About the Author

Who made this book

Conceived, directed and published by Gunnar Nordqvist. The text was written by AI agents under his briefs and was reviewed and approved by him. He is not the author of the book in the ordinary sense of the word.

In plain words, the two parties did different things. Gunnar Nordqvist's part was the subject, the table of contents, the brief for every chapter, the author persona and the style rules, and then the review of every change, the approval of what was published and the responsibility for the result. The agents' part was drafting the prose, running the checks and formatting the book. Elsewhere in this book, "the author" means Gunnar Nordqvist in that role: the person who conceived, directed, approved and answers for the book, not the person who typed its sentences.

This book, like the other volumes of The Transformed Architecture, Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss and AI Blue, draws on decades of practice at the intersection of enterprise architecture, infrastructure engineering, information security, and organisational change. It is directed from the perspective of a practitioner who has watched architecture move from documents to code and who has applied the same discipline to artificial intelligence and, in this book, to the way the teams that attack in order to test and the teams that defend learn together when AI joins the loop between them, in large European organisations.

Gunnar Nordqvist

Gunnar Nordqvist is a self-employed certified Chief Architect and IT Architect consultant in the Kvadrat network, a Swedish consultancy network of independent specialists (95, Kvadrat, n.d.). As an IT generalist with a deep interest in technology, Gunnar has worked across diverse roles throughout his career, including IT architect, technical project manager, and systems technician.

Professional background

Gunnar's experience spans solution and enterprise architecture, IT infrastructure, and information security engagements for large enterprises and public authorities. His technical background encompasses network solutions, servers, virtualisation, cloud platforms, and IT security, and in recent years the architecture of data platforms and AI-enabled services in regulated settings.

Core areas of expertise:

• Solution and enterprise architecture
• Architecture as Code and Infrastructure as Code
• AI Architecture, model governance, and the European regulatory framework
• IT security, risk management, and compliance
• Cloud architecture, virtualisation, and digital sovereignty
• DevOps, CI/CD automation, and platform engineering

From Architecture as Code to AI Purple

Architecture as Code argued that architecture becomes trustworthy when it is codified, version-controlled, and continuously validated (87, Nordqvist, 2025). AI Governance applied that argument to the risk, governance, and assurance of AI (88, Nordqvist, 2026), AI Platform and Security to the platforms that run AI and the security that protects them (89, Nordqvist, 2026), AI Red Team to AI as an active part of cyber defence (90, Nordqvist, 2026), AI Threat to the question whether the dystopias of science fiction are coming true (91, Nordqvist, 2026), The Transformed Security Architect to the role of the person who designs the boundaries on which those volumes depend (92, Nordqvist, 2026), AI Boss to the management of people when AI takes part in it (93, Nordqvist, 2026), and AI Blue to the team that does the defending (94, Nordqvist, 2026). This book joins the two sides of cyber defence and asks how red and blue learn together when AI joins the loop between them. The systems that now emulate adversaries, generate detections and in places act on what they find are systems of the kind the earlier volumes taught architects to build, procure and govern, and an architect who helps to introduce them shares the responsibility for what they do to the people who work beside them. The conviction behind all nine volumes is the same: that systems of consequence deserve engineering rigour, that governance works best when it is executable, and that accountable human judgement is what remains when everything else can be automated. In this book the conviction takes a practical form: a joint exercise needs a named human who can answer for it, and a stop path that does not run inside the system it stops.

About Kvadrat

Gunnar Nordqvist works as an independent consultant through Kvadrat, which describes itself as Sweden's largest network of self-employed consultants and has offices across Sweden (95, Kvadrat, n.d.).

Swedish terminology reference

Terminology note: The Swedish names used in this section keep their native form to preserve accuracy.

• Kvadrat AB – AB stands for aktiebolag, Sweden's equivalent of a limited company. The firm's name translates literally to "square" but is always written as Kvadrat in branding.
• Nordqvist – A Swedish family name combining nord ("north") and qvist ("twig"), reflecting traditional Swedish surname construction.

How this book was made

The name on the cover is that of the person who conceived, directs and answers for the book, not of its writer in the ordinary sense. From AI Governance onwards, the books in this series have been made differently from the way books are usually written. Most of the prose in this book was drafted by a team of specialist AI agents, each configured for a single role: a writer that drafts sections against a chapter brief, a researcher that locates and checks sources, an editor that applies the style guide, a critic that probes arguments for weaknesses, an architect that validates technical claims, and a graphic designer that produces the diagrams. Gunnar Nordqvist's part is less that of a writer at the desk than that of a conductor: setting the score, deciding who plays what, listening, stopping the orchestra and asking for a passage again.

The division of labour does not divide the responsibility. Four things remain the author's, and they are what a reader is entitled to hold a person to account for:

• The design of the book. The choice of subject, the table of contents, the brief for every chapter, the author persona, the style guide and the rules the agents work under are written by the author and kept in the repository alongside the manuscript.
• Review and approval. Every change reaches the manuscript through a pull request that the author reads and then redirects, rejects or approves. Nothing is published that the author has not accepted.
• Judgement. The positions the book takes, its recommendations and its projections are the author's, including the passages written in the first person, even where an agent found the words for them.
• Sources. The author answers for the bibliography. Automated checks confirm that every citation points to an entry that exists; the author checks, by sampling where the volume requires it, that the sources say what the text claims. Errors that remain are the author's, not the agents'.

The arrangement is also an instance of the subject of this book: a person conducting an AI team, what The Transformed Security Architect called Shift 4, from sole author to conductor of an AI team (92, Nordqvist, 2026). The author directs the agents under written briefs and the agents draft; the author decides. None of the agents manages a person, and none of them decides anything about one. The habit on which Architecture as Code (Chapter 27) closes, a traceable human rationale for every AI-assisted decision (87, Nordqvist, 2025), applies here with full force, and it raises a question that the later volumes took up: how is AI-proposed change reviewed for soundness when the reviewer depends on the AI? The author's answer is partial and is offered as such. The briefs are written before the agents draft, a separate critic is set against the drafts, and every change waits for the author's approval. That is a fair question for the reader to put to this book.

The book's technical foundation

All nine volumes are produced with the same automated publishing pipeline: Markdown manuscript, Mermaid diagrams, Pandoc and XeLaTeX for PDF, EPUB, and DOCX, MkDocs for the website, and GitHub Actions for continuous validation. The pipeline is itself an example of Architecture as Code applied to publishing, and its structure is described in the repository documentation.