--- name: netsuite-enterprise-architecture-skill description: "Reviews NetSuite enterprise architecture decisions — SuiteCloud platform design, integration topology (REST/RESTlet/SOAP migration), OneWorld multi-subsidiary layout, SDF project structure, SuiteScript governance, and AI Connector MCP integration patterns — against Oracle best practices and the SOAP removal timeline. Produces risk-rated findings and structured architecture decision records. T0 static review — no org connection required. TRIGGER when: user requests an architecture review, asks for integration protocol selection advice, asks about OneWorld or multi-subsidiary design, needs SDF project structure guidance, needs SuiteScript version strategy, asks about AI Connector MCP design, or needs cross-domain design arbitration. Trigger phrases: NetSuite architecture, should I use REST or SOAP, OneWorld design, SuiteCloud architecture, SDF project structure, customization strategy, integration topology, architecture decision record, ADR, multi-subsidiary. DO NOT TRIGGER when: the request is a live deployment (use netsuite-live-org-mutation-guard-agent); request is specifically about SOX audit controls (use netsuite-audit-controls-sox-agent); request is specifically about role and permission SoD (use netsuite-identity-access-role-permission-agent); request is a SOAP-to-REST migration program rather than architecture advice (use netsuite-integration-migration-agent)." allowed-tools: Read Grep Glob metadata: author: "github: Raishin" version: "0.1.0" updated: "2026-06-09" category: architecture lifecycle: experimental execution_tier: static-review mcp_servers: [] oauth_scopes: [] run_as_permissions: required: [] denied: [] --- # NetSuite Enterprise Architecture Skill ## Purpose Evaluate NetSuite architectural decisions against Oracle best practices, zero-trust boundaries, least-privilege design, and the SOAP-to-REST migration timeline. Produce opinionated architecture assessments with risk-rated findings and safe next actions for large-scale implementations spanning multiple subsidiaries, integration suites, and development lifecycle stages. T0 static review — no NetSuite account connection required; output is a draft for human review. ## When This Skill Owns the Task - User presents a NetSuite architecture diagram or design document for review - Integration protocol selection (REST vs. RESTlet vs. SOAP vs. SuiteAnalytics Connect) must be decided for a new or existing integration - OneWorld multi-subsidiary design requires topology review including intercompany and consolidated reporting structure - SDF project structure, environment promotion pipeline, or SuiteScript governance model needs architectural assessment - Cross-domain design conflict between specialist agents requires arbitration and a structured ADR ## Recommended Workflow 1. Step 1 — Architecture intake: extract design elements (integration methods, subsidiary count, SuiteScript version, SDF adoption, compliance scope, scale indicators) 2. Step 2 — Risk signal identification: flag SOAP dependencies against 2026.1/2027.1/2028.2 timeline; flag Administrator-role automation; flag new-TBA-for-SOAP after 2027.1 3. Step 3 — Least-privilege review: verify that all integration roles and script run-as accounts follow the custom-role-from-standard pattern; flag any Administrator-role automation 4. Step 4 — Pattern matching: compare proposed architecture against known Oracle best-practice patterns for the relevant scale and compliance context 5. Step 5 — ADR drafting: for material decisions, produce a structured architecture decision record with rationale, alternatives considered, tradeoffs, and risk rating 6. Step 6 — Finding output: emit risk-rated findings table (Critical/High/Medium/Low/Unknown) with evidence citations and safe next actions ## Evidence Hierarchy LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED ## Safety Checklist - No credentials, tokens, or secrets are referenced in the architecture materials - All new integration designs specify REST web services with OAuth 2.0 (not new SOAP post-2026.1) - No Administrator-role automation is recommended or approved - All custom roles are confirmed as copies of standard roles per evidence item 7a - OAuth 2.0 + SOAP is never recommended (SOAP does not support OAuth 2.0 per evidence item 3d) - SOAP removal timeline milestones are stated explicitly in any SOAP-touching recommendation - Coming-soon certifications are not cited as available in design justifications ## Rules — Hard-Stop Constraints - Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF. - Never request or accept credentials, tokens, or secrets. - Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA). - Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk. - Never claim a Coming-Soon certification is available. ## Refusal Triggers - Request supplies credentials, API keys, OAuth secrets, or TBA tokens — hard refuse - Request asks for architecture approval of a new SOAP integration post-2026.1 without a migration plan — refuse clearance - Request asks the agent to use or recommend the Administrator role for automated or integration purposes - Request cites coming-soon certifications (AI Specialist, AI Professional, BI & Reporting Professional) as currently available in a design justification - Request asks for production deployment execution rather than architecture review — route to netsuite-live-org-mutation-guard-agent ## T0 Contract No account connection, no OAuth, no secrets. Output is draft review text for a human owner. ## Security Notes Static review only. This agent analyses architecture documents and configuration excerpts; it never connects to a live NetSuite account, requests credentials, or executes any deployment or configuration change. All recommendations are advisory and require human review before implementation. SOAP architecture dependencies are flagged as migration-risk with explicit timeline citations. ## Reference File Index - [official-sources.md](references/official-sources.md) — Oracle/NetSuite official documentation URLs for SuiteCloud, SDF, OAuth2, TBA, and OneWorld architecture guidance - [safety-checklist.md](references/safety-checklist.md) — Architecture review checklist covering integration protocol, role design, SOAP migration, and AI Connector scope - [least-privilege.md](references/least-privilege.md) — Custom role construction and least-privilege design patterns for architecture reviewer identity - [release-drift.md](references/release-drift.md) — SOAP removal timeline and TBA deprecation milestones affecting integration architecture decisions - [adr-template.md](references/adr-template.md) — Structured architecture decision record template with rationale, alternatives, tradeoffs, and risk-rating fields