flowchart TB
  subgraph L0["T3 · Enterprise portals, APIs & control planes"]
    direction LR
    L0N0["Next.js / TypeScript<br/>Customer portals · EN / ES / FR / HT"]
    L0N1["Developer &amp; NOC consoles<br/>Self-service requests · SLO dashboards"]
    L0N2["CAMARA API gateway<br/>QoD · SIM Swap · Device Location"]
    L0N3["Enterprise identity<br/>OIDC / RBAC · IdP-managed passkeys"]
  end
  subgraph L1["T2 · Reviewed delivery &amp; private MCP"]
    direction LR
    L1N0["MCP pre-flight<br/>Typed tools · approved model endpoints"]
    L1N1["GitLab CI &amp; policy<br/>Trivy · SBOM · Cosign · OPA / Kyverno"]
    L1N2["Protected review &amp; Argo CD<br/>Human approval · GitOps reconciliation"]
    L1N3["Secrets &amp; evidence<br/>Vault / ESO · redacted SIEM events"]
  end
  subgraph L2["T1 · Telecom &amp; hybrid infrastructure"]
    direction LR
    L2N0["Ericsson OSS-RC / ENM<br/>RAN / Core / IMS management · mediation"]
    L2N1["OpenShift fleet<br/>restricted-v2 · Multus / SR-IOV"]
    L2N2["VMware / vSAN<br/>Consolidation · MTV → KubeVirt cutover"]
    L2N3["Hybrid infrastructure<br/>Terraform / OpenTofu · VMware / Bare-Metal"]
  end
  L0 -->|"Portal requests → merge request → policy checks → human approval"| L1
  L1 -->|"Argo CD → cluster state · CI / IaC runner → hybrid infrastructure"| L2
  subgraph L3["Network API exposure path"]
    direction LR
    L3N0["CAMARA gateway<br/>Authorized customer API requests"]
    L3N1["Consent &amp; exposure adapters<br/>Operator-supported NEF / SCEF interfaces"]
    L3N0 -->|"OAuth2 · policy · consent"| L3N1
    L3N2["4G / 5G network core<br/>Network capabilities · ENM is separate management"]
    L3N1 -->|"Authorized network exposure"| L3N2
  end
  L2 -.->|"Cluster telemetry, pipeline receipts and redacted tool events return to operations consoles and the evidence store."| L0
  %% Reference topologies, not a statement of fit for your estate. Protocol versions, network boundaries, roles and service targets are set in the low-level design during the Assessment Sprint.