When setting the system boundary for an analysis, which guiding questions do you answer, and why can the same object get very different boundaries?
Ask: What is important here? Whom do I protect against what? What do I want to analyse? The boundary depends on the viewpoint, so each party with a different responsibility draws it around a different part of the same system.
The exercise uses a single object: an internet-connected kitchen fridge ("SmartFrost") made by the manufacturer Gastro-Frost and used by a cheese dairy, K. The kitchen staff watch it through an app on a smartphone, and the fridge's IoT module reports to the manufacturer's server over the internet. Looked at from four responsibilities, the boundary moves every time:
| Viewpoint | What is protected | Analysed interactions |
|---|---|---|
| Device management at K (also responsible for the smartphone) | The work smartphone, against malicious code, especially from the internet | To and from the smartphone (app store, app, internet) |
| Gastro-Frost, programming the fridge's IoT device | The IoT device and, behind it, the fridge and the server | To and from the IoT device (cooling machine, communication module, server) |
| Gastro-Frost, running the SmartFrost servers (web server + backend) | The web server system, against unwanted actions from many devices and customers | To and from the web server |
| Gastro-Frost, building the app | The app including its development and deployment | To and from the app (app store, users, dev and test environment) |
Drawing the boundary first is what keeps an analysis focused: it fixes which actors are inside, which are outside, and which interactions cross.