wardley-maps.sgit.ai / Dinis Cruz on mapping

Dinis Cruz on Wardley Mapping, 2018–2025

Twenty-six published items over seven years, then a stop. Twenty-two were verified by fetching them; four could not be — SlideShare and LinkedIn block automated retrieval, and nothing here routes around a block. The unverified four say so on their face.

The headline is the last row of the table below. The public record stops in 2025 and the private record starts in 2026. Job A found 26 published items ending in a single clause; the same research found 194 unpublished files of agentic-era mapping beginning five months later. The only public link between the two eras is that one clause, in one co-authored article. This site does not report that bridge. It is the bridge — which means it is making a claim, not describing one.

Four claims, held for seven years

2018 — diagrams must become maps

The Medium post of 7 October 2018 is the intellectual seed and the clearest statement of the whole position:

in most development teams, we are still at the "Why do we need up-to-date diagrams?" phase. Where the question that we should be looking at is "How can we make our diagrams every better and more valuable?" And the answer is Maps, which are diagrams with the following properties — are visual — have context (i.e. specific to purpose / perspective) — are mode of components — have at least one anchor — have a position (relative to anchor) — have a consistency of movement

with the complaint that ordinary architecture diagrams "miss the key mapping properties of: anchor, position (relative to anchor) and consistency of movement."

2018 — maps should be generated, not drawn

Creating Wardley Maps using Lambda Functions opens on the frustration of not being able to "programatically create the maps (ideally via [a] DSL or something like DOT language)" and ends with a map generated inside a Lambda from programmatic values. That is the same instinct that, in May 2026, becomes Mermaid wardley-beta in git — eight years apart, one idea. The ending of that story is that the 2018 repository is now a 404 and the 2026 version renders.

2018–2020 — context is the security asset

The 2018 session deliberately mapped a cup of tea and an AWS attack in the same hour, and the outcomes page records the argument over "whether the tea picker was visible" as the teaching moment — position is contested, and that is the point. It becomes a title in October 2020: "Why context is your crown jewels." In security, crown jewels means data assets; the talk inverts it — the contextual understanding of your value chain is the jewel.

2020–2022 — mapping is the missing half of threat modelling

Stated flatly in the March 2022 session abstract: "Wardley Maps could be the missing piece of the puzzle when doing Threat Models." Never followed up in public. The security route through the resources is this site's attempt to follow it up.

And the hinge into AI, 2025

MCP represents the commoditization of LLM-to-tool interfaces, which in turn enables higher-level constructs and rapid innovation (a concept noted in Wardley Maps' Innovate-Leverage-Commoditize cycle). We are currently in the "Genesis and Custom Build" phase of agents using MCP…

One clause, co-authored, three years after the last substantive output. Do not read this site as though a public position on agentic mapping already exists. It does not. Creating one is what the site is for.

The direct ancestor

16 June 2020 — Team Topologies & PST & Squads & Tribes, with Simon Wardley, Tony Richards and Luke Robbertse. Six years later, __Send runs three agent teams named Explorer, Villager and Town Planner. The 2026 pattern has a documented 2020 origin with Wardley himself in the conversation, and nobody has ever put the two side by side. This site does →

Supporting evidence from the same period: the December 2019 hiring post requires candidates to build and present a Wardley Map — "about an industry, about you or even about a cup of coffee… we also want to see the candidate's experience of creating that map, the thought process and the learning experience" — and lists Wardley alongside Spotify Squads, Team Topologies and Cynefin. The cup-of-coffee motif carries straight from the 2018 cup of tea.

The chronology

Every item links to its source. Items with month precision say so: the Open Security Summit mini-summit pages carry a weekday but no date, and every mini-summit index renders the same stale schedule table — March 2022, July 2022 and September 2024 all show identical columns. No exact dates were synthesised.

Not events

• Map camp - Why context is your crown jewels (Wardley Maps and Threat Modeling) — HIGHEST PRIORITY ARCHIVE TARGET. The only artefact of the Map Camp talk, and the 'crown jewels' thesis exists nowhere else in readable form. SlideShare serves a Cloudflare challenge; contents unread. Export to PDF from a real browser and mirror.
• Open Security Summit — Wardley Maps project (standing membership) — Structural, not an event. Establishes the standing relationship.
• Wardley Maps in Cyber Security - Panel — UNRESOLVED. Title and channel confirmed via oEmbed; no session page found; Dinis's participation NOT confirmed. Do not publish as his until verified. Participation unconfirmed; listed here rather than claimed.

The recordings

9 recordings, all resolving live in August 2026, all on the Open Security Summit channel and embedded above via youtube-nocookie. Three more from the wider track are worth the same shelf and are not Dinis's: Wardley Maps First Aid (Petra Vukmirovic — note it is dated 5 June 2020 by its own title despite living under a /may/ URL path, because the 2020 summit slipped from May to June and the URLs never moved), Wardley Maps and services model at Glasswall (Steve Purkis), and Maturity Mapping (Chris McDermott).

What should be archived before it disappears

This site should not link to fragile things without mirroring them, and it currently does. Stated as a debt rather than done: see the task list.

1. The SlideShare deck (A15). The only artefact of the Map Camp talk, and the sole source for the crown-jewels thesis. Export to PDF from a real browser and mirror it.
2. The year-subdomains — 2018., 2019., 2020.open-security-summit.org. Separate deployments holding participant lists, outcomes and session notes the current site lacks; the canonical index says outright that "this list of events and sessions is not complete." The 2018 Maps and Graphs track — the only one Dinis organised — has no presence on the current site at all.
3. The two LinkedIn posts. Unfetchable, unarchivable, deletable, and the only evidence of 2024 activity. And label them accurately: both are shares.
4. The two blog posts. The Blogger feed API confirms the Wardley_Maps label holds exactly two entries — that label is the complete list of his Wardley blogging.
5. Dying links inside the session pages themselves — a heysummit registration that now reads "This event is not live yet", Zoom links with passwords in the URL, a join.slack.com invite, and Google Slides /e/2PACX-…/embed links that break the instant the owner unpublishes.