The boundary grew and nobody updated the sentence

In March the platform got a second region, because a customer in Frankfurt asked for one. In June a second product shipped, on its own infrastructure, built by two people who joined in April. In August four contractors were given production access for a migration, and three of them still have it.

The boundary statement is the same four lines it was in January. Nobody changed it, because nobody thought of it as a thing that could go out of date.

Predict

Four things arrived during the year. Which one is most likely to be inside your boundary already, with nobody having decided it should be?

Choose one answer

The second region of the existing platformThe second product, on its own infrastructureThe four contractors with production accessThe analytics tool that now receives customer events

Lock in answer

Four numbers and one question

Re-count four things as they stand today, not as the statement describes them.

Systems inside the line. Count regions, clusters and replicas separately, because a reviewer sampling evidence will. The figure that matters is not how many services you have; it is how many distinct things a control has to cover.

People who can reach them. Not headcount. The number of human accounts with a path to customer data, counted from the systems rather than from the staff directory.

Contractors and anybody else not on payroll. Counted separately on purpose, because they enter by function and leave by nothing.

Companies inside your boundary. The ones whose failure is indistinguishable from yours, as opposed to the ones who merely invoice you.

Then the one question that catches whatever the four numbers missed: which team shipped something this year that has never read the boundary statement? That is the honest answer to where the next surprise is, and it is the condition under which the rest of this lesson stops working — a system added by people who have not read the sentence cannot be caught by re-reading the sentence.

Write what is inside the line today, in the words you would use out loud to the customer in Frankfurt.

Your own register

Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.

What is inside the line?

One or two sentences, in your own words. The test is whether you would read it out to a customer.

Save the boundary

What the referee can and cannot see here

Now the part that is worth more than the exercise.

The engine has just read your boundary and found nothing to say about it. That is not a gap in the tool. It is the most important limitation in this whole subject, and a lesson about re-counting the boundary is the right place to say it out loud: the decision with the largest effect on your cost and your credibility is the one nothing in here can check.

Two things that would contradict a boundary are invisible to any engine. A system inside the line that your sentence covers and your register has never heard of — the engine cannot know it exists. And a system your sentence excludes that is actually load-bearing for the thing you included — the engine has no map of your architecture.

What it can see is the downstream wreckage, which is why the findings below are about controls rather than about scope.

What does not line up

What a wider line does to the controls you already declared

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

Read those with the new count in your hand. A control marked running with nothing attached was already a contradiction; with a second region inside the line it is a contradiction about twice as much. A control whose evidence is one artefact from one system was a thin claim in January and is a thinner one now, and nothing about it changed except the size of the set it is claiming to cover.

That is the shape of boundary drift: no finding ever says the boundary grew. Every finding says a control covers less than it is claimed to cover, and the reason is always the same thing nobody wrote down.

Check

You re-count and find the second region has been inside the line since March. What is the honest thing to do about the period you are currently claiming?

Choose one answer

Nothing. The controls are the same controls, applied to one more regionCollect the missing evidence for the new region now and date it todaySay when each system came inside the line, and which evidence predates which arrivalNarrow the statement so the second region is explicitly outside it

Check answer

Worth remembering

• A boundary statement is a membership rule, not an inventory, and it keeps deciding after you stop reading it.
• Things that match your existing wording join the boundary silently; things with new names get a conversation.
• Re-count systems, human accounts with a path to the data, non-payroll people, and companies inside the line.
• The surprise is usually a team that shipped something without ever reading the boundary statement.
• No engine can check a boundary; it can only show controls covering less than they are claimed to cover.
• Record when each system came inside the line, so earlier evidence stays an accurate claim about a smaller set.