1007 lines
58 KiB
TeX
1007 lines
58 KiB
TeX
% !TEX encoding = UTF-8 Unicode
|
|
% ============================================================================
|
|
% AISE502 -- AI in Software Engineering II
|
|
% Lecture 13 slides, typeset with the official FHGR beamer theme
|
|
% (beamerthemeFHGR.sty, University of Applied Sciences of the Grisons).
|
|
% Slide content is unchanged; only the presentation layer is the FHGR template.
|
|
% ============================================================================
|
|
\documentclass[aspectratio=169]{beamer}
|
|
|
|
\usetheme[showsection, titlebg=pics/theme_pics/titlepage.png]{FHGR}
|
|
|
|
% ============================================
|
|
% PACKAGES
|
|
% The theme already loads tikz, graphicx, xcolor, tabularx, colortbl,
|
|
% listings, hyperref, environ and xparse -- only the extras are needed here.
|
|
% ============================================
|
|
\usepackage[british]{babel}
|
|
\usepackage{booktabs}
|
|
\usepackage{amsmath}
|
|
\usepackage{amssymb}
|
|
\usepackage{tcolorbox}
|
|
\usetikzlibrary{shapes.geometric, arrows.meta, positioning, fit, backgrounds, calc}
|
|
|
|
% ============================================
|
|
% SEMANTIC COLOURS, MAPPED ONTO THE FHGR PALETTE
|
|
% The names used throughout the slides are kept, so no slide text changes;
|
|
% they now resolve to the FHGR brand colours defined by the theme.
|
|
% ============================================
|
|
\colorlet{bankblue}{blue} % FHGR blue (4B92A4)
|
|
\colorlet{bankgreen}{green} % FHGR green (817E65)
|
|
\colorlet{bankred}{red} % FHGR red (C60219)
|
|
\colorlet{codegray}{gray} % FHGR gray (595959)
|
|
\colorlet{backcolour}{linen} % FHGR linen (E1D3B5)
|
|
\definecolor{aiviolet}{HTML}{6B4E71} % muted plum, kept distinct for the AI lens
|
|
|
|
% Attribution labels in English (theme default is German)
|
|
\renewcommand{\source}[1]{\par\hfill {\tiny\color{FHGRDeco} Source:\,\itshape #1}}
|
|
\renewcommand{\imagesource}[1]{\par\hfill {\tiny\color{FHGRDeco} Image source:\,\itshape #1}}
|
|
|
|
% ============================================
|
|
% CUSTOM TCOLORBOXES (same semantics as the script, FHGR colours)
|
|
% ============================================
|
|
\newtcolorbox{keypoint}{
|
|
colback=bankblue!7!white,
|
|
colframe=bankblue,
|
|
title=Key Concept,
|
|
fonttitle=\bfseries\small,
|
|
boxrule=0.8pt,
|
|
arc=2pt,
|
|
top=2pt, bottom=2pt, left=4pt, right=4pt
|
|
}
|
|
|
|
\newtcolorbox{examplebox}[1][]{
|
|
colback=bankgreen!10!white,
|
|
colframe=bankgreen,
|
|
title={Example: #1},
|
|
fonttitle=\bfseries\small,
|
|
boxrule=0.8pt,
|
|
arc=2pt,
|
|
top=2pt, bottom=2pt, left=4pt, right=4pt
|
|
}
|
|
|
|
\newtcolorbox{definitionbox}[1][]{
|
|
colback=linen!40!white,
|
|
colframe=camel!85!black,
|
|
title={Definition: #1},
|
|
fonttitle=\bfseries\small,
|
|
boxrule=0.8pt,
|
|
arc=2pt,
|
|
top=2pt, bottom=2pt, left=4pt, right=4pt
|
|
}
|
|
|
|
\newtcolorbox{thinkbox}{
|
|
colback=lightGray!35!white,
|
|
colframe=darkGray,
|
|
title=Discussion,
|
|
fonttitle=\bfseries\small,
|
|
boxrule=0.8pt,
|
|
arc=2pt,
|
|
top=2pt, bottom=2pt, left=4pt, right=4pt
|
|
}
|
|
|
|
\newtcolorbox{hinweisbox}{
|
|
colback=bankred!5!white,
|
|
colframe=bankred,
|
|
title=Important Note,
|
|
fonttitle=\bfseries\small,
|
|
boxrule=0.8pt,
|
|
arc=2pt,
|
|
top=2pt, bottom=2pt, left=4pt, right=4pt
|
|
}
|
|
|
|
\newtcolorbox{ailinse}[1][]{
|
|
colback=aiviolet!7!white,
|
|
colframe=aiviolet,
|
|
title={AI Lens: #1},
|
|
fonttitle=\bfseries\small,
|
|
boxrule=0.8pt,
|
|
arc=2pt,
|
|
top=2pt, bottom=2pt, left=4pt, right=4pt
|
|
}
|
|
|
|
\newtcolorbox{projektbox}{
|
|
colback=bankblue!4!white,
|
|
colframe=bankblue!70!black,
|
|
title=Project Link: Portfolio Intelligence Platform,
|
|
fonttitle=\bfseries\small,
|
|
boxrule=0.8pt,
|
|
arc=2pt,
|
|
top=2pt, bottom=2pt, left=4pt, right=4pt
|
|
}
|
|
|
|
% ============================================
|
|
% TITLE METADATA
|
|
% ============================================
|
|
\title[AI in Software Engineering II]{AISE502: AI in Software Engineering II}
|
|
\subtitle{Lecture 13: Threats, the Shifted Matrix, Agent Orchestration -- and Synthesis\\[0.4ex]{\small Script: Part V, Sections 42.6--42.7, 43--45}}
|
|
\author{Dr.\ Florian Herzog}
|
|
\shortname{AISE502}
|
|
\fullname{Fachhochschule Graub\"unden, Chur -- Autumn Semester 2026}
|
|
|
|
\begin{document}
|
|
|
|
% ============================================
|
|
% TITLE SLIDE
|
|
% ============================================
|
|
\FHGRTitlePage
|
|
|
|
% ============================================
|
|
% AGENDA
|
|
% ============================================
|
|
\begin{frame}{Agenda}
|
|
\small
|
|
\begin{enumerate}\setlength\itemsep{1pt}
|
|
\item Axis B completed: a new threat class -- \textbf{OWASP LLM Top 10}, prompt injection; regulation as a hard constraint -- the \textbf{EU AI Act}
|
|
\item How AI \textbf{shifts the matrix}: the C10 row cell by cell; D12 across the seven patterns; five shifted cells; MLOps maturity; A6 restated
|
|
\item \textbf{Agent orchestration} -- the emergent eighth pattern: the advisor workflow; agent vs.\ workflow; topologies and classical analogues
|
|
\item The economics of autonomy and the default rule; a capability-profile sketch
|
|
\item Synthesis: one theory, five parts -- \textbf{Maxim 8}; one discipline at two binding sites
|
|
\item Exam orientation
|
|
\item This week's exercise: \textbf{M5 closes} -- eval harness in CI, guard, cost observability; threat model incl.\ prompt injection via news $+$ basic hardening; optional distinction work (K\"ur)
|
|
\end{enumerate}
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% RECAP
|
|
% ============================================
|
|
\section{Recap}
|
|
|
|
\begin{frame}{Recap: where we are}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{1pt}
|
|
\item Part V is the framework's stress test on two axes: \textbf{Axis A} -- AI in the process (agentic tools, verification bottleneck, guardrails); \textbf{Axis B} -- AI in the product (components that are non-deterministic, fallible, latency-heavy, priced per call)
|
|
\item Lecture 12: Axis-A evidence -- two RCTs and their resolution; the \textbf{verification bottleneck} (Maxim 7: generation is cheap, verification and architecture are binding -- D7 and D9 gain weight); Axis A compact: documentation as control interface, fitness functions as operating licence, who merges answers; Axis B: sentiment call wired wrong and right; three component types; SE4AI classics; reference architecture (\textbf{LLM gateway} as single measurement point); eval-harness basics
|
|
\item The C10 verdict has been computed \textbf{three times}: mini-match (L, MM, MS -- Lecture 3), profile and real systems (Lecture 6), the full row with its cell rationales (Lecture 10; the $7 \times 10$ matrix itself was read in Lecture 7)
|
|
\item Lecture 6 filed the outlook: agent orchestration is a \emph{composition pattern} reusing the catalogue's topologies -- workflows before agents ($15\times$ tokens). Today that claim is paid out
|
|
\item Today: Axis B completed (threats, regulation) $\to$ how AI \emph{shifts} the matrix $\to$ the eighth pattern with a profile sketch $\to$ synthesis and exam orientation. \textbf{The last lecture of new material}; week 14: one lesson synthesis and exam hints, three lessons final presentations, architecture defence and peer reviews (A3, M6)
|
|
\end{itemize}
|
|
|
|
\vspace{0.03cm}
|
|
\centering\textcolor{codegray}{tenth class (done) -- twelfth dimension (done) -- shifted cells (today) -- one composition pattern (today)}
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% AXIS B COMPLETED -- THREATS AND REGULATION
|
|
% ============================================
|
|
\section{Axis B Completed -- Threats and Regulation}
|
|
|
|
\begin{frame}{A new threat class -- OWASP Top 10 for LLM Applications (1/2)}
|
|
\emph{\textcolor{bankblue}{AI components add an attack surface that classical threat models do not cover.}}
|
|
|
|
\vspace{0.1cm}
|
|
\footnotesize The OWASP Top 10 for LLM Applications 2025 codifies it; the script pairs each risk with its \textbf{architectural} counter-measure -- deliberately, because the defence is \emph{structural, not model-internal}.
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\footnotesize
|
|
\begin{tabular}{@{}p{1.2cm}p{4.2cm}p{7.2cm}@{}}
|
|
\toprule
|
|
\textbf{ID} & \textbf{Risk} & \textbf{Architectural counter-measure} \\
|
|
\midrule
|
|
LLM01 & Prompt injection (direct and indirect) & Defence in depth: privilege separation, output validation, human-in-the-loop for sensitive actions \\
|
|
LLM02 & Sensitive information disclosure & Data minimisation in prompts; output filtering at the gateway \\
|
|
LLM03 & Supply chain & Vetting of models, weights, and dependencies; registry discipline \\
|
|
LLM04 & Data and model poisoning & Data governance and provenance for training/index data \\
|
|
LLM05 & Improper output handling & Treat output as untrusted input: schema validation, encoding, ontology guard \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
\end{frame}
|
|
|
|
\begin{frame}{A new threat class -- OWASP Top 10 for LLM Applications (2/2)}
|
|
\begin{center}
|
|
\footnotesize
|
|
\begin{tabular}{@{}p{1.2cm}p{4.2cm}p{7.2cm}@{}}
|
|
\toprule
|
|
\textbf{ID} & \textbf{Risk} & \textbf{Architectural counter-measure} \\
|
|
\midrule
|
|
LLM06 & Excessive agency & Least-privilege tool design; deterministic services own irreversible actions \\
|
|
LLM07 & System prompt leakage & No secrets or authorisation logic in prompts \\
|
|
LLM08 & Vector and embedding weaknesses & Access control and tenant isolation on the retrieval index \\
|
|
LLM09 & Misinformation & Grounding with mandatory citations; domain-axiom checks \\
|
|
LLM10 & Unbounded consumption & Rate limits, token budgets, cost circuit breakers per tenant \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\vspace{0.2cm}
|
|
\footnotesize \emph{Most counter-measures are elements of the gateway architecture of Lecture 12.}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Prompt injection -- why the model cannot solve it}
|
|
\begin{hinweisbox}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{2pt}
|
|
\item Prompt injection is \textbf{not fully solvable inside the model}, because LLMs process instructions and data in the \emph{same channel}
|
|
\item Any document, e-mail, or web page the system reads can carry instructions (``ignore your previous rules and \dots'') -- and no reliable in-model separator exists
|
|
\item The defence is therefore \textbf{defence in depth at the system level}: least-privilege tools (LLM06), output validation (LLM05), human approval for consequential actions, consumption limits (LLM10)
|
|
\item This is the security-flavoured restatement of the section's design rule: \textbf{the architecture, not the model, is the trust boundary}
|
|
\item For the course project, concretely: no LLM output may reach the booking path without passing the \textbf{ontology guard}; no agent tool may perform an \textbf{irreversible action}
|
|
\end{itemize}
|
|
\end{hinweisbox}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Regulation as a hard constraint: the EU AI Act}
|
|
\footnotesize Regulation closes the quality-attribute loop with legal force -- \textbf{Regulation (EU) 2024/1689}, the AI Act, entered into force on 1~August 2024; a risk-based approach with four classes:
|
|
|
|
\vspace{0.15cm}
|
|
\begin{columns}[T]
|
|
\begin{column}{0.55\textwidth}
|
|
\scriptsize
|
|
\begin{tabular}{@{}p{1.9cm}p{5.2cm}@{}}
|
|
\toprule
|
|
\textbf{Class} & \textbf{Examples / duties} \\
|
|
\midrule
|
|
\textbf{Unacceptable risk} & prohibited practices, e.g.\ social scoring \\
|
|
\textbf{High risk} & Annex III use cases: creditworthiness assessment, employment, critical infrastructure -- duties: risk management, data governance, documentation, logging, oversight, accuracy/robustness/cybersecurity \\
|
|
\textbf{Limited risk} & transparency duties: labelling AI interaction and generated content \\
|
|
\textbf{Minimal risk} & -- \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{column}
|
|
\begin{column}{0.42\textwidth}
|
|
\scriptsize
|
|
\begin{tabular}{@{}>{\raggedright\arraybackslash}p{1.7cm}>{\raggedright\arraybackslash}p{3.7cm}@{}}
|
|
\toprule
|
|
\textbf{Date} & \textbf{What applies} \\
|
|
\midrule
|
|
2 Feb 2025 & prohibitions; AI-literacy duties \\
|
|
2 Aug 2025 & governance; GPAI duties \\
|
|
2 Aug 2026 & general applicability incl.\ Annex III high-risk \\
|
|
2 Aug 2027 & high-risk AI in regulated products \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{column}
|
|
\end{columns}
|
|
\end{frame}
|
|
|
|
\begin{frame}{AI Act obligations -- K(a), not weights}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{1pt}
|
|
\item For this theory the AI Act has a precise, limited role: its obligations are \textbf{quality attributes with legal force} that enter the requirements profile as \textbf{hard constraints $K(a)$, not as weights} -- Part I: constraints are knock-out filters, never averaged away
|
|
\item A finance-related advisory platform -- class C10, particularly with any \emph{creditworthiness} bearing -- can fall into the \textbf{high-risk} class
|
|
\item Then logging of agent steps, technical documentation, human oversight, and demonstrated robustness stop being engineering preferences and become \textbf{conditions of legal operation}
|
|
\end{itemize}
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\footnotesize
|
|
\begin{tabular}{@{}p{3.2cm}p{9.4cm}@{}}
|
|
\toprule
|
|
\textbf{Obligation} & \textbf{Architectural element it lands on} \\
|
|
\midrule
|
|
\textbf{logging} & gateway telemetry $+$ audit journal \\
|
|
\textbf{human oversight} & human-in-the-loop interfaces at the determinism boundary \\
|
|
\textbf{robustness} & fallback chains $+$ eval harness \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\vspace{0.1cm}
|
|
\begin{keypoint}
|
|
\footnotesize Compliance, correctly designed, is not a parallel work stream -- \textbf{it is the same architecture, documented}.
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% HOW AI SHIFTS THE MATRIX
|
|
% ============================================
|
|
\section{How AI Shifts the Matrix}
|
|
|
|
\begin{frame}{How AI shifts the matrix}
|
|
\emph{\textcolor{bankblue}{You have computed the C10 verdict three times -- what were those computations doing to the rest of the matrix?}}
|
|
|
|
\vspace{0.15cm}
|
|
\small
|
|
\begin{itemize}\setlength\itemsep{2pt}
|
|
\item The verdict itself needs \textbf{no fourth derivation} -- the three computations of the recap (Lectures 3, 6, 10)
|
|
\item Two of the four absorption forms on the recap's map -- the \textbf{tenth class} and the \textbf{twelfth dimension} -- are exactly the artefacts those computations used
|
|
\item This section supplies the generalisation in three steps:
|
|
\begin{enumerate}\setlength\itemsep{1pt}
|
|
\item[(i)] the \emph{supply-side} reading of the row you own
|
|
\item[(ii)] the full \textbf{D12 column} it exercised
|
|
\item[(iii)] the \textbf{cells that moved} -- cell by cell, with stated and measurable reasons
|
|
\end{enumerate}
|
|
\item Then: when the pipeline promise is real (MLOps maturity) -- and A6 restated as a falsifiable claim
|
|
\end{itemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}{The C10 row -- which D12 mechanism each cell exercises}
|
|
\footnotesize Start from the row you own (Lecture 10) -- the one reading the three computations used but never stated in one place: \emph{which D12 mechanism each cell exercises}.
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\footnotesize
|
|
\begin{tabular}{@{}p{1.6cm}cp{9.6cm}@{}}
|
|
\toprule
|
|
\textbf{Cells} & \textbf{Fit} & \textbf{D12 mechanism exercised} \\
|
|
\midrule
|
|
MM, HX & $++$ & \textbf{boundary and port}: a CI-verifiable module boundary and an anti-corruption adapter on a port contain a fallible, entangled component \\
|
|
EDA, PF & $+$ & \textbf{queue}: asynchronous absorption of latency, rate limits, and outages; pipeline-shaped ingestion and evals \\
|
|
L & $-$ & none of the three -- no queue, no port, no measurement point \\
|
|
MS & $\circ$ & seconds-scale, fallible calls in synchronous chains (the missing queue) \\
|
|
SL & $\circ$ & minutes-long LLM and solver work against platform timeout ceilings \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\vspace{0.1cm}
|
|
\begin{keypoint}
|
|
\footnotesize \textbf{Recommendation (Part IV, ADR-007):} a hexagonal modular monolith plus pipelines and an orchestrated agent workflow, with EDA as the secondary job/audit spine -- governed by token and latency budgets and the determinism boundary: \emph{agents propose; deterministic services decide and book}.
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
\begin{frame}{D12 across the seven patterns}
|
|
\footnotesize The D12 row of the Lecture-6 consolidated table, now with tactic-level rationales -- D12 (AI integrability) measures whether the pattern naturally provides \textbf{the queue, the port, and the measurement point} a slow, fallible, per-call-priced component requires.
|
|
|
|
\vspace{0.05cm}
|
|
\scriptsize
|
|
\renewcommand{\arraystretch}{0.8}%
|
|
\begin{center}
|
|
\begin{tabular}{@{}p{2.6cm}cp{8.4cm}@{}}
|
|
\toprule
|
|
\textbf{Pattern} & \textbf{D12} & \textbf{Rationale} \\
|
|
\midrule
|
|
L -- Layered & $\circ$ & technical layers give the non-deterministic component no boundary, no queue, and no measurement point of its own \\
|
|
MM -- Modular monolith & $+$ & a dedicated AI module with a hard, CI-verifiable interface contains the component cheaply \\
|
|
HX -- Hexagonal & $++$ & the LLM is an adapter on a port: swappable, mockable, contract-guarded -- the ACL discipline structurally built in \\
|
|
MS -- Microservices & $\circ$ & per-service isolation helps; synchronous chains through seconds-scale calls hurt -- net neutral \\
|
|
EDA -- Event-driven & $++$ & queues absorb exactly what LLMs are worst at: latency, rate limits, outages; natural batching points \\
|
|
PF -- Pipes-and-filters & $++$ & ingestion, training, and eval pipelines are pipes-and-filters by construction \\
|
|
SL -- Serverless & $\circ$ & event-glue around batch AI APIs fits; platform timeout ceilings collide with minutes-long LLM/solver runs \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Which existing cells shift, and why (1/2)}
|
|
\footnotesize Beyond the new row and column, AI as a runtime component moves \emph{existing} evaluations in stated directions -- all five visible in the D12 ratings, each carrying a measurable reason:
|
|
|
|
\vspace{0.1cm}
|
|
\begin{enumerate}\setlength\itemsep{3pt}
|
|
\item \textbf{Asynchronous patterns gain (EDA, PF $\uparrow$).} Queues and pipelines absorb what LLMs are worst at -- latency, rate limits, outage -- and ingestion and eval pipelines are pipes-and-filters by construction
|
|
\item \textbf{Hexagonal gains most (HX $\uparrow$).} The ACL/port discipline is exactly what the CACE problem demands; Assumption A1's cost-of-change criterion bites hardest at \emph{model replacement}; testing against deterministic fakes is the only way to keep the deterministic 95\,\% of the system deterministic
|
|
\item \textbf{Synchronous distributed chains lose (MS $\downarrow$ where LLM calls sit in the request path).} Seconds-scale latency and per-hop failure probability multiply along the chain; without constitutive stability patterns this is a cascade design
|
|
\end{enumerate}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Which existing cells shift, and why (2/2)}
|
|
\footnotesize
|
|
\begin{enumerate}\setlength\itemsep{3pt}
|
|
\setcounter{enumi}{3}
|
|
\item \textbf{Serverless is conditional (SL $\sim$).} Platform timeout ceilings against minutes-long LLM and solver runs cap it; event-glue around batch APIs remains a fit
|
|
\item \textbf{A cost dimension becomes load-bearing everywhere.} Cost per request, feature, and tenant is a runtime quality attribute with no counterpart in classical profiles; it belongs in the gateway and in CI budgets. Routing across cheap and expensive models is the new incarnation of a classical resource-arbitration tactic: \textbf{cascades} up to $\sim$98\,\% cost reduction at comparable quality; \textbf{learned routers} more than $2\times$ cheaper without quality loss
|
|
\end{enumerate}
|
|
|
|
\vspace{0.15cm}
|
|
\begin{keypoint}
|
|
\footnotesize The matrix does not get \emph{rewritten} by AI; it gets \emph{shifted} -- in \textbf{five stated directions, for five stated and measurable reasons}. A student who can name, for any cell movement, the quality-attribute mechanism behind it (which tactic the pattern bundles or impedes for a slow, fallible, per-call-priced component) has understood both Part IV and Part V.
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
\begin{frame}{MLOps maturity: the three-level ladder}
|
|
\footnotesize For type-(b) components the PF cells' promise (the D12 $++$) is realised only at sufficient process maturity -- the canonical three-level ladder:
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\scriptsize
|
|
\renewcommand{\arraystretch}{1.0}%
|
|
\begin{tabular}{@{}p{1.4cm}p{7.0cm}p{4.4cm}@{}}
|
|
\toprule
|
|
\textbf{Level} & \textbf{Characteristics} & \textbf{Key trait} \\
|
|
\midrule
|
|
\textbf{Level 0} & manual, script-driven, interactive; data science and operations separated; releases rare, no CI/CD, minimal monitoring -- \emph{the documented reality of many teams} & model handed ``over the fence'' as an artefact \\
|
|
\textbf{Level 1} & automated ML pipeline with continuous training; automated data and model validation, triggers, metadata store, feature store & \emph{the pipeline, not the model, is the deployment artefact} \\
|
|
\textbf{Level 2} & CI/CD automation of the pipeline components themselves & fast, reliable experiment-to-production cycles \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\vspace{0.15cm}
|
|
\scriptsize\textcolor{codegray}{Nine consolidated MLOps principles: CI/CD automation, workflow orchestration, reproducibility, versioning of data/model/code, collaboration, continuous training and evaluation, metadata tracking, monitoring, feedback loops.}
|
|
\end{frame}
|
|
|
|
\begin{frame}{When the pipeline promise is real: the fit-theoretical reading}
|
|
\begin{keypoint}
|
|
\footnotesize \textbf{Fit-theoretical reading:} the MLOps level describes how much of \textbf{D9} (testability/deployability) and \textbf{D12} the organisation can actually \emph{cash in}.
|
|
\end{keypoint}
|
|
|
|
\vspace{0.2cm}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{3pt}
|
|
\item A Level-0 team holding a $++$ pattern rating realises little of it
|
|
\item This is the \textbf{Axis-B echo of DORA's Axis-A finding} (Lecture 12): \emph{guardrail maturity, not tool adoption}, converts potential into performance
|
|
\end{itemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Assumption A6 restated as a falsifiable claim}
|
|
\footnotesize Three of the four absorption forms are now on the table, each \emph{computed rather than asserted}: the tenth class, the twelfth dimension, the shifted cells -- the fourth, the emergent composition pattern, follows next.
|
|
|
|
\vspace{0.15cm}
|
|
\begin{keypoint}
|
|
\footnotesize \textbf{Assumption A6 restated as a falsifiable claim.}
|
|
\begin{itemize}\setlength\itemsep{1pt}
|
|
\item Runtime AI components are non-deterministic, fallible, latency-heavy, per-call-priced, and subject to drift and vendor deprecation
|
|
\item They \emph{stretch} existing quality dimensions by orders of magnitude and add sub-attributes: token cost per request, eval pass rate, provider deprecation risk, prompt-injection resistance
|
|
\item What does \emph{not} change is the method: scenarios with response measures, tactics, trade-off analysis, ADRs, fitness functions
|
|
\item The theory absorbs AI -- as a tenth application class, a twelfth profile dimension, shifted cell values, and one emergent composition pattern -- instead of being reinvented for it
|
|
\item The quality gate is carried by the one new test-artefact class A6 named from the start: the \textbf{eval harness}
|
|
\end{itemize}
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% AGENT ORCHESTRATION -- THE EMERGENT EIGHTH PATTERN
|
|
% ============================================
|
|
\section{Agent Orchestration -- The Emergent Eighth Pattern}
|
|
|
|
\begin{frame}{Agent orchestration -- the emergent eighth pattern}
|
|
\emph{\textcolor{bankblue}{``Should I reduce my exposure to European industrials?'' -- no single model call can answer that responsibly, so what structure can?}}
|
|
|
|
\vspace{0.15cm}
|
|
\small
|
|
\begin{itemize}\setlength\itemsep{3pt}
|
|
\item The final structural novelty of the AI era is the \textbf{orchestration of agents}
|
|
\item As everywhere in this script, \textbf{the concrete system comes before the catalogue}: first the advisory workflow the course project actually builds, then the name of what it is an instance of
|
|
\end{itemize}
|
|
|
|
\vspace{0.2cm}
|
|
\footnotesize \textbf{Rhythm of this block:} case $\to$ what an agent is and is not $\to$ topologies and classical analogues $\to$ choosing a topology $\to$ economics and the default rule $\to$ capability-profile sketch $\to$ project link
|
|
\end{frame}
|
|
|
|
\begin{frame}{Case: the course project's advisor workflow}
|
|
\begin{center}
|
|
\resizebox{\textwidth}{!}{%
|
|
\begin{tikzpicture}[
|
|
sysbox/.style={rectangle, draw, rounded corners=4pt, align=center, font=\small\sffamily, line width=0.8pt},
|
|
agent/.style={sysbox, fill=aiviolet!15, draw=aiviolet, minimum width=2.7cm, minimum height=0.9cm},
|
|
det/.style={sysbox, fill=bankgreen!15, draw=bankgreen, minimum width=2.7cm, minimum height=0.9cm},
|
|
extern/.style={sysbox, fill=gray!15, draw=gray!60!black, minimum width=2.2cm, minimum height=0.9cm},
|
|
arr/.style={-{Stealth[length=2.5mm]}, thick, gray!60!black}
|
|
]
|
|
\node[extern] (req) at (-8.6,1.7) {request};
|
|
\node[agent] (orch) at (0,1.7) {Orchestrator\\ \footnotesize LLM call, fixed system prompt};
|
|
\node[agent] (da) at (-4.2,-0.4) {Document analyst\\ \footnotesize findings with citations};
|
|
\node[agent] (pq) at (0,-0.4) {Portfolio quant\\ \footnotesize exposure, concentration};
|
|
\node[agent] (cc) at (4.2,-0.4) {Compliance checker\\ \footnotesize citations, ontology, mandate};
|
|
\node[det] (ana) at (0,-2.4) {deterministic analytics services};
|
|
\node[det] (guard) at (7.4,1.7) {guard};
|
|
\node[extern] (out) at (10.9,1.7) {user / books};
|
|
\draw[dashed, aiviolet, rounded corners=6pt, line width=0.8pt] (-6.1,-1.15) rectangle (6.1,2.75);
|
|
\node[font=\small\sffamily, text=aiviolet, anchor=west] at (-6.0,2.45) {LLM gateway -- every call};
|
|
\draw[arr] (req) -- (orch);
|
|
\draw[arr] (orch) -- node[left, font=\scriptsize\sffamily, pos=0.4] {sub-tasks} (da);
|
|
\draw[arr] (orch) -- (pq);
|
|
\draw[arr] (orch) -- (cc);
|
|
\draw[arr] (pq) -- (ana);
|
|
\draw[arr] (orch) -- node[above, font=\scriptsize\sffamily] {merged answer} (guard);
|
|
\draw[arr] (guard) -- (out);
|
|
\end{tikzpicture}%
|
|
}
|
|
\end{center}
|
|
|
|
\vspace{0.05cm}
|
|
\footnotesize
|
|
\textbf{Orchestrator} (an LLM call with a fixed system prompt) splits the request into sub-tasks, delegates, then merges the results into one grounded answer. \textbf{Document analyst}: extracted findings from the ingestion corpus \emph{with citations}; \textbf{portfolio quant}: exposure and concentration numbers by calling only deterministic analytics services -- \emph{arithmetic is not a job for a language model}. \textbf{Compliance checker}: verifies the draft -- every cited passage exists, every entity resolves against the ontology, every mandate constraint holds.
|
|
\end{frame}
|
|
|
|
\begin{frame}{Strip the labels: a shape you know cell by cell}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{3pt}
|
|
\item Every call by every participant flows through the \textbf{LLM gateway} -- routed, cached, budgeted, logged -- and nothing any agent produces reaches the user or the books without passing the \textbf{guard}: \emph{agents propose; deterministic services decide and book}
|
|
\item Now strip the labels: a coordinator decomposing work for specialised workers is the \textbf{mediator topology of event-driven architecture} (Lecture 5); the fixed retrieve--extract--check sequence inside each specialist is a \textbf{pipeline} (Lecture 6); peers coordinating over shared context would be the \textbf{broker topology}
|
|
\item This is the claim the Part II outlook (Lecture 6) filed in advance; this section pays it out -- the full six-row mapping follows
|
|
\end{itemize}
|
|
|
|
\vspace{0.15cm}
|
|
\begin{keypoint}
|
|
\footnotesize The section's deliberately \emph{deflationary} claim: agent orchestration is \textbf{not a new architectural style} but a \textbf{composition pattern for non-deterministic runtime components} that reuses the topologies of the seven patterns you already know -- which is why it can be evaluated with the \textbf{rating grid you already have}.
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
\begin{frame}{What an agent is -- and is not}
|
|
\begin{definitionbox}[Agent; workflow vs.\ agent]
|
|
\footnotesize An \emph{agent} is an LLM running in a loop with tools and state: at each iteration the model observes the current state (conversation, tool results, working memory), selects an action (a tool call or an answer), and the loop executes it and feeds the result back -- until a termination condition holds. Schematically: \textbf{agent $=$ loop $+$ tools $+$ state}. The load-bearing distinction: a \textbf{workflow} orchestrates LLM calls and tools along \emph{predefined code paths} -- deterministic structure, non-deterministic building blocks; an \textbf{agent} lets the model \emph{steer its own process and tool use} -- the control flow itself becomes model output. Autonomy is therefore not a binary but a \textbf{dial}, and every notch on it costs latency, tokens, and testability.
|
|
\end{definitionbox}
|
|
|
|
\vspace{0.1cm}
|
|
\footnotesize Engineering guidance of the source that defined this vocabulary -- matching the module's philosophy verbatim: \textbf{find the simplest solution possible} $\cdot$ \textbf{prefer simple, composable patterns over frameworks} $\cdot$ \textbf{escalate to agents only when the task genuinely requires open decision paths}.
|
|
|
|
\vspace{0.1cm}
|
|
Orchestration frameworks that model workflows as \emph{explicit graphs} make the topology \textbf{inspectable} -- an architectural virtue for the same reason a C4 diagram is (Lecture 3).
|
|
\end{frame}
|
|
|
|
\begin{frame}{Topologies and their classical analogues}
|
|
\footnotesize The Lecture-6 outlook table, now with its third column: every workflow topology maps exactly onto a structure from Part II that you know cell by cell -- and every property the classical pattern is known for (and every weakness) \emph{transfers}.
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\scriptsize
|
|
\renewcommand{\arraystretch}{0.9}%
|
|
\begin{tabular}{@{}p{3.4cm}p{3.1cm}p{6.5cm}@{}}
|
|
\toprule
|
|
\textbf{Topology} & \textbf{Classical analogue} & \textbf{Structure and use} \\
|
|
\midrule
|
|
Prompt chaining (chain) & Pipes-and-filters (PF) & each call processes the previous output; programmatic gates between stages; fixed decomposition \\
|
|
Routing & Routing layer / mediator & a classification step directs inputs to specialised prompts or models; the runtime sibling of model routing \\
|
|
Parallelisation (sectioning, voting) & Broker-style fan-out & independent subtasks in parallel, or repeated runs with majority vote \\
|
|
Orchestrator--workers (tree/graph) & Mediator EDA & a lead model decomposes the task dynamically and delegates to workers; central workflow control \\
|
|
Evaluator--optimizer & Feedback control loop & generator and evaluator model iterate until a quality criterion holds \\
|
|
Autonomous multi-agent & Broker topology & peer agents coordinate over shared context; maximal flexibility, minimal central control \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Four topologies, drawn -- gates in code, judgement in the model}
|
|
\begin{center}
|
|
\resizebox{0.7\textwidth}{!}{%
|
|
\begin{tikzpicture}[
|
|
agentbox/.style={rectangle, draw, rounded corners=3pt, minimum width=1.5cm, minimum height=0.7cm, align=center, font=\scriptsize\sffamily, fill=aiviolet!15, draw=aiviolet, line width=0.7pt},
|
|
gatebox/.style={rectangle, draw, rounded corners=3pt, minimum width=1.2cm, minimum height=0.7cm, align=center, font=\scriptsize\sffamily, fill=bankgreen!15, draw=bankgreen, line width=0.7pt},
|
|
lbl/.style={font=\scriptsize\sffamily\bfseries, align=center},
|
|
arr/.style={-{Stealth[length=2mm]}, semithick, gray!60!black}
|
|
]
|
|
% --- Chain ---
|
|
\node[agentbox] (c1) {LLM 1};
|
|
\node[gatebox, right=0.5cm of c1] (g1) {gate};
|
|
\node[agentbox, right=0.5cm of g1] (c2) {LLM 2};
|
|
\node[agentbox, right=0.5cm of c2] (c3) {LLM 3};
|
|
\draw[arr] (c1) -- (g1); \draw[arr] (g1) -- (c2); \draw[arr] (c2) -- (c3);
|
|
\node[lbl, above=0.25cm of g1, xshift=0.9cm] {Chain $\;\hat{=}\;$ pipes-and-filters};
|
|
|
|
% --- Orchestrator-workers ---
|
|
\node[agentbox, right=1.6cm of c3, yshift=0.65cm] (orch) {Orchestrator};
|
|
\node[agentbox, below=0.55cm of orch, xshift=-1.7cm] (w1) {Worker A};
|
|
\node[agentbox, below=0.55cm of orch] (w2) {Worker B};
|
|
\node[agentbox, below=0.55cm of orch, xshift=1.7cm] (w3) {Worker C};
|
|
\draw[arr] (orch) -- (w1); \draw[arr] (orch) -- (w2); \draw[arr] (orch) -- (w3);
|
|
\node[lbl, above=0.25cm of orch] {Orchestrator--workers $\;\hat{=}\;$ mediator EDA};
|
|
|
|
% --- Evaluator-optimizer ---
|
|
\node[agentbox, below=2.4cm of c1, xshift=0.6cm] (gen) {Generator};
|
|
\node[agentbox, right=1.5cm of gen] (ev) {Evaluator};
|
|
\draw[arr] (gen.10) -- (ev.170);
|
|
\draw[arr] (ev.190) -- node[below, font=\tiny\sffamily]{feedback} (gen.350);
|
|
\node[lbl, above=0.25cm of gen, xshift=1.4cm] {Evaluator--optimizer $\;\hat{=}\;$ control loop};
|
|
|
|
% --- Multi-agent broker ---
|
|
\node[gatebox, right=2.6cm of ev, minimum width=3.4cm, minimum height=0.5cm] (bus) {shared context / bus};
|
|
\node[agentbox, above=0.5cm of bus, xshift=-1.2cm] (a1) {Agent 1};
|
|
\node[agentbox, above=0.5cm of bus, xshift=1.2cm] (a2) {Agent 2};
|
|
\node[agentbox, below=0.5cm of bus] (a3) {Agent 3};
|
|
\draw[arr] (a1) -- (bus); \draw[arr] (a2) -- (bus); \draw[arr] (bus) -- (a3);
|
|
\node[lbl, below=0.3cm of a3] {Multi-agent $\;\hat{=}\;$ broker topology};
|
|
\end{tikzpicture}%
|
|
}
|
|
\end{center}
|
|
|
|
\vspace{0.05cm}
|
|
\footnotesize Deterministic gates (green) between non-deterministic stages (violet) are the \textbf{workflow discipline}: \emph{structure stays in code, judgement stays in the model}.
|
|
\end{frame}
|
|
|
|
\begin{frame}{The evaluation logic applies unchanged -- sharpened along three axes}
|
|
\footnotesize Because the topologies are the old topologies, the evaluation logic of this theory applies \textbf{unchanged} -- sharpened along exactly three axes:
|
|
|
|
\vspace{0.15cm}
|
|
\begin{itemize}\setlength\itemsep{4pt}
|
|
\item \textbf{Non-determinism} -- testability is read as \emph{eval coverage} (the eval harness of Lecture 12)
|
|
\item \textbf{Token economics} -- cost per \emph{request}, not per infrastructure
|
|
\item \textbf{Fallibility} -- fault tolerance is read as guardrails, evaluator loops, and deterministic fallbacks behind ports
|
|
\end{itemize}
|
|
|
|
\vspace{0.2cm}
|
|
Consequence: the choice of topology can be compressed into the same style of decision aid the matrix provides -- next frame.
|
|
\end{frame}
|
|
|
|
\begin{frame}{Choosing a topology from the task signature}
|
|
\footnotesize Read top-down and \textbf{stop at the first matching row} -- the ordering encodes ``simplest structure first''.
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\footnotesize
|
|
\begin{tabular}{@{}>{\raggedright\arraybackslash}p{4.6cm}>{\raggedright\arraybackslash}p{3.2cm}>{\raggedright\arraybackslash}p{4.8cm}@{}}
|
|
\toprule
|
|
\textbf{Task signature} & \textbf{Topology} & \textbf{Cost/risk note} \\
|
|
\midrule
|
|
Fixed decomposition; every intermediate result verifiable & Prompt chain (workflow) & cheapest and most testable; deterministic gates between stages \\
|
|
Heterogeneous input categories with specialised handling & Routing & cheap; the router itself needs its own eval \\
|
|
Broad, parallelisable subtasks; breadth-first search & Parallelisation or orchestrator--workers & token cost multiplies with worker count ($\sim$15$\times$ class) \\
|
|
Output must clear a measurable quality bar & Evaluator--optimizer & latency and cost grow per iteration; needs a reliable evaluator \\
|
|
Path genuinely unknown; open-ended tool use & Agent & highest cost and risk; guardrails, budgets, and oversight mandatory \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\vspace{0.1cm}
|
|
\begin{projektbox}
|
|
\footnotesize Your Axis-B ADR must justify your topology \emph{against this table}.
|
|
\end{projektbox}
|
|
\end{frame}
|
|
|
|
\begin{frame}{The economics of autonomy -- and the default rule}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{2pt}
|
|
\item The rigour case for restraint, quantified by the best-documented production account (previewed in the Lecture-6 outlook): Anthropic's multi-agent research system -- an orchestrator--workers design -- beat a single agent by \textbf{90.2\,\%} at roughly \textbf{15$\times$ the tokens} of a chat interaction (simple agents $\sim$4$\times$); token use alone explains \textbf{80\,\%} of the variance
|
|
\item A textbook \textbf{CBAM decision} in the sense of Part IV: autonomy is bought with cost, latency, and error accumulation -- justified only where the task's utility-response curve clears the price: broad, parallelisable research questions do; a form-filling workflow does not
|
|
\item Regulation closes the loop from the other side: the AI Act's logging, documentation, human-oversight, and robustness duties attach to \emph{exactly the autonomy this section prices}
|
|
\end{itemize}
|
|
|
|
\vspace{0.1cm}
|
|
\begin{keypoint}
|
|
\footnotesize \textbf{The default rule for agent architecture.} Workflows before agents; the simplest structure first; autonomy only on demonstrated need; every escalation an ADR with a measurement contract. \emph{An orchestration decision without a token budget and an eval threshold is an opinion -- Maxim 6 applies to agents without modification.}
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Agent orchestration -- capability-profile sketch}
|
|
\scriptsize
|
|
\renewcommand{\arraystretch}{0.8}%
|
|
\vspace{-0.35cm}
|
|
\begin{center}
|
|
\begin{tabular}{@{}p{3.45cm}c>{\raggedright\arraybackslash}p{8.75cm}@{}}
|
|
\toprule
|
|
\textbf{Dimension} & \textbf{Rating} & \textbf{Ground} \\
|
|
\midrule
|
|
D1 Read scalability & $\circ$ & state small and replicable; throughput bounded by provider rate limits \\
|
|
D2 Write scal.\ \& elasticity & $\circ$ & fan-out cheap in structure, expensive in tokens; volume quota-bound \\
|
|
D3 Latency \& predictability & $--$ & seconds per step, steps multiply; open-ended loops have no tail bound \\
|
|
D4 Consistency \& integrity & $--$ & non-deterministic by construction; integrity only outside, in deterministic validation \\
|
|
D5 Availability \& isolation & $-$ & each step adds provider failure modes and error accumulation; evaluator loops and fallbacks mitigate \\
|
|
D6 Security \& auditability & $\circ$ & logging natural ($+$), legally required in high-risk uses; injection, excessive agency widen the surface ($-$) \\
|
|
D7 Evolvability & $+$ & prompts, tools, models swap behind contracts; churn claws part back \\
|
|
D8 Simplicity \& TTM & $-$ & a chain workflow is genuinely simple; every notch of autonomy is not \\
|
|
D9 Testability \& deployability & $--$ & exhaustive testing impossible; evals with statistical thresholds replace assertions \\
|
|
D10 Operating cost & $--$ & token cost per request orders of magnitude up; multi-agent $\sim$15$\times$ chat \\
|
|
D11 Team scaling & $\circ$ & sub-agent and tool ownership parallelises teams moderately (PF analogy) \\
|
|
D12 AI integrability & $++$ & it \emph{is} the composition pattern for AI components -- its own best host \\
|
|
\midrule
|
|
Status & \multicolumn{2}{@{}>{\raggedright\arraybackslash}p{10.1cm}@{}}{provisional (state 2025/26) -- every cell carries its own temporal fitness function; default hypotheses, re-verified on every model generation} \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Agent orchestration -- reading the sketch}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{3pt}
|
|
\item \textbf{Why only a \emph{sketch} -- three caveats:} no Richards--Ford star ratings; no decade of production case studies; every cell is a \textbf{default hypothesis} in the sense of the theory's own limits discussion -- to be replaced by measurement and \textbf{re-verified on every model generation}
|
|
\item The cells read, as always, ``as the dominant structure of the subsystem it governs'' -- here the \textbf{AI subsystem}, not the whole platform
|
|
\item \textbf{The reading:} the profile explains at a glance why agent orchestration can never be the dominant structure of a whole platform of class C1--C9 -- it is \textbf{vetoed by every High weight on D3, D4, D9, or D10} (stage 2 of the three-stage match, Lecture 7)
|
|
\end{itemize}
|
|
|
|
\vspace{0.15cm}
|
|
\begin{keypoint}
|
|
\footnotesize Agent orchestration is, and remains, an \textbf{edge pattern} -- hosted behind the ports of a deterministic core, exactly where the C10 recommendation places it.
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Project link: Axis B is what you build -- and what you build it as}
|
|
\begin{projektbox}
|
|
\footnotesize Axis B is \emph{what} you build; the advisor workflow -- an orchestrator with two to three specialised sub-agents (document analyst, portfolio quant, compliance checker -- in the exercise sheet: \texttt{ResearchAgent}, \texttt{RiskAgent}\,/\,\texttt{OptimizationAgent}, and the ontology guard), all behind the LLM gateway -- is what you build it \emph{as}. The graded Axis-B deliverables are the \textbf{containment artefacts}:
|
|
\begin{enumerate}\setlength\itemsep{1pt}
|
|
\item[(i)] the \textbf{gateway} with fallback chain and per-request \textbf{cost observability} -- cost per request, per feature, reported on a dashboard and enforced as a CI budget (model routing itself is distinction work)
|
|
\item[(ii)] the \textbf{ontology guard} -- every extracted entity resolves against the deterministic data store, every cited passage exists, portfolio axioms hold
|
|
\item[(iii)] the \textbf{eval harness} (Lecture 12 listing) wired as a \textbf{CI gate}
|
|
\item[(iv)] one \textbf{ADR} that justifies your chosen orchestration topology against the task-signature table, with its \textbf{token budget and eval threshold} as the measurement contract
|
|
\end{enumerate}
|
|
\emph{Sub-agents propose; your deterministic services decide and book.}
|
|
\end{projektbox}
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% SYNTHESIS -- ONE THEORY, FIVE PARTS
|
|
% ============================================
|
|
\section{Synthesis -- One Theory, Five Parts}
|
|
|
|
\begin{frame}{What did AI change? Two temptations, one position}
|
|
\emph{\textcolor{bankblue}{What, in the end, did AI change?}} -- \small the bet of the opening can now be settled. Architecture teaching in the AI era faces \textbf{two symmetric temptations}:
|
|
|
|
\vspace{0.2cm}
|
|
\begin{columns}[T]
|
|
\begin{column}{0.48\textwidth}
|
|
\textcolor{bankblue}{\textbf{Denial}}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{1pt}
|
|
\item generative AI as a passing tool fashion that leaves software engineering untouched
|
|
\item \textbf{falsified by the adoption data alone}: \textbf{90\,\%} of practitioners report using AI at work by 2025
|
|
\end{itemize}
|
|
\end{column}
|
|
\begin{column}{0.48\textwidth}
|
|
\textcolor{bankblue}{\textbf{Exceptionalism}}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{1pt}
|
|
\item AI systems as a new discipline with new vocabulary, new roles, new decision logic
|
|
\item \textbf{rejected on the assembled evidence}: nothing AI does, on either axis, required a decision no ADR can record, a correctness no response measure can capture, or a structure no tactic vocabulary describes
|
|
\end{itemize}
|
|
\end{column}
|
|
\end{columns}
|
|
|
|
\vspace{0.25cm}
|
|
\begin{keypoint}
|
|
\footnotesize\centering Between the temptations lies the position defended since Part I: \textbf{absorption}.
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
\begin{frame}{The script read backwards as a single argument (1/2): Parts I--III}
|
|
\begin{center}
|
|
\footnotesize
|
|
\renewcommand{\arraystretch}{1.1}%
|
|
\begin{tabular}{@{}p{1.45cm}p{8.1cm}p{3.45cm}@{}}
|
|
\toprule
|
|
\textbf{Part} & \textbf{What it established} & \textbf{Artefact} \\
|
|
\midrule
|
|
\textbf{Part I} & architecture is the set of significant, hard-to-reverse decisions (\textbf{A1}); everything is a trade-off (\textbf{A2}); quality attributes -- not features -- drive structure (\textbf{A3}); requirements decide anything only as measurable scenarios (\textbf{A4}) & the \textbf{twelve dimensions} on which all later judgements run \\
|
|
\textbf{Part II} & turned seven patterns into \textbf{capability profiles} by explaining every rating through the tactics a pattern bundles or impedes & the consolidated \textbf{capability table} \\
|
|
\textbf{Part III} & turned ten application classes into \textbf{requirements profiles} -- recurring bundles of architecturally significant requirements with response measures and hard constraints & the \textbf{requirements table} \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
\end{frame}
|
|
|
|
\begin{frame}{The script read backwards as a single argument (2/2): Parts IV--V}
|
|
\begin{center}
|
|
\footnotesize
|
|
\renewcommand{\arraystretch}{1.1}%
|
|
\begin{tabular}{@{}p{1.45cm}p{8.1cm}p{3.45cm}@{}}
|
|
\toprule
|
|
\textbf{Part} & \textbf{What it established} & \textbf{Artefact} \\
|
|
\midrule
|
|
\textbf{Part IV} & matched them: knock-out screening, veto rule, holistic ordinal reading; \textbf{hybrids are the normal case}; the decision procedure ends in an \textbf{ADR}, and every ADR ends in a \textbf{measurement contract} -- because a decision is a hypothesis tested over the life cycle (\textbf{A5}) & the \textbf{$7 \times 10$ fit matrix} \\
|
|
\textbf{Part V} & subjected the whole construction to its hardest contemporary stress test -- \textbf{and the construction held} (\textbf{A6}) & Axis A / Axis B outcomes \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\vspace{0.1cm}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{2pt}
|
|
\item \textbf{Axis A} raised the value of the theory's artefacts -- documentation as agent context, fitness functions as operating licence -- rather than obsoleting them
|
|
\item \textbf{Axis B} was absorbed as one class, one dimension, five cell shifts, and one composition pattern whose profile the theory's own grid can express
|
|
\end{itemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Maxim 8 -- the pipeline of this script in one sentence}
|
|
\begin{keypoint}
|
|
\footnotesize \textbf{Maxim 8.} The theory absorbs AI: a tenth application class, a twelfth dimension, shifted cells, one emergent composition pattern -- \emph{same assumptions, same procedure, same contract}. The pipeline of this script is one sentence long:
|
|
|
|
\vspace{0.1cm}
|
|
\emph{scenarios with numbers (Part I) meet capability profiles (Part II) and requirements profiles (Part III) in a non-compensatory match (Part IV) whose result is an ADR with a measurement contract -- and nothing about AI, on either axis, changes a single step of it (Part V)}
|
|
\end{keypoint}
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\resizebox{0.78\textwidth}{!}{%
|
|
\begin{tikzpicture}[
|
|
sysbox/.style={rectangle, draw, rounded corners=4pt, align=center, font=\small\sffamily, line width=0.8pt, minimum height=1.0cm, minimum width=2.6cm},
|
|
part/.style={sysbox, fill=bankblue!20, draw=bankblue},
|
|
res/.style={sysbox, fill=bankgreen!15, draw=bankgreen},
|
|
arr/.style={-{Stealth[length=2.5mm]}, thick, gray!60!black}
|
|
]
|
|
\node[part] (p1) at (0,0) {\textbf{Part I}\\scenarios with numbers};
|
|
\node[part] (p2) at (4.7,0.8) {\textbf{Part II}\\capability profiles};
|
|
\node[part] (p3) at (4.7,-0.8) {\textbf{Part III}\\requirements profiles};
|
|
\node[part] (p4) at (9.4,0) {\textbf{Part IV}\\non-compensatory match};
|
|
\node[res] (adr) at (13.8,0) {\textbf{ADR}\\$+$ measurement contract};
|
|
\draw[arr] (p1) -- (p2); \draw[arr] (p1) -- (p3);
|
|
\draw[arr] (p2) -- (p4); \draw[arr] (p3) -- (p4);
|
|
\draw[arr] (p4) -- (adr);
|
|
\draw[dashed, aiviolet, rounded corners=6pt, line width=0.8pt] (-1.8,-1.6) rectangle (15.6,1.6);
|
|
\node[font=\small\sffamily, text=aiviolet, anchor=north] at (6.9,-1.65) {\textbf{Part V}: nothing about AI, on either axis, changes a single step};
|
|
\end{tikzpicture}%
|
|
}
|
|
\end{center}
|
|
\end{frame}
|
|
|
|
\begin{frame}{The deepest result: one discipline at two binding sites}
|
|
\small One symmetry deserves to be made explicit -- the deepest result of Part V:
|
|
|
|
\vspace{0.15cm}
|
|
\begin{columns}[T]
|
|
\begin{column}{0.48\textwidth}
|
|
\textcolor{bankblue}{\textbf{Axis A concluded}}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{1pt}
|
|
\item \emph{generation} is cheap
|
|
\item \emph{verification} is the bottleneck
|
|
\item so the \textbf{SDLC} must be rebuilt around machine-checkable specifications, guardrails, and human accountability
|
|
\end{itemize}
|
|
\end{column}
|
|
\begin{column}{0.48\textwidth}
|
|
\textcolor{bankblue}{\textbf{Axis B concluded}}
|
|
\footnotesize
|
|
\begin{itemize}\setlength\itemsep{1pt}
|
|
\item \emph{model output} is cheap
|
|
\item \emph{validation} is the bottleneck
|
|
\item so the \textbf{runtime} must be rebuilt around contracts, ontology guards, eval harnesses, and a human-owned determinism boundary
|
|
\end{itemize}
|
|
\end{column}
|
|
\end{columns}
|
|
|
|
\vspace{0.2cm}
|
|
\begin{keypoint}
|
|
\footnotesize These are the \textbf{same conclusion at two different binding sites}: whether the LLM sits in the toolchain or in the product, the discipline it demands is \textbf{containing cheap, fallible generation behind expensive, explicit verification} -- which is, on reflection, what this module has called \emph{architecture} all along.
|
|
\end{keypoint}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Discussion: is it one discipline?}
|
|
\begin{thinkbox}
|
|
\footnotesize Close the module with the symmetry. Consider the artefact pairs across the two axes:
|
|
|
|
\vspace{0.1cm}
|
|
\begin{center}
|
|
\scriptsize
|
|
\begin{tabular}{@{}p{5.6cm}p{6.4cm}@{}}
|
|
\toprule
|
|
\textbf{Axis A artefact} & \textbf{Axis B artefact} \\
|
|
\midrule
|
|
\texttt{AGENTS.md} & the system prompt and ontology \\
|
|
the CI fitness function & the runtime ontology guard \\
|
|
the code-review obligation & the human-oversight duty of the AI Act \\
|
|
the test suite as the agent's operating licence & the eval harness as the model's operating licence \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
|
|
\vspace{0.1cm}
|
|
\begin{itemize}\setlength\itemsep{2pt}
|
|
\item For each pair: is this genuinely \emph{one} engineering discipline observed at two binding sites -- or are there differences of kind, in \textbf{reversibility}, in \textbf{accountability}, in \textbf{failure semantics}, that the symmetry hides?
|
|
\item And if it is one discipline: which parts of this script would survive the next order-of-magnitude improvement in model capability -- and which would you expect to rewrite?
|
|
\end{itemize}
|
|
\end{thinkbox}
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% EXAM ORIENTATION
|
|
% ============================================
|
|
\section{Exam Orientation}
|
|
|
|
\begin{frame}{The written examination -- the facts}
|
|
\begin{block}{Written examination (50\,\%)}
|
|
\begin{itemize}\setlength\itemsep{3pt}
|
|
\item \textbf{50\,\%} of the module grade -- the project is the other 50\,\%
|
|
\item \textbf{End of semester, 60 minutes}
|
|
\item \textbf{Open book:} script and own notes, \emph{on paper}
|
|
\item \textbf{Closed internet}
|
|
\item Focus: \textbf{architecture reasoning -- profiles, matching, trade-offs}
|
|
\item Language: all materials, the script, and the exam in English
|
|
\end{itemize}
|
|
\end{block}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Six learning objectives, five parts}
|
|
\begin{center}
|
|
\scriptsize
|
|
\renewcommand{\arraystretch}{0.85}%
|
|
\begin{tabular}{@{}>{\raggedright\arraybackslash}p{5.4cm}>{\raggedright\arraybackslash}p{7.2cm}@{}}
|
|
\toprule
|
|
\textbf{Learning objective (Lecture 1)} & \textbf{Where the script settles it} \\
|
|
\midrule
|
|
1. explain why architecture selection is a \textbf{matching problem} -- no pattern is good or bad in itself & Part I: A2 everything is a trade-off, A3 quality attributes drive structure; Part II: every rating explained through the tactics a pattern bundles or impedes \\
|
|
2. construct a \textbf{requirements profile} $R(a)$: scenarios with response measures, utility tree, weights & Part I: A4 requirements decide only as measurable scenarios; Part III: ten classes as ASR bundles with response measures and hard constraints $K(a)$ \\
|
|
3. derive the \textbf{capability profile} $C(p)$ of seven patterns from their tactics & Part II: capability profiles, every rating explained by tactics (the consolidated capability table) \\
|
|
4. run the \textbf{three-stage, non-compensatory match} and defend the result & Part IV: knock-out screening, veto rule, holistic ordinal reading; hybrids are the normal case \\
|
|
5. record decisions as \textbf{ADRs} and attach a \textbf{measurement contract} & Part IV: the procedure ends in an ADR, every ADR in a measurement contract -- A5, a decision is a hypothesis tested over the life cycle \\
|
|
6. engineer \textbf{AI components} into a system (Axis B) and use \textbf{AI tools} in the process (Axis A) with the same discipline & Part V: A6 held -- one class, one dimension, five cell shifts, one composition pattern; Axis A raised the value of the artefacts \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{center}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Open book: the map and the four tables}
|
|
\footnotesize
|
|
\textcolor{bankblue}{\textbf{Your map: Maxim 8's one sentence}}
|
|
\begin{center}
|
|
\vspace{-0.1cm}
|
|
\resizebox{0.8\textwidth}{!}{%
|
|
\begin{tikzpicture}[
|
|
sysbox/.style={rectangle, draw, rounded corners=4pt, align=center, font=\small\sffamily, line width=0.8pt, minimum height=1.0cm, minimum width=3.0cm},
|
|
part/.style={sysbox, fill=bankblue!20, draw=bankblue},
|
|
res/.style={sysbox, fill=bankgreen!15, draw=bankgreen},
|
|
arr/.style={-{Stealth[length=2.5mm]}, thick, gray!60!black}
|
|
]
|
|
\node[part] (p1) at (0,0) {\textbf{Part I}\\scenarios with numbers};
|
|
\node[part] (p2) at (4.8,0) {\textbf{Parts II $+$ III}\\capability $+$ requirements profiles};
|
|
\node[part] (p4) at (9.6,0) {\textbf{Part IV}\\non-compensatory match};
|
|
\node[res] (adr) at (13.8,0) {\textbf{ADR}\\$+$ measurement contract};
|
|
\draw[arr] (p1) -- (p2); \draw[arr] (p2) -- (p4); \draw[arr] (p4) -- (adr);
|
|
\node[font=\small\sffamily, text=aiviolet, anchor=north] at (6.9,-0.65) {\textbf{Part V}: AI changes no step of it};
|
|
\end{tikzpicture}%
|
|
}
|
|
\end{center}
|
|
|
|
\vspace{-0.05cm}
|
|
\begin{columns}[T]
|
|
\begin{column}{0.48\textwidth}
|
|
\textcolor{bankblue}{\textbf{The four tables the argument runs on}}
|
|
\begin{itemize}\setlength\itemsep{0pt}
|
|
\item the \textbf{twelve dimensions} (Part I)
|
|
\item the \textbf{consolidated capability table} (Part II)
|
|
\item the \textbf{requirements table} of the ten classes (Part III)
|
|
\item the \textbf{$7 \times 10$ fit matrix} (Part IV)
|
|
\end{itemize}
|
|
\end{column}
|
|
\begin{column}{0.48\textwidth}
|
|
\textcolor{bankblue}{\textbf{Part V's additions}}
|
|
\begin{itemize}\setlength\itemsep{0pt}
|
|
\item the \textbf{D12 row with rationales}; the \textbf{agent capability-profile sketch}; the \textbf{task-signature table}; the \textbf{OWASP table}
|
|
\end{itemize}
|
|
\textcolor{bankblue}{\textbf{The spine}}: the six load-bearing assumptions \textbf{A1--A6} -- and the Maxims, up to Maxim 8
|
|
\end{column}
|
|
\end{columns}
|
|
|
|
\vspace{0.1cm}
|
|
Focus (Lecture 1): \textbf{architecture reasoning -- profiles, matching, trade-offs}; in the words of the Section 43 key concept: \emph{name, for any cell movement, the quality-attribute mechanism behind it}.
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% CLOSING
|
|
% ============================================
|
|
\section{Closing}
|
|
|
|
\begin{frame}{This week's exercise: M5 closes -- harness, guard, cost observability}
|
|
\begin{projektbox}
|
|
\footnotesize Week 13 of \textbf{M5 -- Multi-Agent Orchestration, Evaluation, and Hardening}; coaching session (1 lesson):
|
|
\begin{enumerate}\setlength\itemsep{1pt}
|
|
\item \textbf{Evaluation harness as a CI gate}; report accuracy and failure modes
|
|
\item \textbf{Observability} of token cost and latency per request
|
|
\item \textbf{Threat model} incl.\ prompt injection via news (today's Section 42.6: the OWASP table as your checklist; the same-channel rule) $+$ \textbf{basic hardening}
|
|
\item \textbf{Scaling/optimisation}: caching, batching
|
|
\end{enumerate}
|
|
\textbf{Optional distinction work} (semester plan: \emph{K\"ur}): autonomous planning, self-repair, model routing, CI/CD, tracing -- every topology escalation justified against the task-signature table and priced per the default rule.
|
|
|
|
\vspace{0.1cm}
|
|
\textbf{Milestone M5: eval harness in CI $+$ guard $+$ cost observability.} Keep the deterministic core free of LLM calls -- this is the line that is graded.
|
|
\end{projektbox}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Summary}
|
|
\footnotesize
|
|
\begin{enumerate}\setlength\itemsep{2pt}
|
|
\item \textbf{OWASP LLM Top 10}: prompt injection cannot be solved in the model (same channel) -- defence in depth at the system level; \emph{the architecture, not the model, is the trust boundary}
|
|
\item \textbf{EU AI Act}: quality attributes with legal force enter $R(a)$ as hard constraints $K(a)$, never weights -- compliance is the same architecture, documented
|
|
\item \textbf{C10 row and five shifts}: boundary/port, queue and capped cells; EDA/PF $\uparrow$, HX $\uparrow$ most, MS $\downarrow$ in synchronous chains, SL conditional, cost load-bearing -- the matrix is \emph{shifted}, not rewritten; MLOps level $=$ how much of D9/D12 a team can cash in
|
|
\item \textbf{Agent orchestration} is a composition pattern, not a style: agent $=$ loop $+$ tools $+$ state; workflows vs.\ agents; topologies map onto PF, mediator EDA, broker, control loop
|
|
\item \textbf{Economics and profile}: 90.2\,\% at $\sim$15$\times$ tokens is a CBAM decision; $--$ on D3/D4/D9/D10 makes it an edge pattern -- workflows before agents, every escalation an ADR with token budget and eval threshold (Maxim 6)
|
|
\item \textbf{Maxim 8}: the theory absorbs AI -- same assumptions, same procedure, same contract; one discipline at two binding sites: containing cheap, fallible generation behind expensive, explicit verification
|
|
\end{enumerate}
|
|
\end{frame}
|
|
|
|
\begin{frame}{Next week}
|
|
\begin{columns}[T]
|
|
\begin{column}{0.55\textwidth}
|
|
\textcolor{bankblue}{\textbf{Week 14 -- synthesis, presentations, defence}}
|
|
\begin{itemize}\small
|
|
\item one lesson synthesis and exam hints: a \textbf{recap of today's synthesis and exam orientation plus Q\&A} -- \emph{no new material}
|
|
\item three lessons final presentations, architecture defence and peer reviews (deliverable A3, milestone M6)
|
|
\item present the system and \textbf{defend your architectural trade-offs}; reflect on where AI helped and where it hurt -- in building (A) and in the system (B)
|
|
\item then the written examination (open book, 60 min)
|
|
\end{itemize}
|
|
\end{column}
|
|
\begin{column}{0.42\textwidth}
|
|
\textcolor{bankblue}{\textbf{Reading}}
|
|
\begin{itemize}\small
|
|
\item this week: Part V, Sections 42.6--42.7, 43--45
|
|
\item ahead: \textbf{the whole script, Parts I--V} -- the four tables and Maxim 8's one sentence as the map
|
|
\end{itemize}
|
|
|
|
\vspace{0.2cm}
|
|
\textcolor{bankblue}{\textbf{Exercise / deliverable}}
|
|
\begin{itemize}\small
|
|
\item M5 closes this week: eval harness in CI $+$ guard $+$ cost observability; threat model $+$ hardening; optional distinction work
|
|
\item \textbf{A3: final presentation with architecture defence, week 14}
|
|
\end{itemize}
|
|
\end{column}
|
|
\end{columns}
|
|
\end{frame}
|
|
|
|
% ============================================
|
|
% END
|
|
% ============================================
|
|
\FHGRClosingPage[][{\color{white}\parbox{0.9\paperwidth}{\centering Thank you!\\[3ex]
|
|
{\normalsize\mdseries Dr.\ Florian Herzog\\[0.9ex]
|
|
Fachhochschule Graub\"unden, Chur\\[2.4ex]
|
|
{\small AISE502 -- AI in Software Engineering II}}}}]
|
|
|
|
\end{document}
|