What the Boundary Model is

A runtime‑focused theory of jurisdiction, ownership, and lifecycle across SAP BTP extensions. It is used to produce verdicts on what must change vs what must not change.

Six boundaries

• Runtime — where behavior executes; where assumptions fail first.
• Identity — propagation of identity and authorization context across layers.
• Tenant — routing and isolation expectations versus runtime truth.
• Data — ownership, integrity, and truth enforced during execution.
• Integration — cross‑system jurisdiction after connectivity is established.
• Lifecycle — upgrades, rollout rules, and the stability window over time.

Why traditional reviews miss these failures

Traditional design reviews stabilize diagrams, not runtime boundaries. Failures surface months later when tenants diverge, trust or routing shifts, or lifecycle controls change ownership. Post‑go‑live reality exposes boundary drift, not feature gaps.

When this model matters

• Symptoms vary by tenant or entry surface; runtime behavior diverges.
• Ownership is fragmented and no single team can issue a decision.
• Fixes imply changing trust, subdomains, destinations, roles, or routing.