Architecture decisions rot. The diagram says "all traffic goes through the gateway," but production disagrees. Nobody notices until an audit, an incident, or a very awkward pentest report.

This session shows how to turn architectural intent into executable checks. Using Azure Resource Graph, Azure Policy, and a little code, we'll build fitness functions that continuously verify your decisions: no public endpoints, no cross-region data flows, naming and tagging conventions, and dependency rules between services. We'll wire them into CI/CD and scheduled runs so architecture drift becomes a failing build instead of a surprise.

You'll leave with a repeatable "architecture as tests" pattern, working examples to adopt, and a way to make ADRs enforceable instead of decorative.