Carlos Eduardo da Silva

Problem: Microservice granularity is typically treated as a one-time design decision, yet service boundaries must evolve with changing technical and business demands. The absence of systematic mechanisms for continuously reassessing granularity often leads to excessive fragmentation, increased maintenance effort, and elevated operational costs. Method: This paper presents Granulify, a novel evidence-based approach for continuous granularity management that addresses critical gaps identified in a systematic mapping of 24 primary studies. The approach integrates qualitative diagnosis and quantitative assessment to support iterative boundary adjustments. The approach introduces the Granularity Classification Spectrum (GCS) for positioning services along a granularity continuum, and the Granularity Saturation Method (GSM), which combines polarity-aligned metrics into two aggregate indices—Net Benefit (NB) and Total Variation (TV)—and derives a bounded Saturation Score (SS) from their ratio for regime classification. Thresholds are calibrated through a lagged rolling window, ensuring that each period is classified only using prior historical observations. We followed an industry-oriented Design Science Research approach, operationalised through 13-month longitudinal action research in a large-scale financial services platform, where the first author served as lead architect actively participating in granularity decisions while systematically collecting evidence. Results: The rolling analysis treated the initial months as calibration warm-up and identified the first actionable over-decomposition signal in February 2024, when negative Net Benefit values indicated architectural degradation. These quantitative signals were interpreted through triangulation with qualitative observations from sprint retrospectives and architecture review meetings. During the prospective intervention phase, Granulify supported the team in identifying efficient decomposition periods, detecting empirical saturation before further fragmentation, and performing a strategic consolidation that was associated with the highest Saturation Score values of the observation period. Conclusion: Granulify provides actionable, evidence-based support for architectural decisions that traditionally relied on subjective judgement, supporting teams in detecting saturation signals and adjusting service boundaries before incurring unnecessary complexity and costs.

Defining and managing appropriate service granularity remains a recurring challenge in the design and evolution of microservices-based systems, directly affecting modularity, maintenance, and operational efficiency. This paper presents early empirical evidence supporting Granulify, a continuous granularity-management approach that dynamically adjusts service boundaries throughout the system lifecycle. Although still preliminary, the results already point to tangible benefits in modularity, maintainability, and operational cost, underscoring the method’s industrial applicability. The proposal is being validated through the reengineering of a real-world investment management platform from a major financial institution in Brazil. The analysed platform manages over 40 million transactions monthly and supports more than 250K internal users across investment, compliance, and trading domains. Preliminary results indicate patterns of architectural fragmentation, productivity impacts, and signs of granularity saturation. We believe that continuous application of this approach will contribute to more informed architectural decisions, balancing modularity, maintenance effort, and operational costs. This ongoing research aims to consolidate Granulify as a practical solution to support teams in the evolutionary management of granularity in microservices architectures.

Surrogate models provide virtual representations that mirror physical objects or processes, serving distinct purposes in simulations and digital transformation. This review article examines how integrating surrogate modelling with artificial intelligence (AI) techniques can facilitate the iterative development of surrogate models and identify instances where additional data acquisition is necessary to enhance the performance of a surrogate model. This demonstrates the potential of combining AI with surrogate modelling in addressing some of the key challenges in the food and drink manufacturing industry. The paper also provides an accessible examination of AI and surrogate modelling in the food and drink manufacturing industry, offering a summary of current applications and advancements within the field. The key areas addressed by this article include the application of AI and ML in process control, prediction, and modelling for food manufacturing, as well as the advantages and limitations of AI-based surrogate modelling (SM), among other issues addressed. Based on the literature reviewed herein, AI-based surrogate models can be employed to optimise production processes and reduce the need for extensive physical prototyping in the food and drink manufacturing industry. This review emphasises AI-based surrogate modelling techniques tailored for complex food processing systems and distinguishes itself by bridging method-specific insights with practical industrial relevance. Additionally, this article reviews challenges and limitations in the food and drink manufacturing industry and the application of surrogate modelling, along with future directions for research in this rapidly evolving field.

Several software development methodologies and practices are taught in computer science and software engineering higher education degrees. This happens through individual modules and capstone projects and sometimes with participation from real clients. Different from industry, where processes are usually prescribed, students encounter company-agnostic artefacts and practises, often having to choose between the available options. Feedback from tutors, students and clients indicates this to be a challenge, with students often confused trying to mix-and-match different practices without the proper consideration of how they would work together. This paper introduces the SHU Development Process, covering all software development stages, that is instantiated into different levels of detail for students as they progress through their degree studies. The SHU Dev Process provides structured guidance to software development practices that can be followed through their chosen process flow or cherry-picked by students as needed. It has been created through a student-led project over multiple years. First applied during the academic year 2021/2 and iterated upon for 2022/3 in a capstone project module at Sheffield Hallam University, the process was evaluated annually by surveying students across different courses and levels of study. In initial surveys, students responded positively, and our experience provides valuable insight that other practitioners may draw upon to implement and evaluate a similar resource in the future.

Domain-driven design is one of the most used approaches for identifying microservice architectures, which should be built around business capabilities. There are a number of documentation with principles and patterns for its application. However, despite its increasing use there is still a lack of systematic approaches for creating the context maps that will be used to design the microservices. This article presents BPM2DDD, a systematic approach for identification of bounded contexts and their relationships based on the analysis of business processes models, which provide a business view of an organisation. We present an example of its application in a real business process, which has also be used to perform a comparative application with external analysts. The technique has been applied to a real project in the department of transport of a Brazilian state capital, and has been incorporated into the software development process employed by them to develop their new system.

Resumo A alta capacidade de disseminação do vírus SARS-CoV-2 fez com que vários países passassem a adotar providências excepcionais. Para assegurar a eficiência na fiscalização do cumprimento dessas determinações, os países começaram a valer-se da tecnologia da informação, entre elas o desenvolvimento de aplicativos de contact tracing. O uso dessa tecnologia enseja uma intervenção estatal no direito à privacidade, pois implica o tratamento de dados pessoais, de modo que se questiona a sua constitucionalidade no contexto do ordenamento jurídico brasileiro a partir da análise da sua proporcionalidade. Este trabalho, portanto, objetiva, com base no estado da arte apresentado, identificar os limites legais e constitucionais da utilização dos aplicativos de contact tracing pelo Estado brasileiro em um contexto de pandemia à luz do direito à privacidade, em face do conteúdo da LGPD e a partir da aplicação do critério da proporcionalidade. Nesse cenário, questiona-se: diante da colisão entre a proteção aos dados pessoais, o direito à privacidade e a tutela da saúde pública, é proporcional que o Estado faça uso de aplicações de contact tracing? A pesquisa fez uso do método dedutivo e pautou-se em uma análise exploratória e interdisciplinar, recorrendo tanto à dogmática jurídico-constitucional quanto ao conhecimento técnico da tecnologia da informação. É possível concluir que as aplicações de contact tracing devem ser construídas de modo a seguir o protocolo da descentralização, utilizando uma abordagem baseada em proximidade e técnicas seguras de transmissão de dados e encriptação de informações para facilitar a anonimização dos dados.

The reengineering of systems into a microservice-based architecture can be seen as an implementation of a service-oriented architecture (SOA). However, the deployment of SOA into an enterprise is a challenging task, as it may involve the modernization of mission-critical systems with high technical debt and high maintenance costs. To this end, a process is required to provide an appropriate set of steps and techniques that minimize risks and at the same time ensure the quality of the systems during the migration process. Thus, this work presents the Service-oriented Process for Reengineering and DevOps—SPReaD, an instantiation of the mainstream SOA methodology focusing on the reengineering of legacy systems integrating DevOps aspects for developing microservices systems. This process has been defined during a real software reengineering project of legacy systems from a Brazilian State Department of Taxation. The results obtained include a substantial improvement in the quality of the main taxation system used by the state, including not only code-related metrics but also performance improvements of the services offered, and a change in the methodology adopted by the software development team.

Traditionally, access control mechanisms have been hard-coded into application components. Such approach is error-prone, mixing business logic with access control concerns, and affecting the flexibility of security policies, as is the case with IFRN SUAP Django-based system. The externalization of access control rules allows their decoupling from business logic, through the use of authorization servers where access control policies are stored and queried for computing access decisions. In this context, this paper presents an approach that allows a Django Web application to delegate access control decisions to an external authorization server. The approach has been integrated into an enterprise level system, which has been used for experimentation. The results obtained indicate a negligible overhead, while allowing the modification of access control policies without interrupting the system.

A Internet das coisas (Internet of Things - IoT) está sendo utilizada em diversos domínios de aplicação, incluindo sistemas de controle de acesso físico. Entretanto, as soluções existentes não consideram a transposição da autenticação federada combinada com o acesso físico e acesso lógico unificado. Neste contexto, este artigo descreve uma solução para sistemas de controle de acesso físico baseada no padrão SAML de autenticação federada, no modelo de controle de acesso baseado em atributos (ABAC) e no padrão FIDO UAF para prover autenticação forte.