$2.5 million in year-one architectural debt follows every federal AI submission that treats an agentic system like a web application.

By Michelle Buckner

There is a moment every federal security architect dreads. The assessor is sitting across the table, the authority to operate package is open, and she asks a question nobody prepared for: “Show me where your AI model’s training data crosses the boundary.”

Most teams cannot answer it. The answer exists. Nobody drew it.

Federal authorization has always lived or died on the diagram. The Enterprise Mission Assurance Support Service (eMASS), the system of record for Department of Defense Risk Management Framework packages, requires architects to document every data flow, every trust boundary, and every external dependency before an assessor will touch the controls. For twenty years, that meant drawing a box around your application, another box around your database, and arrows between them. Assessors understood the picture. Programs got their authorization. AI broke the picture.

A modern AI architecture is not a web application with a clever frontend. It is a probabilistic pipeline where training data, model weights, inference endpoints, orchestration layers, and feedback loops all move across boundaries that a standard cloud diagram never captures. When a defense contractor adds a retrieval-augmented generation system to a Controlled Unclassified Information (CUI) handling application, they are adding three new storage types, a cross-boundary data retrieval mechanism, and a trust relationship between the application and a model that may live in a completely different authorization boundary. None of that shows up in the diagram they submitted.

The new architectures making this worse are the agentic ones. Model Context Protocol (MCP) systems, the connective tissue behind today’s AI agents, create host-client-server relationships where a single agent can call external tools, retrieve private data, and loop back through a reasoning engine multiple times before producing an output. Each hop is a potential boundary crossing. Each boundary crossing that does not appear in the authorization diagram is an undocumented attack surface. Each undocumented attack surface is a liability the program owns whether or not the assessor finds it.

The assessor is not going away. The question she is going to ask is getting harder. The answer has to be in the diagram before she walks in the room.

The Financial Consequences Of An Undocumented AI Boundary

Six-month authorization delay for a ten-person development team: roughly $1.5 million in sunk labor before the application touches a single user.

Category I finding from an undocumented external inference endpoint: stop-work order at $20,000 per day.

Retrofitting model observability tools into a finished AI stack: three times the cost of architecting them in from the start.

These are the standard outcome when teams treat the authorization diagram as a paperwork exercise rather than a financial instrument.

About The Author

Michelle Buckner is a former NASA Information System Security Officer and GRC leader with 25 years in cybersecurity. She writes about AI risk, DevSecOps, and the federal technology market.