Business Case

NWAF Agent — Business Case

Status: v1.0 · Last updated: 2026-07-23 Companion to: governance.md, adr/0001…0009, diagrams/nwaf-agent-hld.png

All figures below are illustrative and parameterised — they state their assumptions so an organisation can substitute its own rates. The case does not rest on precise numbers; it rests on the structural shift from point-in-time to continuous review.

---

1. Executive summary

Manual AWS Well-Architected (WA) reviews are infrequent, expensive, inconsistent, and stale the moment they finish. The NWAF Agent replaces the mechanical detection in a WA review with a deterministic nightly pipeline, reserving human architects for judgment. It shrinks the risk-exposure window from months to ~24 hours, produces evidence-backed, reproducible findings, and scales across a fleet at near-zero marginal cost — for an illustrative ~$1–2K per workload per year versus ~$6–20K for a far less frequent manual review.

It does not replace the architect; it removes the config-checking toil so the architect's time goes to design and the judgment pillars a scanner cannot assess.

---

2. Problem — the status quo

A conventional WA review is a point-in-time, manual engagement:

• Infrequent. Typically quarterly at best, often annual or one-off. Between reviews, posture is unknown.
• Stale on delivery. Infrastructure drifts the day after the review; the report describes a state that no longer exists.
• Labour-intensive & senior. Prep, evidence-gathering, the review session, and write-up consume scarce senior-architect / Solutions-Architect time.
• Inconsistent & unreproducible. Different reviewers, different depth, no machine-checkable evidence, no run-to-run comparability.
• Drift-blind. Out-of-band changes (someone toggles off encryption in the console) go undetected until the next review — if ever.

The real cost is not the review fee; it is the exposure window — the months a High-Risk Issue sits undetected.

---

3. Cost of the status quo (illustrative)

Per manual review, one workload

Driver	Assumption	Cost
Senior architect / SA effort	20–40 h @ $150–250/h loaded	$3,000–$10,000
Frequency	1–2× per year (optimistic)	—
Annual, per workload		~$6,000–$20,000

…and that spend still leaves 6–12 month blind windows and no continuous evidence. A paid partner WA engagement typically lands in the same range or higher, per workload.

The unpriced cost: a single misconfiguration-driven incident (a public bucket, an unencrypted database, a missing backup) can exceed the entire annual review budget many times over. Continuous detection is primarily an exposure-window reduction play.

---

4. Proposed solution & value

A deterministic nightly pipeline (see governance.md §4 — it passes its own WA review) that:

• Runs every night, cutting the exposure window from months to ~24 h.
• Detects deterministically (Prowler, Checkov, Steampipe, Infracost, Compute Optimizer) and reconciles live-vs-code to classify drift — catching out-of-band changes manual reviews miss.
• Reserves the LLM for judgment — reconciliation, WA-pillar mapping, prioritisation, remediation narrative — with findings evidence-linked and scanner-fact vs judgment clearly labelled.
• Keeps the WA Tool posture current automatically (scanner-backed answers, to a dedicated automation workload; §ADR-0006).
• Frees senior talent from config-checking toil for design and the soft pillars.
• Scales to a fleet at near-zero marginal cost.

---

5. Cost model

Per nightly run, one workload (illustrative)

Component	Basis	Cost / run
CodeBuild compute	~30 min, general1 medium/large	$0.10–$0.50
Bedrock inference	reconcile over structured findings (compact), Sonnet-tier	$1–$3
Scanners	run inside CodeBuild; API calls free	included
RAG retrieval	bundled reference — no always-on cost (ADR-0005)	$0
S3 / SNS / adapters	logs + one thin publish	<$0.10
Per run		~$2–$4
Per workload / year	~365 runs	~$0.7K–$1.8K

One-time build: a few engineering-weeks for the pipeline, adapters, and IaC. Amortised across the fleet — the **marginal cost of the Nth workload is ~$0 build

• ~$1–2K/yr run.** Fleet economics strongly favour the agent: manual reviewing a large fleet is prohibitive; the agent's cost is linear and small.

---

6. ROI

	Manual review	NWAF Agent
Cost / workload / yr	~$6K–$20K	~$1K–$2K
Frequency	1–2× / yr	~365× / yr
Exposure window	months	~24 h
Evidence / reproducibility	low	high
Drift detection	none	yes
Scales to fleet	poorly	linearly

Even on cost alone the agent is ~3–10× cheaper while delivering ~200× more frequent coverage. The dominant return, however, is the shortened exposure window — one prevented incident typically repays years of run cost. Add the recovered senior-architect hours (redirected to design) and the case compounds.

---

7. Risks & mitigations

Risk	Mitigation	ADR
False positives / inaccuracy	Deterministic scanners + evidence-linkage; human disposition	0004, 0008
LLM hallucination	LLM reconciles, never invents findings; no auto-remediation; no fabricated "fixed" status	0003, 0008
Trust in automated WA writes	Dedicated automation workload; human record untouched; reversible milestones	0006
Security of the reviewing tool itself	Read-only, write structurally impossible in target; per-stage least-privilege	0007
Over-claiming coverage	Performance / process-Ops / Sustainability labelled as judgment, not scanner fact	0004
Adoption friction	report_only default; opt-in advisory PRs; accepted-risk register	0008
Alert fatigue	Idempotent one-ticket-per-finding; accepted-risk suppression	0008, 0009
Silent run failure	Open gap — run-failure alerting not yet designed (see governance.md §4)	follow-on
Maintenance drift	Pinned scanner versions; corpus refresh per WA revision	0004, 0005

---

8. Success metrics (KPIs)

Coverage & timeliness

• Workloads/accounts under nightly review (target: full fleet).
• % of WA questions answered with scanner-backed evidence.
• Mean time-to-detect a new HRI (target: < 24 h, vs months).

Risk reduction

• Open-HRI trend (should decline over time).
• Out-of-band drift findings caught per month.
• Mean time-to-remediate HRIs.

Efficiency

• Senior-architect hours saved vs the manual-review baseline.
• Cost per workload-review (agent vs manual).

Quality & adoption

• % findings actioned (ticket resolved / PR merged).
• False-positive rate (findings dismissed).
• Run success rate (% nights with a completed review).
• Teams opted into advisory_pr; count of accepted-risk exceptions (a healthy governance signal, not a failure).

---

9. Strategic value (beyond the numbers)

• Continuous, audit-ready compliance evidence rather than periodic snapshots.
• Consistency & reproducibility — the same inputs yield the same review.
• Fleet scale — a per-workload practice that was economically impossible manually.
• Talent leverage — senior architects move from checking to designing.
• Cultural shift — Well-Architected becomes a continuous practice, not an event.

---

10. Recommendation

Adopt the NWAF Agent, rolled out in report_only mode first to establish trust, expanding to advisory_pr per team as confidence grows. Prioritise closing the run-failure alerting gap before fleet-wide rollout. Track the KPIs in §8 from day one to make the exposure-window and efficiency gains visible.

References

• governance.md (framework mapping, trade-off register, AI controls)
• adr/0001…0009 (decision records)
• diagrams/nwaf-agent-hld.png (v2.3)