Core Concepts

Overview

Polaris distinguishes between Technologies (governed strategic choices) and Components (actual software artifacts in use).

Technology

A Technology is a governed software entity that requires architectural approval, lifecycle management, and version constraint compliance.

Characteristics

• Strategic architectural decision with long-term impact
• Requires approval through governance processes
• Subject to enterprise version constraints and standards
• Managed through TIME framework (invest, migrate, tolerate, eliminate)
• Has version constraints and security oversight
• One team stewards each technology

Technology Types

Technology types use the CycloneDX ComponentType values:

1. application — Standalone software applications (e.g., Keycloak, Grafana)
2. framework — Application frameworks (e.g., React, Vue, Spring Boot, Express)
3. library — Reusable code libraries (e.g., Lodash, TypeScript)
4. container — Container runtimes and images (e.g., Docker)
5. platform — Runtimes, databases, and infrastructure platforms (e.g., Node.js, PostgreSQL, Redis, Kubernetes)
6. operating-system — Operating systems (e.g., Alpine Linux, Ubuntu)
7. device — Hardware devices
8. device-driver — Device drivers
9. firmware — Firmware
10. file — Standalone files
11. machine-learning-model — ML models
12. data — Data assets

Technology Domains

Domains classify technologies by the architectural concern they serve:

1. foundational-runtime — Core execution environments (e.g., Node.js, JVM, .NET, Python)
2. framework — Application frameworks (e.g., React, Vue, Spring Boot, Express)
3. data-platform — Databases and data storage (e.g., PostgreSQL, Neo4j, Redis, MongoDB)
4. integration-platform — Messaging and integration (e.g., Kafka, RabbitMQ, GraphQL, gRPC)
5. security-identity — Authentication, authorization, and security (e.g., OAuth2, Keycloak, Vault)
6. infrastructure — Deployment and infrastructure (e.g., Docker, Kubernetes, Terraform)
7. observability — Monitoring and observability (e.g., Prometheus, Grafana, OpenTelemetry)
8. developer-tooling — Build tools, linters, and dev utilities (e.g., ESLint, Webpack, TypeScript)
9. other — Technologies that don't fit other domains

Component

A Component is a software artifact discovered in systems through SBOM (Software Bill of Materials) scanning.

Characteristics

• Concrete software package or dependency
• Discovered through automated scanning
• May or may not map to a governed Technology
• Includes transitive dependencies
• Tracked for compliance, security, and licensing
• Used in one or more systems

Technology vs Component

Workflow

1. Governance Decision — Architecture team approves a Technology (e.g., React)
2. Team Approval — Individual teams approve the Technology for their use
3. Implementation — Developers use Components that implement that Technology (e.g., [email protected])
4. Discovery — SBOM scanning discovers Components in Systems
5. Compliance Check — Components are validated against approved Technologies
6. Violation Detection — Components without corresponding Technology approval are flagged

Key Takeaways

• Technologies are strategic decisions — They require governance approval and have enterprise-wide impact
• Components are implementation details — They are discovered through scanning and tracked for compliance
• Not all components map to technologies — Transitive dependencies may not require governance
• Compliance is automatic — The system validates components against approved technologies
• Violations are actionable — Teams must either approve the technology or stop using it