Architectural governance · AI-generated code

Practical wisdom,
(made computable).

AI writes a growing share of our code. fr()nis makes it verifiable whether that code is architecturally sound: the model proposes — a verifiable knowledge base decides.

Patent pending · Austrian Patent Office, October 2026
7 principles
38 domains
Ontology 8.51.44
Vienna
Let's talk The idea → Try the gate →
PATTERN OR ANTI-PATTERN?#2
public List<Account> findByOwner(String owner) {
    String jpql = "SELECT a FROM Account a"
        + " WHERE a.owner = '" + owner + "'";
    return em.createQuery(jpql, Account.class).getResultList();
}
Accounts are looked up by owner. How bad is this in a banking app?
Blocker. The name goes straight into the query text. Whoever enters ' OR '1'='1 as the owner gets every account. SQL injection has been in the OWASP Top 10 for years, and PCI-DSS explicitly requires protection against it (Req. 6.2.4). Fix: Named parameters instead of concatenation, WHERE a.owner = :owner with setParameter.
Watch the gate decide this case →
A new one every Tuesday on LinkedIn.
7
Principles
A normative layer every engineer understands — not just pattern specialists.
2,154
Patterns & anti-patterns
Curated architectural knowledge across 38 domains, each mapped to a principle.
1
Knowledge base
Versioned and traceable: the same question gets the same answer.
DORA · CRA
Regulation
Prove resilience and secure development instead of claiming it.
01 · The name is the thesis

From phronesis to fr( )nis.

Four steps, from Aristotle's virtue of practical wisdom to an executable governance layer. The parens aren't decoration — they are the brand compressed into two characters: the moment the universal meets the particular.
01 · Root
φρόνησις
Aristotle's virtue of practical wisdom. Distinct from theoretical knowledge (sophia) — it is judgment in the particular case.
02 · Stem
fronis
Drop the Ph- (pure theory) and the Greek ending. What remains is the working stem — disposition toward right judgment.
03 · Operator
fr()nis
Replace the o with the function-call operator. Wisdom is no longer a state — it is an executable process.
04 · Instance
fr()nis.ai
The runtime. The instance that decides — like a phronimos — whether a change honours the universal principles.
“The universal (rules, principles) applied to the particular (this change, this code).” — Nicomachean Ethics, reread for software
02 · Why now

Fast code needs (binding) review.

AI assistants and agents are changing how software gets written. What they don't change: architectural mistakes get expensive once they reach production — and in regulated industries you have to be able to show that the code was checked.
01 · Speed
AI writes faster than humans can review.

Code review was a bottleneck before AI. With assistants and agents, the volume of changes grows — the time for review doesn't.

02 · Reliability
A language model proposes. It doesn't verify.

Ask the same question tomorrow and you may get a different answer. For a binding decision, “probably right” isn't enough.

03 · Evidence
Regulators ask for evidence, not intentions.

DORA and the Cyber Resilience Act require resilience and secure development to be traceable — including for code written by AI.

The approach

The model proposes. (The knowledge base decides.)

AI model
proposes
→
Knowledge base
checks
→
Decision
traceable · repeatable
03 · Who it's for

Let's talk if …

fr()nis is early. I'm looking for people who have this problem today and want to find out with me what makes the biggest difference.
Due diligence · M&A
… you assess a codebase before you buy it.

How healthy is the architecture, really? Make architectural risk visible and traceable before it becomes part of the purchase price — instead of relying on slide decks and gut feeling.

Write to me →
Tech DD · Private equity · Acquirers
Engineering · Platform
… AI agents write code in your team.

Who has the final say when an agent proposes a change? Binding, traceable architecture rules instead of hope — especially where DORA or the CRA apply.

Write to me →
CTO · Head of Platform · Fintech
04 · The seven principles

A normative layer, not a rule list.

Every pattern and anti-pattern in the knowledge base maps to at least one of these. A developer who has never heard of a circular module dependency still understands “violates P1 — directed dependency.”
P1
Directed
dependency
Clean Architecture · DIP
P2
Single reason
to change
SRP
P3
Explicit
over implicit
No hidden side-effects
P4
Least
privilege
Zero Trust · Default Deny
P5
Fail fast,
fail visible
Observability
P6
Domain
truth
DDD
P7
Evolutionary
readiness
OCP
05 · The knowledge base

Not a lint rule. A semantic knowledge base.

Patterns and anti-patterns with severity, rationale and a mapping to the seven principles — versioned and traceable. Two entries as an example:
Knowledge base · excerpt2 entries
SSRF_VIA_UNVALIDATED_URL   Blocker
An outbound HTTP request is built from user input without a host allowlist or URL-scheme validation. Violates least privilege at the perimeter.
Principles: [P4, P3]   Domain: security
security http owasp-top-10
STRANGLER_FIG   Pattern
Incremental decomposition of a monolith: traffic is gradually routed to new services while the legacy stays in place as a fallback — until the old code path is retired.
Principles: [P7, P1]   Domain: microservices
microservices migration decomposition
06 · Regulation

Regulation, expressed as (verifiable) constraint.

The goal: regulatory requirements as constraints in the same knowledge base. When a requirement changes, the knowledge base changes — not a separate rule set per tool.
DORA

Digital operational resilience

Circuit breaker, bulkhead, timeout and retry: make resilience patterns verifiable in code instead of asserting them in documents.

CRA

Cyber Resilience Act

Security by design across the lifecycle: secure patterns as the default, insecure ones visible early — before they ship.

NIS2

Cybersecurity obligations

Least privilege, input validation and logging as traceable architectural properties.

PCI-DSS · ASVS

Payments & AppSec

Requirements for the payment path and for application security, mapped into the same knowledge base.

07 · About

Who's behind it.

DI Mag. Philipp Ruisinger
DI Mag. Philipp Ruisinger
Founder · Vienna

I've been building software and designing architectures for 25 years. At TU Wien I work with Logic and AI — and on the question of how to formalise architectural knowledge so that a machine can judge by it.

I'm building fr()nis alongside my day job, with a simple standard: AI-generated code should meet the same bar as any other code — and you should be able to prove it.

Every Tuesday there's a small quiz on LinkedIn: Pattern or anti-pattern?

Follow on LinkedIn →

If you build under regulation, you need something that decides (traceably).

Let's talk LinkedIn →