Trustworthiness and assurance
AIRA provides Trustworthiness and assurance (T&A) domains as an architectural lens for analysing AI systems. These domains help agencies consider how trustworthiness, risk and assurance concerns manifest across system components, dependencies, information flows and operational arrangements. While this differs from the Australian AI Ethics Principles used throughout the Policy for the Responsible Use of AI in Government and the AI Impact Assessment Tool (IAT), the intent is complementary rather than alternative. The Ethics Principles provide a governance perspective on the outcomes government expects agencies to achieve, while the T&A domains provide an architectural perspective on the system characteristics that support and demonstrate those outcomes.
Observability
Observability is the ability to continuously understand the internal state, behaviour and performance of a system through its externally observable signals (NIST, 2023).This includes the capability to generate, export, collect, store, correlate, analyse and visualise telemetry across the AI system lifecycle. It encompasses instrumentation across the functional stack, including collector and processing pipelines for traces, metrics and logs, as well as backend platforms for retention and query, and frontend tools for dashboards to support incident investigation, assurance and operational insight. Observability can enable drift detection, unintended consequences, emergent failure modes and timely governed intervention before issues escalate.
Traceability
Traceability is the ability to track and verify the provenance, ownership, processing history and outputs of AI models, data and pipelines across their full lifecycle. It protects intellectual property, detects misuse and supports reproducible, contestable and auditable AI systems (ETSI TR 104 032, 2024). This domain provides architectural guidance for areas such as detecting authenticity, tracing model origin and standards for data traceability including versioning, lineage and provenance of training, validation, test and inference data. It also includes attribution of automated and human-assisted decisions, long-term preservation of AI systems and the ability to reliably roll back models, data, configurations and decision logic to a known prior state when errors, drift or harm are detected.
Where AI outputs contribute to decisions, recommendations or actions affecting individuals, architecture can help agencies maintain evidence and traceability to support review, audit and contestability.
Explainability and interpretability
Explainability refers to a representation of the mechanisms underlying AI systems’ operation, whereas interpretability refers to the meaning of AI systems’ output in the context of their designed functional purposes (NIST, 2023). Architectural patterns include pre-modelling, modelling and post-modelling techniques for model explainability, long-term interpretability and user experience patterns.
Validity and reliability
Validity and reliability are system‑level trustworthiness properties that ensure AI systems are fit for purpose and behave predictably over time. Validity refers to the extent an AI system performs its required functions. Reliability refers to its ability to perform its required functions under stated conditions for a specific period (ISO/IEC 2289, 2022).
The validity of an AI system is largely shaped by the data used to develop it. This means designing and documenting the assumptions that govern data collection and preparation. AIRA can provide guidance on target population specification, as well as the conditions, edge cases and classifications the data is intended to cover and the expected proportions to be represented. It can also provide guidance on capturing data provenance and lineage from acquisition and assessing data representativeness against the system’s objectives and target operating population.
AIRA acknowledges that model-training techniques improve reliability. For example, data augmentation, adversarial training, regularisation, ensemble method and cross-validation averaging. To ensure system dependability does not solely rely on the AI model being correct, AIRA focuses on building dependable systems around imperfect models. It will cover patterns such as confidence and abstention handling, fallback pathways, input and output validation, redundancy, hybrid approaches and arbitration.
Safety
Safety is the property of a system that, under defined conditions, does not lead to a state in which human life, health, property or the environment are endangered (ISO/IEC TS 5723, 2022). This domain provides guidance and patterns to prevent, detect and minimise harm and its impacts, including input and output validation, redundancies, circuit breakers, rate limiting, fail-safes, cross-validation, fault recovery and graceful degradation without corrupting the system.
Fairness
Fairness in AI incorporates equality and equity, addressing issues such as harmful bias, discrimination and unequal access to AI-enabled services (NIST, 2023). This domain provides guidance and patterns on bias identification, measurement and mitigation across data, models, workflows and user experiences. It also includes designing for equitable access and inclusion across different user contexts, such as age-based experience, cultural adaptation, reading-level adaptation, multilingual support, compatibility with assistive technologies, prioritised access for people with greater need and usable experiences in offline or low-bandwidth environments.
Sustainability
Sustainability refers to the ability of AI systems to be designed, deployed and operated in ways that are environmentally responsible, operationally viable and institutionally maintainable over time. This includes choices that influence energy and resource consumption, cost and operational efficiency, system longevity, model replaceability and the capacity of agencies to safely manage, adapt and retire AI systems as technologies and requirements evolve. It also includes consideration of sovereignty, operational dependence, critical technology dependencies, vendor concentration and the ability to substitute key technologies and services over time.
Sustainability does not imply that every system and every part of a system should be under full control of the agency. Rather, sustainability can be improved when the level of control across the architecture is understood, deliberate and recorded as an architectural decision. This includes assessing the sensitivity and criticality of the workload or system, identifying the consequences of dependence on external providers across the architecture, and evaluating the controls available to manage those consequences. Sustainability is a system‑level trustworthiness property, embedded across AIRA rather than addressed through post‑hoc controls.
Security and resilience
Security protects the confidentiality, integrity and availability of data and systems through defence‑in‑depth, least‑privilege access and continuous monitoring. Resilience is the ability of the system to recover operational conditions quickly following an incident (ISO/IEC 22989, 2022). This includes patterns to anticipate, adapt, resist or recover from a potentially disruptive event.
Security and resilience considerations apply across the AI lifecycle and the architecture. For example, attack surface includes training and evaluation data, models, retrieval mechanisms, prompts, identities, communication pathways, agents, external services and infrastructure dependencies. Threat actors may exploit these surfaces through techniques including adversarial machine learning, model and data poisoning, prompt injection, retrieval manipulation, identity abuse, agent compromise and AI-assisted cyber threats.
Architectural controls help agencies identify trust boundaries, enforce least privilege, constrain agent and tool actions, protect data and model assets, monitor system behaviour, detect anomalous activity and recover safely when controls fail.
AIRA will defer to existing guidance, where available.
Privacy
Privacy considerations apply across the AI life cycle and the architecture. Personal, sensitive and person-linked information may be present in training data, evaluation data, retrieval sources, prompts, model outputs, logs, user profiles, interaction history and agent memory. Privacy risks can emerge through inappropriate collection, use, disclosure, retention, secondary use beyond the original purpose of collection, as well as through techniques such as membership inference, model inversion, data reconstruction, re-identification of de-identified data, unintended regurgitation of sensitive information, prompt leakage or excessive retention.
Architectural controls help agencies implement privacy-by-design principles. This includes patterns for data minimisation, purpose limitation, consent and authority management, role-based access controls, disclosure boundaries, retention and disposal controls, privacy-enhancing technologies and mechanisms for human oversight. Architecture can also help agencies understand how personal information flows across components, systems, agencies, vendors and jurisdictions, and identify where additional safeguards may be required.