Accelerator
Design an access architecture for AI
Pick a situation, place the objects, draw the links and set their properties, then check your design.
The grade is deterministic: each rule shows its source and the exact strength of that source.
Your diagram stays in your browser.
Sources checked on 18 October 2026.
What do you want to make possible?
How it is graded
- The verdict comes first. A diagram is correct when every essential rule holds. Until then, it shows how many essential rules hold, and no score.
- A correct diagram scores 80 points for the essential rules, plus up to 20 for the recommended ones. Each hint costs 2 points, a precise hint 5 more. The bonus, up to 8, is shown apart and never added to the score.
- A rule that depends on another one waits until that one holds, so one mistake gives one message.
- Layout is never graded: only objects, links and their properties count.
What the badges mean
- MUST, SHOULD, MAY
- · The keyword the source itself uses. A badge never says more than its source.
- IETF draft
- · An Internet-Draft: work in progress, which may change. Its version is always shown.
- NIST IR 8587 (guideline)
- · A NIST guideline: voluntary unless a policy or a contract requires it.
- OWASP (guidance)
- · OWASP good practices, with the edition year of each ID.
- YogaSec recommendation
- · YogaSec analysis. No external standard requires it.
Questions
Why is my diagram « not correct yet » when most rules pass?▾
The verdict depends on the essential rules only. Each one answers a requirement of the brief, so one missed rule is enough. The recommended rules count in the score, once the diagram is correct. A rule marked waiting depends on another one, so fix the one shown first.
What do MUST, SHOULD and « recommendation » mean?▾
MUST, SHOULD and MAY are the keywords of IETF standards (BCP 14: RFC 2119 and RFC 8174), also used by MCP, OpenID and NIST IR 8587. MUST is a requirement. SHOULD is a strong recommendation, to set aside only for a good reason whose consequences are understood. MAY and OPTIONAL mark something truly optional. « Describes the mechanism » means the source explains how it works without a keyword. Each badge repeats the keyword of the source it cites, never a stronger one. NIST IR 8587 is a guideline: voluntary unless a policy or a contract requires it. A « YogaSec recommendation » is YogaSec analysis that no external standard requires.
Why is an IETF draft cited?▾
The Cross-App Access situation relies on the Identity Assertion JWT Authorization Grant (ID-JAG), an Internet-Draft of the IETF OAuth working group. No RFC defines this grant yet: it builds on two published RFCs, Token Exchange (RFC 8693) and the JWT bearer grant (RFC 7523). The « IETF draft » badge and the version shown make this clear, and the rules are reviewed when a new version comes out.
Does the layout of the boxes count?▾
No. Only the objects, the links, their direction and their properties are graded. « Arrange » tidies the boxes without changing the grade, and the names you give to objects are never graded either.
Are my diagrams sent anywhere?▾
No. Building, checking and the solutions all run in your browser. Your diagram is never sent or saved, not even in the browser's storage, so closing the page loses it unless you exported it. « Export » downloads a file to your device. Only anonymous counters are sent, such as the number of checks or hints, never the diagram or the names.