Focus

Software Architecture

Articles, podcasts, talks, and more about Software Architecture.
Blog Post

Stop Using Bearer Tokens Like House Keys

You’ve built an API. You protected it with OAuth 2.0. You’re using JWTs. You feel secure. You’re not.

Blog Post

Indecent Exposure

I noticed a trend in recent years where teams first create APIs for their Single Page Application (SPA) and then offer the same endpoints to other teams for systems integration. In my opinion that is a bad practice and you should think twice before you do that. In this blog post I will explain why.

Blog Post

What ECST Events, Domain Events, and ECST Really Are

Clarifying terms, resolving misunderstandings

Blog Post

OpenProject: A Real Alternative to Jira?

In his article “Using Jira Data Center with AI Features”, my colleague Nicolas Inden showed how to connect a self-hosted Jira instance with an AI model. One point stands out: Atlassian will only support Jira Data Center until early 2029. After that, support ends. Sales of Data Center licenses to new customers were already discontinued at the end of March 2026. So what do we do if we don’t want to return to Jira Cloud after 2029 - or want to move away from Jira right now?

Blog Post

RAG and Fine-Tuning

Large Language Models (LLMs) don’t always produce reliable results. In practice, one thing becomes clear: combining Retrieval Augmented Generation (RAG) and fine-tuning can make them more robust. This post explains how the two approaches complement each other – and why a production feedback loop is critical.

Blog Post

Nebu: Self-made sovereignty

How I’m building an enterprise chat server with agentic development that simply doesn’t exist.

Blog Post

The right size of a Data Product

Setting the boundaries of data products incorrectly can lead to integration issues, unclear ownership and duplicated logic. This guide offers practical heuristics for creating data products of the right size.

Blog Post

Neuland reloaded

When Angela Merkel said in 2013 that the internet is ‘Neuland’ (uncharted territory) for all of us, the amusement online was considerable. Viewed from some temporal and substantive distance, one can now recognize a perspective from which she was indeed correct.

Blog Post

Spec-Driven Architecture: When Agents Build, Architecture Must Speak

SDD describes how a system is built. SDA describes how systems fit together

Blog Post

Your Database Table is an awful API

A shared database table can feel like the ultimate shortcut: no API design, no contracts - just a schema. The catch is that this convenience quietly turns into friction: it blurs boundaries, slows change, and makes independent evolution harder than it needs to be. This article looks at why tables (and data-model-shaped “generated APIs”) are such a tempting trap - and what better integration boundaries look like.

Blog Post

Leave It Better Than You Found It

Leave your code better than you found it. This advice, also known as the Scout Rule, sounds so simple, but what does it look like in practice? This is the story of how I followed the advice and cleaned up a fat controller along the way, and how this unexpectedly enabled us to handle new requirements quickly and with minimal effort. It’s a lesson in habits and continuous architecture.

Blog Post

Why not scatter @Transactional everywhere?
Blog Post

Managing Geopolitical Risks with Enterprise Architecture

IT leaders in Europe increasingly face questions about whether geopolitical developments – such as data protection disputes or trade conflicts between the EU and the US – threaten the viability of US cloud services. The risks range from price increases and legal uncertainties to potential usage restrictions. CIOs must not only ensure functional IT operations but also proactively assess external risks. This article demonstrates how enterprise architecture methods can help identify risks early and develop viable alternatives.

Blog Post

The Path to Heterogeneous Cloud Platforms

Digital transformation brings both challenges and opportunities for businesses. To create future-proof and flexible IT infrastructures, more and more companies are adopting multi-cloud or hybrid cloud strategies. This isn’t just about cost reduction, but also about aligning innovative services from different providers with regulatory requirements - particularly in the area of data protection. This article shows how targeted integration strategies can help you leverage the benefits of multi-cloud to optimize your existing infrastructure, reduce technical dependencies, and ensure long-term business success.

Blog Post

Achieving Digital Sovereignty with Standard Software
Blog Post

A Governance Framework for Digital Sovereignty

In an increasingly connected world where digital infrastructure forms the backbone of our economy and society, the topic of digital sovereignty is gaining more and more attention. For decision-makers in German-speaking countries, this goes far beyond merely selecting a cloud provider. It’s about strategic agency, resilience, and the ability to actively shape one’s digital future. This article explores how a robust governance methodology can help organizations not only understand digital sovereignty but also put it into practice—without sacrificing convenience or innovation.

Blog Post

Digital Sovereignty: Why Architecture Matters and How to Make Your Company Resilient

In an era where digital systems form the backbone of our economy and society, control over one’s digital future is increasingly becoming the focus of strategic decisions. For many technology decision-makers in German-speaking regions, this is not just a political or regulatory challenge, but a fundamental task with far-reaching implications for software architecture work.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Practical Considerations & Recommendations
Blog Post

From Data Graveyards to Knowledge Landscapes

Europe is sitting on a wealth of public data—but much of its potential remains untapped. The challenges are well known: fragmented portals, incompatible interfaces, and growing reliance on non-European platforms that slow innovation. While new industrial data spaces are emerging—enabling secure and sovereign exchange of sensitive information—public and industrial data ecosystems remain largely siloed. This article explores how Artificial Intelligence (AI) and the Model Context Protocol (MCP) can help bridge that gap and accelerate Europe’s shift from Open Data to Open Knowledge—supporting digital sovereignty and delivering greater value to society.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Decision Dimensions for Authorization Patterns

Choosing the right patterns is critical, as it directly impacts the system’s security posture, performance, scalability, and maintainability.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Identity Propagation Patterns
Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Authentication Patterns

Without knowing who the subject is, without verifying its identity, there is only a limited way to perform meaningful access decisions.

Blog Post

What’s Wrong with the Current OWASP Microservice Security Cheat Sheet?

Modern microservice architectures require evolving security practices. Yet popular resources like the OWASP Microservice Security Cheat Sheet are starting to show their age and need a fresh look.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Core Concepts
Blog Post

Technical and other Debt in IT Systems

This article explores the many hidden forms of technical debt that silently slow down IT teams—far beyond just messy code.

Blog Post

Updating OWASP’s Microservice Security Cheat Sheet: Authorization Patterns

Authorization patterns explain how distributed systems organize their access control — where and how decisions happen, where policies live — and influence, in turn, how identities and related attributes travel between components.

Blog Post

Don’t Forget the People

When Architectural Changes Become a Change Project

Blog Post

Socio-Technical Architectures: Informality from Mining to Today

Informal structures are hard to spot – but they can make or break a technical solution. Sociotechnical systems show why that matters, and what mining has to do with building apps.

Blog Post

How Much Thinking Can a Team Handle?

The term Cognitive Load has become a common reference point in recent discussions about team structures, roles, and task distribution in IT organizations. However, these discussions often fail to distinguish between the different purposes of IT organizations and frequently rely on an oversimplified concept of Cognitive Load.

Blog Post

Enabling Stakeholders as a Success Factor
Blog Post

Socio-Technical Architecture as a Competitive Advantage

In today’s business world, technological progress is not just about increasing efficiency—it also unlocks entirely new business opportunities that would be unthinkable without these technologies. As a result, leveraging new technologies effectively has become a key competitive advantage. However, IT decision-makers are increasingly realizing that technology alone is not enough. Instead, companies must understand themselves as socio-technical systems, where technical systems and human interactions are deeply interconnected. This article explores why socio-technical architectures matter for IT decision-makers and how they can create a competitive edge for organizations.

Blog Post

Platforms, Teams, and APIs: How Do They Fit Together?

One of the major trends in recent years has been Platform Engineering, as many organizations strive for more efficient and fasterdevelopment practices. The term has gained traction since 2018, particularly following an influential article by Evan Bottcher. Looking at the origins of this concept provides valuable insights into the relevance of Platform Engineering today and its potential future developments.

Blog Post

Common Approaches in the Field of Socio-Technical Architectures
Blog Post

LLM-assisted Abbreviation Mining for Legacy Systems

This blog post shows the process of mining abbreviations and discovering first concepts a COBOL legacy mainframe codebase is made of with the help of Large Language Models. It uses Python, pandas and Claude 3.5 Sonnet to generate insights that can be gathered from such a simple thing like a list of files.

Blog Post

Where does it go from here?

In this (fifth) installment of the mini-series on software architecture, we leave behind the realm of small to medium-sized systems and take a look at large, risky, and complex projects. In other words, we examine the “scaling” of the role of software architecture.

Blog Post

Who does it?

Fundamentals of software architecture – Part 4

Blog Post

Technologies for the Integration of Services

In the course of an internal study, we asked a number of INNOQ consultants about their experiences in current or past development projects. One interesting topic here was the integration of microservices and self-contained systems (SCS). Asynchronous communication is frequently used in distributed systems to enable better scalability, greater resilience, and looser coupling. In this article, you will read what insights we learned in our conversations.

Blog Post

Tasks and activities – How is it done?

In this part of the mini-series, we explain everything you need to do when creating software architecture. First, we take a look at the necessary tasks and activities. Then we discuss some of the skills and capabilities required for these architecture tasks.

Blog Post

Terms

Fundamentals of software architecture – Part 2

Blog Post

Building, purpose, aesthetics

Welcome to the first part in the mini-series on software architecture. We start by examining the original source of the term – since the word architecture presumably conjures in most people thoughts of buildings.

Blog Post

Rate Limiting with Spring Boot, Bucket4j, and Redis

Let’s implement rate-limiting protection for multiple Spring Boot server instances using bucket4j and redis to have the solution on application level.

Blog Post

Rate Limiting with Spring Boot
Blog Post

Schema Evolution

Using Kafka, sooner or later you might want to describe a schema to specify your data structures. Since software continuously changes during it’s lifetime you’ll also have to evolve your schema. In this article we’ll discuss approaches and tools which can guide you in the realization of your schema evolution.

Blog Post

Micro Frontends With Ionic And Capacitor

We planned and set up a micro frontend architecture using Capacitor and Ionic. In this article, I talk about some of the challenges we faced and the ways we solved them.

Blog Post

No future-proof architectures!

Why future-proofing should not be an architecture design goal.

Blog Post

Concise Documentation – Revisited

You think architecture documentation is cumbersome and takes a long time to create? We will prove you wrong.

Blog Post

Evolving software like an orchardist

Software systems are usually larger, overgrown structures that developers need to bring back into shape after some time. However, creating an overview of the sprawling conglomerate of software components is challenging, let alone developing a clear plan for moving on. This blog post uses analogies from pruning apple trees to show developers how to evolve their software systems using a value-based approach.

Blog Post

Draw The Diff
Blog Post

What is Sustainable Software?

Environmental sustainability is a very important issue, but software is something virtual, so it doesn’t seem to have an impact, right? Wrong! As software creators, we have a significant impact and can make a difference by incorporating the principles of eco-friendly software development into our understanding and practices.

Blog Post

Shortcomings of ISO 25010

Published in 2011, the ISO 25010 standard on software product quality lacks pragmatism and practical applicability. Terms like scalability, deployability, energy efficiency, safety, or code quality are missing. This article explains these shortcomings and shows that even the (draft) update from 2022 still needs polishing…

Blog Post

Behaviour over structure
Blog Post

Frontend integration options

The integration of data and functionality in the frontend is a powerful topic that is still rarely discussed. This article aims to try and show established patterns of frontend integration and briefly name possible advantages and disadvantages.

Blog Post

Documenting software architecture with arc42

arc42 is a template for architecture communication and documentation. It is a proven, practical and highly pragmatic approach and takes the pain out of documentation.

Blog Post

cards42 English edition

The activity cards for software architects

Blog Post

Principles of technical documentation

This article collects fundamental requirements for technical documentation, especially software architecture documentation, together with ideas how to satisfy those.

Blog Post

Data Mesh to Go: How to Get the Data Product

You know what a data mesh is? You understand its basic principles? But you don’t know how on earth to get the data product? Then I will show you how to extract your data product from your Domain-driven Design (DDD) artifacts.

Blog Post

HTTP Feeds

Asynchronous Interfaces without Kafka or RabbitMQ

Blog Post

Quality Driven Software Architecture - Revised

Quality is the raison d’être for software architects: Our systems should be reliable, performant, scalable and user-friendly. Systems should be build and maintained cost-effective and future-proof. Every IT professional knows that this combination of characteristics means hard work. The article shows how you can methodically construct quality.

Blog Post

What’s in a name: Legacy

The term “legacy” has a negative connotation in IT, and stands for an old, somehow bad piece of software. In real-life, legacy has a completely different and often positive meaning.

Blog Post

What’s in a Name: Quality
Blog Post

Is Domain-driven Design overrated?

Domain-driven design (DDD) is a useful approach that provides excellent guidelines for modeling and building systems, but it is a means to an end, not an end in itself. While the concepts are valid, you lose a lot if you limit yourself to using them only: There actually is a life beyond DDD.

Blog Post

Happy without a Service Mesh

It does not always have to be a service mesh. Even microservices are not a good idea per se. For good decisions we have to get a deep understanding of the problem first.

Blog Post

Domain-driven Design in the Large

A Structured Approach to DDD

Blog Post

Requirements Engineering

The priority to invest into requirements engineering often suffers in everyday life, although its importance has been proofed to be the basis to develop values for customers. The objective of this article is to recall the core definitions and statements of requirements engineering and to provide aid with links for further readings on how to apply it in practice.

Blog Post

Command & Control, SAFe, Domain-driven Design, and Release Trains

Large complex projects are difficult to manage. Software release trains are one solution to coordinate such projects. But the approach is not a great fit for self-organization and modern management ideas.

Blog Post

Identification of quality requirements with Quality Storming

Collaborative modeling for a cross-skill collection and prioritization of quality requirements

Blog Post

JavaScript? Yes, but in moderation

The benefits of classic architecture decisions for web applications.

Blog Post

code-your-model

Some time ago I was looking for some simple, lightweight tool to document a complex, modularized model. I was not able to find anything that fits my requirements or expectations, so I came up with my own idea. Today, a good 15 months later, I want to introduce it to you.

Blog Post

Cooking with Onions: Inward-Pointing Arrows
Blog Post

Domain Events vs. Event Sourcing

Why domain events and event sourcing should not be mixed up.

Blog Post

Do We Worship Complexity?

Complexity is the most important challenge in software development. So it is important to always strive to eliminate complexity. But sometimes we worship complexity - and that can make complexity problems unsolvable.

Blog Post

No-Principles Software Architecture

Think for Yourself!

Blog Post

Code Redundancy or Reuse?

Reuse used to be the holy grail of software development. If developers reuse code, they don’t have to write it again. This should increase productivity significantly. In the meantime, however, some things have changed - and even redundant code has advantages. So avoiding redundancy is also just another trade-off.

Blog Post

Technical Debt Just Happens

“Technical debt” is a great metaphor to reason about the quality of a software project. But a closer look also reveals some problems and shows approaches how to deal with software quality even better.

Blog Post

Microservices? Or Rather Monoliths?

After the Hype

Blog Post

A Playground for Testing OpenID Connect

This post describes how you can set up a development environment in order to play around with your OpenID client implementation. When running your application in a cluster, it can be difficult to test how it will behave behind a load balancer. One factor that can be particularly difficult to test is when you are communicating with an OAuth 2.0 or OpenID Connect server which expects that a request will be redirected back to the same application instance that it came from.

Blog Post

dprox – Declarative Reverse Proxy

Reverse proxies don’t have to be a pain when it comes to local development.

Blog Post

The language of maths is not the language of your business
Blog Post

What’s in a Name: Evaluate

The term evaluation is often used in the context of system and architecture reviews. In my opinion, this term is often misleading and such activities should be named differently.

Blog Post

Self-contained Systems: A Different Approach to Microservices

Microservices are the current hype in the Software Architecture community. However, microservices can be used in many different scenarios to reach different goals. Self-contained Systems (SCSs) are one approach to achieve some of those goals while avoiding many common pitfalls.

Blog Post

The perils of shared code
Blog Post

What’s in a Name: Architecture

The term architecture is used with slightly different meanings throughout the IT industry. This post clarifies what (software) architecture is all about - and which misunderstandings might linger on your way to common understanding.

Blog Post

ROCA vs. SPA

Currently, a lot of companies are migrating from Desktop applications (mostly written in Java) to Web applications for their products as well as for their internal tooling. When they start with this process they often ask themselves: Which technologies should we use to build our Web application? Should we use Angular.js or React? Or should we go with recommendations like ROCA instead of a Single Page Application?

Blog Post

Solving the wrong problems
Blog Post

What’s in a Name: Transparency

The term transparent denotes something translucent, where light can shine through. It is, for example, used in context of economics (transparent markets), meaning markets where much is known by many, and nothing is hidden. Sometimes geeks tend to inverse this meaning, saying transparency where they mean opaqueness. This post illustrates that your favorite XY-framework by no means makes XY transparent for developers.

Blog Post

Transclusion in self-contained systems

Frontend integration in the web is a huge topic. This post deals with the aspect of transclusion of other systems' content in the DOM of a web page.

Blog Post

Why RESTful communication between microservices can be perfectly fine
Blog Post

What’s in a Name: Consistency

The term consistency has several different meanings. This post identifies and clarifies those - especially consistency as synonym for conceptual integrity, one of the most important features for long-lasting software systems.

Blog Post

Reliable Web Clients

Microservices can make teams and systems more independent but also more vulnerable to the fallacies of distributed systems. Initially I thought this blog post is going to be about how to build reliable web clients with Akka and Akka Persistence. While this is an interesting topic by itself, I now think it is more crucial to first understand the underlying problems and trade-offs before we learn how to get around them.

Blog Post

What’s in a Name: Reactive
Blog Post

Why You Should Avoid a Canonical Data Model

As an enterprise architect, you might be tempted to strive for a canonical data model for your systems’ interfaces. That’s not a good idea.

Blog Post

Scalable Software Systems

Scalability has long been one of the hallmarks of quality IT systems. When we hear this term we usually associate it with an upward scalability of the system. Generally, it seems to be about how much more throughput and load our system can sustain through additonal RAM, CPU or extra machines. Often, however, downwards scalability is just as interesting, that is, the behaviour of the system when only very few resources are available. Such flexibility is very useful, for instance, if a complex system has to go through a variety of differently sized development, test and acceptance environments before it is provisioned in the live system.

Blog Post

Hystrix – to make your fuse blow just in time
Case Study

Building a learning platform that enables continuous pedagogical evolution

Read case study
News

New Primer: Advanced IAM Patterns and Strategies
News

Agile meets Architecture 2026: Program Announced
News

Agile meets Architecture 2025
Case Study

Fleurop: A modern architecture for reliable floral greetings

Read case study
News

Launch of New Microsite: Architecture Antipatterns
Case Study

A digital communication link between wholesale and retail based on self-contained systems

Read case study
Case Study

Hellmann Road: clear interfaces for efficient product teams

Read case study
Case Study

Creating a “Best in Industry” E-Commerce Platform with Self-Contained Systems

Read case study
Case Study

Proof of payment clearing and fraud detection: Krombacher is leveraging automation as part of its loyalty program

Read case study
News

Agile meets Architecture 2023
Case Study

SACAC optimizes the quotation process with a customized software solution

Read case study
Case Study

Digitization of land register management in cooperation with Terravis

Read case study
Case Study

Breuninger improves time-to-market through verticalization and self-contained systems

Read case study
Case Study

A cloud platform for efficient commissioning processes in dentistry

Read case study
Training

Designing software architectures for AI and ML systems

iSAQB® Training
Dates & Details