Unified Dashboard MVP — GARB ADS as submitted

Unified Dashboard MVP — GARB ADS as submitted An architecture diagram generated by Archify. CIAM · ForgeRock · Architecture component · existing · no change CIAM ForgeRock existing · no change Per-BU MFEs · React micro-frontends · Azure · Canada — all PII at rest in Canada · new Per-BU MFEs React micro-frontends new BU Mapping Service · CIAM ID → product relationships · Architecture component · CIAM-owned · manual linking BU Mapping Service CIAM ID → product relationships CIAM-owned · manual linking Customer · Browser · post-login · Architecture component Customer Browser · post-login Akamai · CDN · WAF · DDoS · bot · Architecture component · existing Akamai CDN · WAF · DDoS · bot existing Dashboard Shell · Next.js SSR · route handlers · Azure · Canada — all PII at rest in Canada · new · BFF experience Dashboard Shell Next.js SSR · route handlers new · BFF experience Integration API · channel-agnostic orchestration · Azure · Canada — all PII at rest in Canada › Service principal · ForgeRock JWT (S2S) · new Integration API channel-agnostic orchestration new BU Data APIs · 7 business-unit domains · Architecture component · existing · 7 calls per load BU Data APIs 7 business-unit domains existing · 7 calls per load Adobe Experience Manager · content fragments · Architecture component · existing Adobe Experience Manager content fragments existing CosmosDB · session store · MongoDB API · Azure · Canada — all PII at rest in Canada · new CosmosDB session store · MongoDB API new Azure Managed Redis · short-TTL response cache · Azure · Canada — all PII at rest in Canada › Service principal · ForgeRock JWT (S2S) · new · AES-256-GCM Azure Managed Redis short-TTL response cache new · AES-256-GCM HTTPS HTTPS · edge cache OIDC auth code + PKCE serves · runtime composition session state content fragments service principal POST /mappings/search REST · ForgeRock JWT per-downstream cache Azure · Canada — all PII at rest in Canada Service principal · ForgeRock JWT (S2S) Legend Frontend Backend Database Cloud Security External

Aggregation

  • • One BU Mapping call plus seven BU Data API calls per dashboard load
  • • GB · Canada Retirement/GRS · Bank · Insurance · Wealth · Seg Funds · Affinity
  • • Redis caches downstream responses at short TTL; CosmosDB holds session state

Identity and authorization, as written

  • • CIAM (ForgeRock) authenticates; the shell trusts only validated CIAM tokens
  • • “No change to authorization” — enforced in the existing BU portals
  • • BU Mapping, populated by manual linking, decides which MFEs render

Scope, as the ADS states it

  • • Replaces the Product Selection Home Page inside the existing portal
  • • No unified profile, no auto product linking, no centralized authorization
  • • ECID, MDM and consent are deferred to Phases 2–3
  • • Dark Launch: shell only, 10–15 internal employees, gated by Unleash flags