Up and running in an afternoon.
Four steps. No bespoke tooling. No long onboarding engagement. The first design audit on a real PR — the same day you start.
- 01Adopt a Steering foundation in one click
rkito ships with pre-built Steering standards — AWS Well-Architected Framework, OWASP Top 10, ISO 27001 compliance templates, and more. One click adopts them into your org's Steering corpus. Review, customise, and approve. You have design intent from day one. No authoring from scratch.
Your own Steering artifacts can be added at any time. The open standards are a starting point, not a constraint.AWS Well-ArchitectedOWASP Top 10ISO 27001CIS BenchmarksSOC 2and more - 02Point rkito at your GitHub repository
Connect your repository. rkito reads your codebase — source code, Terraform, Helm charts, Kubernetes manifests, OpenAPI specs, and more — and automatically discerns your components, services, system boundaries, interfaces, and infrastructure topology. Everything discovered is loaded into your Architecture Ledger as a baseline.
rkito does not store your source code. It reads structure and extracts architectural entities. Your code stays in GitHub.Source codeTerraformHelmKubernetesOpenAPIDocker ComposeGuide: GitHub Integration - 03Review and commit your Architecture Ledger
The discovery run generates a Change Intention — a structured proposal of every architectural entity rkito found. Architects review, update, and approve it. You commit and merge. Your Architecture Ledger is live — the verified baseline against which every future PR will be audited.
This is the only manual step in the setup. After this, the CDA runs automatically on every PR without architect involvement — unless drift is detected.Auto-generated Change IntentionArchitect review workflowCommit & merge to activate - 04Install the rkito GitHub App
Install the rkito GitHub App into your organization. The PR webhook is configured automatically — no manual callback setup, no YAML to write. Every pull request from this point forward triggers the CDA gate before it reaches code review.
That is it. The next PR that opens gets a design audit against your Steering standards and Architecture Ledger.GitHub App install→PR webhook auto-configured→CDA active on next PR
Done. The next PR your team opens gets a full design audit — evaluated against your Steering standards and Architecture Ledger, automatically, before it reaches code review. No architect needs to be present.
Run it where you need it.
Three deployment models. The same design audit gate, the same CDA capability — wherever your constraints require it to run.
Add the rkito CDA as a step in your existing GitHub Actions pipeline. No infrastructure to manage. The design audit gate runs alongside your current build, test, and code quality steps — exactly where it belongs.
Hosted on AWS. rkito Cloud handles CDA execution, results storage, and the full platform — fully managed, no infrastructure to run. For regulated industries, data residency compliance is available subject to AWS datacenter availability in your region, meeting judicial boundary requirements.
For teams that cannot send code or architectural data to external services, rkito ships as a Docker container. Run the full CDA stack inside your own infrastructure. No data leaves your environment.
Open standards built in
You do not start from a blank page. These Steering foundations are pre-built in rkito and available for one-click adoption into any org.
Operational excellence, security, reliability, performance, cost
Web application security risk and design constraint coverage
Information security management and control compliance
Hardening and configuration security standards
Trust service criteria for security, availability, and privacy
Cybersecurity framework for critical infrastructure
Pick your path.
Your role playbook shows what to watch once audits are running.
How rkito hooks into your PR workflow, what a BLOCKED check means, raising a CHI before you code, and governing AI coding agents with MCP.
CTO Architecture Health PlaybookA CTO's weekly check on architecture health, board-ready DHS reporting, AI adoption governance via ADRIFT, and knowing when to escalate.
CSO Security PlaybookA CSO's guide to architectural security conformance, audit evidence from the CDA pipeline, and governing AI-generated security-relevant code with rkito.
VP Engineering PlaybookHow VPs of Engineering track sprint conformance, team-level drift, and quarterly process health using DCS, IFR, PDT, and PDRP signals.
Chief Architect PlaybookHow chief architects author Lenses, triage blocked PRs, run weekly conformance reviews, grow Governance Depth, and govern AI coding agents with rkito.
Product Owner PlaybookHow product owners use IFR, MTTCD, and DCS signals to plan predictable sprints and understand the root cause of delivery blockers with rkito.
SRE Operational PlaybookHow SREs use UDR and ADRIFT as pre-incident signals, trace architectural root cause after an incident, and monitor AGVR governance bypass.