trust_boundary

ArchiMate / Open Group Equivalent: Grouping / Security Perimeter Plateau (Security Architecture Aspect)

Represents a security zone, network perimeter, execution sandbox, or logical boundary where data and interactions transition between trust levels.

Visual Styling

To customize the visual border, dash style, or fill color of trust boundaries, use a Style Rule (e.g. style trust_boundary where boundary_type == "DMZ" { custom_css "stroke-dasharray: 4 2; stroke: #f59e0b;" }).

---

Syntax

trust_boundary <id> "<Display Name>" {
    description "<text>"
    owner "<team>"
    tags ["tag1", "tag2"]
    boundary_type "Network" | "Process" | "Machine" | "Data" | "Zone" | "Cloud" | "DMZ" | "System" | "Logical"
    trust_level "<level_string>"

    relationships { ... }
}

---

Properties

Property	Type	Allowed Values	Description
description	string	Free text	Explanation of security controls guarding the perimeter
owner	string	Free text	Network or security operations owner
tags	string[]	Array of strings	Categorization tags
boundary_type	enum	"Network", "Process", "Machine", "Data", "Zone", "Cloud", "DMZ", "System", "Logical"	Perimeter classification
trust_level	string	e.g. "Untrusted", "DMZ", "Internal Protected", "PCI Scoped"	Trust level ranking

---

Allowed Relationship Verbs & Targets

Verb	ArchiMate / Security Relation	Allowed Target Entity Types
encloses	Grouping / Containment	actor, process, system, app, component, infrastructure, data_object, agent, trust_boundary
protects	Protection	system, app, component, infrastructure, data_object, agent
governed_by	Governance	policy, standard

---

Complete Example

trust_boundary zone_pci_cde "PCI Cardholder Data Environment (CDE)" {
    description "Isolated network segment strictly guarded via Next-Gen Firewalls"
    boundary_type "Network"
    trust_level "PCI Scoped (High)"
    tags ["cde", "pci", "zero-trust"]

    relationships {
        this encloses sys_payment_gateway "Encloses tokenization workloads"
        this encloses infra_aurora_db "Encloses vaulted databases"
        this governed_by pol_pci_network_segmentation
    }
}