The shell
Everything here is built as layers with boundaries between them. This page explains why, because the reasoning determines every other decision on the site.
A failure should have an edge
The question that matters in infrastructure is not whether something will fail. It is how far the failure travels before it stops.
A system built as one undifferentiated thing has no natural edge. A fault in call routing reaches numbering; a fault in numbering reaches connectivity; and the first symptom anybody notices is that nothing works, which is the least useful symptom available.
Building in layers puts an edge around each. When something fails, the question "what is affected" has an answer that was decided at design time rather than discovered at three in the morning.
Each layer holds one kind of risk
The connectivity layer holds the risk of not being able to make or take a call at all. Its failure mode is total for a site and invisible everywhere else.
The control layer holds the risk of a call reaching the wrong place. It fails partially: some flows work, some do not, and the symptom is confusion rather than silence.
The numbering layer holds the risk of a published number becoming unreachable, which is the most commercially expensive failure of the four because it is invisible to you and obvious to the caller.
The operation layer holds the risk of change. In practice it causes more incidents than the other three combined, which is why it is treated as a layer rather than as an activity.
Protection sits at each boundary
Encryption, authorisation and destination policy are applied at the connectivity boundary. Role-based access and recording controls at the control boundary. Presentation authority and porting verification at the numbering boundary. Change control and attribution at the operation boundary.
Applying everything everywhere sounds thorough and produces a system nobody can reason about. Applying the right protection at the right boundary produces one where a security question has a specific answer.
The limits of the metaphor
Layers do not make a single-circuit site resilient. That site is bounded by its circuit regardless of how carefully everything above it is separated, and the design says so rather than letting the architecture imply otherwise.
Nor do they remove the dependency between layers. Control depends on connectivity; numbering depends on both. What layering does is make the dependency explicit and the failure containable, not absent.
It changes what happens during an incident. Because each layer has a stated failure boundary, diagnosis starts by identifying which layer rather than by ruling out everything at once.
No. Most organisations take one or two. The boundaries mean adding another later does not require unpicking the first.
Where this is applied
Connectivity
The outermost layer. Whether a call can happen at all.
Open Layer twoControl
Where a call goes, and what happens when nobody answers.
Open Layer threeNumbering
What a caller dials, and whether it can ever be unreachable.
Open Layer fourOperation
Change, treated as a layer because it causes more incidents than failure does.
Open