Engineering-first
Best practices are often context-free. WAF++ focuses on transparent criteria, evidence, and trade-offs — so decisions remain reproducible across teams.
WAF++ is a community-driven, vendor-neutral framework built from real-world experience. Our goal: make architecture quality, governance, and sovereignty in cloud and multi-cloud environments transparently assessable and continuously improvable.
Three structural gaps in the existing landscape that WAF++ was built to close.
Best practices are often context-free. WAF++ focuses on transparent criteria, evidence, and trade-offs — so decisions remain reproducible across teams.
WAF++ defines principles, reference models, and controls — regardless of whether you run AWS, Azure, GCP, on-premises, or hybrid combinations.
Decisions are discussed, documented, and versioned publicly via RFCs, reviews, and the roadmap. This makes the framework auditable and community-ready.
Organizations should be able to evaluate cloud architectures in a multi-cloud reality — clearly, transparently, and independently of marketing narratives. WAF++ provides a shared lens of pillars, criteria, and reference models.
“Traceability instead of gut feeling. Criteria instead of buzzwords.”
Four concrete deliverables that turn the vision into engineering reality.
Guiding questions and criteria for architecture quality — including what evidence (artifacts, policies, ADRs, metrics) makes an answer robust.
A maturity and scoring model built step by step — not a black box, but transparent rules that teams can iteratively improve.
Reusable patterns, anti-patterns, and reference architectures — including trade-offs and operational considerations consolidated from real projects.
Working Groups, Maintainers, and the TSC ensure quality and consistency. Decisions are transparent, documented, and publicly discussed.
WAF++ is not a replacement for provider frameworks — it is the neutral layer between them.
Provider frameworks are valuable — but often product-centric. WAF++ complements them with vendor-neutral criteria, governance, and sovereignty considerations.
Governance and community structure are inspired by proven open-source models such as CNCF: Working Groups, RFCs, and radical transparency.
WAF++ is audit-friendly: criteria are documented, decisions traceable, and improvements can be versioned — making it compliance-ready by design.
Four non-negotiables that shape every decision in the WAF++ framework — from content to governance.
No product lock-in. Decisions are principle-based.
Criteria, evidence, trade-offs — documented and reproducible.
Experience from operations, projects, and audits matters.
Public discussions and clear roles and decisions.
At project launch, Pillar 2 (Cost Optimization) and Pillar 7 (Sovereign) are the first active pillars. Governance, community processes, and roadmap rituals are being built in parallel.
Make costs visible, increase efficiency, and allocate resources deliberately. The first fully documented pillar.
Digital sovereignty, data control, exit capability, and regulatory alignment across cloud environments.
Working Groups, reviews, use cases, sessions — we build in the open. No minimum contribution required.
Share use cases, provide feedback, or contribute in Working Groups — WAF++ thrives on real-world practice and community input.
WAF++ now includes an eighth pillar — AI-assisted architecture reviews, autonomous remediation, and policy-aware agents for secure cloud operations.