Layers and relations

A network is more than cables. A board says how things depend on each other, in a closed vocabulary that the diagram, the trace, the review and the exports all understand.

Layers

Every element sits on a layer, read from its colour:

Layer	Holds
Physical	Machines, appliances, cables, radios
Logical	Services, applications, flows of traffic
Security	Controls: firewalls, WAFs, identity providers, policies

Relations

A connection has a kind, and some kinds a verb that refines them:

Kind	Verbs	Points	Example
link	—	no direction	A cable or a radio between two interfaces
flow	—	as the traffic goes	HTTPS from the web tier to the API
placement	runs_on, hosted_on, scheduled_on, part_of	child → parent	A VM runs on a hypervisor; a pod on a node
depends	needs	dependent → dependency	An application needs DNS
security	protects, enforces, authenticates	control → what it covers	A WAF protects an application
resilience	replicates_to, backs_up_to, fails_over_to	source → target	A primary replicates to its replica

A connection with no kind means what it always meant: a link on the physical layer, a flow elsewhere. The list is closed — anything else is refused when the board is saved.

Arrows point from the element that would suffer to the one it rests on. That is the direction the impact trace walks: select a device and ask what breaks if it goes down.

Hosts drawn as zones

A server can be drawn as a zone holding what runs on it. The server device then names that zone as its boundary, so the board knows the zone and the device are the same machine.

Why it matters

Written as labels on ordinary links, “runs on” and “protects” read as traffic to everything except a person. As relations, the trace, the document view and the exports treat them as what they are — and an import from a hypervisor or Kubernetes draws them for you.