool usage in regulated codebases for traceability", "Define policy on which AI tools are approved for use in validated system development" ], "diagramSuggestion": "Developer workflow with AI coding assistant integrated into IDE, PR review, and CI/CD pipeline stages.", "exampleUseCases": [ "Claude Code in VS Code with Azure DevOps integration for BPT development", "AI-assisted test generation for Semantic Kernel agent plugins", "MCP server for repository and pipeline context in agentic development flows" ], "gxpRelevance": "Medium. AI-generated code used in validated GxP systems must be reviewed, tested, and change-controlled to the same standard as manually authored code.", "approvedVendors": [ { "id": "github-copilot", "name": "GitHub Copilot", "description": "AI pair programmer integrated with VS Code and GitHub for code completion and generation.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=256ad37f3b0ad61095e91764c3e45ab3&v=" }, { "id": "microsoft-copilot", "name": "Microsoft Copilot (M365 Copilot Chat)", "description": "Enterprise AI assistant for Microsoft 365 workflows and conversational productivity.", "approvalUrl": "https://eurofins.service-now.com/sp?id=form&table=u_it_tech_portfolio&filter=&sys_id=796a177f3b0ad61095e91764c3e45a74&v=" } ] } ] } ], "layerMappings": { "edge-transport-security": [ "network-segmentation-zero-trust", "secure-connectivity-encryption", "service-mesh-l7-policies", "ai-gateway-llm-control-plane" ], "ai-runtime-execution": [ "agent-platforms", "agent-infra-tooling", "model-serving-inference-runtimes", "routing-prompt-experimentation", "ai-observability-evaluation", "ai-agent-governance", "service-mesh-l7-policies", "workload-machine-identity" ], "ai-gateway-control-plane": [ "routing-prompt-experimentation", "ai-safety-security", "ai-agent-governance", "agent-infra-tooling", "ai-gateway-llm-control-plane", "federation-token-services", "authorization-entitlement-policy" ], "api-gateway-enforcement": [ "routing-prompt-experimentation", "ai-safety-security", "web-search-crawl-apis", "event-brokers-messaging", "service-mesh-l7-policies", "ai-gateway-llm-control-plane", "federation-token-services", "authorization-entitlement-policy" ], "prompt-data-output-governance": [ "data-governance-catalog", "privacy-security", "ai-safety-security", "vector-databases", "graph-databases", "web-search-crawl-apis" ], "resource-knowledge-backend-systems": [ "storage", "event-brokers-messaging", "vector-databases", "graph-databases", "web-search-crawl-apis", "compute" ], "observability-finops-audit-compliance": [ "cloud-observability", "ai-observability-evaluation", "bi-analytics-platforms", "ai-agent-governance", "identity-threat-detection-response", "identity-governance-administration" ], "policy-control-plane": [ "data-governance-catalog", "privacy-security", "ai-agent-governance", "agent-infra-tooling", "network-segmentation-zero-trust", "secure-connectivity-encryption", "ai-gateway-llm-control-plane", "workforce-identity-sso", "ciam-external-identity", "authentication-assurance-mfa", "federation-token-services", "authorization-entitlement-policy", "privileged-access-management", "workload-machine-identity", "identity-governance-administration", "identity-threat-detection-response" ] }, "definitionSources": [ { "name": "NIST SP 800-145 Cloud Computing Definition", "url": "https://csrc.nist.gov/publications/detail/sp/800-145/final" }, { "name": "Wikipedia Technology Domain Definitions", "url": "https://en.wikipedia.org/wiki/Category:Computer_science" }, { "name": "NIST SP 800-63-4 Digital Identity Guidelines", "url": "https://doi.org/10.6028/NIST.SP.800-63-4" }, { "name": "OAuth 2.0 Authorization Framework", "url": "https://www.rfc-editor.org/rfc/rfc6749" }, { "name": "OpenID Connect Core", "url": "https://openid.net/specs/openid-connect-core-1_0.html" }, { "name": "SPIFFE Overview", "url": "https://spiffe.io/docs/latest/spiffe-about/overview/" } ] }