Image without description
  • Jacco Meijer
  • |
  • Mar 9, 2026

  1. Capability is not confused. It is occupied

Most capability work fails before it starts because it does not ask which type of claim it is making. A diagnostic language for enterprise and security architects.

Part of the series: Capability is everywhere in the organisation. For architects it is a strategic element. For everyone else it is what they do daily.

Capability is precise. It is also plural.

Architects understand capability with precision. In ArchiMate, capability sits in the Strategy Layer: the ability an organisation, person or system possesses, expressed in general and high-level terms, aimed at outcomes and realised by a combination of organisation, people, processes, information and technology. It is clearly defined, deliberately placed and central to the decisions that matter. That precision comes from the language. It is the right place to start.

For everyone else in the organisation, capability is simply what gets done. Not a framework element and not a mapped asset. Just the daily work that makes the organisation what it is.

The Open Agile Architecture (OAA) Standard noticed this. It defines capability once cleanly in chapter 2: the ability that an organisation, person or system possesses. It then returns to it in chapter 17 and works through six definitions and still finds none of them quite right.

The signal is this: a standard that settles capability in two sentences needs six definitions and a position statement to handle it in operations architecture. That is not a terminology dispute. The concept is doing different work in different contexts and the frameworks have not caught up.

Capability from the OAA Standard

The Standard is precise: when capability is used to mean an activity, even a self-contained one, two issues follow. Terminology becomes a source of confusion and the risk of limiting the range of possible solutions is higher.

When capability is routinely treated as an activity, it limits the range of possible solutions before the problem is fully understood.

The Standard's position is that operational capabilities should refer to outcomes the operating system delivers. Its examples are deliberately concrete, such as delivering inexpensive food quickly from a standard menu with a defined quality level. Not what the organisation has. Not what it does. What it achieves, reliably and repeatedly.

The Standard cites Amartya Sen to make the distinction concrete. When a person enjoys a capability, it implies they have the freedom to exercise it. Having a capability and being able to exercise it are not the same thing.

The OAA maps a specific part of the landscape. The territory is wider. The perspectives that follow provide a structured entry.

Six questions

Capability is not confused. It is occupied, doing different work in different contexts and asking a different question depending on where you stand. The table maps six perspectives, each with its own question.

PerspectiveCore question
Enterprise modellingWhat are we structured to do?
Strategic planningWhat can we achieve?
Operational performanceWhat is demonstrably done?
Human developmentCan this capability actually be exercised?
Systems engineeringWhat fails when components interact?
Adaptive systemsWhat becomes possible when components interact?

This is not an exhaustive survey of perspectives. It covers the most relevant to enterprise and security architects. It includes Human development because the OAA introduces it through Sen and it highlights Adaptive systems as the condition where capabilities most visibly fail or surprise.

Behind these questions lie two types of capability claim. Strategic capabilities describe what an organisation is structured to do or could achieve. They are claims about potential. Operational capabilities describe what is demonstrably done. They are claims about reality.

ArchiMate makes the separation formal. Capability belongs to the Strategy Layer, expressing what the organisation can do. The business functions that realise it belong to the Business Layer, expressing how it is done. They are related by a realisation relationship. They are not the same element and they are not interchangeable.

Most failure begins when they are treated as if they are. The errors are structural and often invisible from inside the frame that created them. This is why the first question in any capability exercise is prior and non-negotiable: which type of claim is this? If that question is not answered first, everything that follows is unstable.

The human condition as condition

The OAA's citation of Sen is not decorative. It introduces a question most capability frameworks do not ask: can the people this capability is meant to serve actually exercise it?

Consider three common examples. A security awareness programme that treats people as the problem rather than the asset. An incident reporting process that creates fear rather than safety. A zero trust architecture that assumes a level of digital literacy most users do not have. In each case the capability exists formally, mapped, documented and assessed, but fails in practice because adoption was never treated as a condition.

This is what Sen means by real freedom. Resources, activities and outcomes are not the same as the freedom to exercise them.

Most enterprise capability maps describe representations, not capabilities. They describe what the organisation believes is true, not what people can actually do.

This is not only a failure mode. It introduces a condition: any capability must be tested against the conditions in which it operates. That argument is developed in full in the second post in this series. What matters here is the pattern it reveals: the nature of a capability claim determines what evidence can honestly support it.

What experienced architects already know

Experienced architects already navigate this terrain. They move between perspectives, adjust language to context and apply conditions without naming them. When they say a capability looks good on paper but needs to be seen under pressure, they are testing conditions. When they ask whether it actually works, they are invoking the feedback loop.

What is missing is not intuition. It is a shared language precise enough to make that intuition transferable across disciplines and legible to the people who work alongside architects.

The proliferation of definitions across this post is itself a signal. Capability resists unification because it is doing different work in different contexts. The multiplicity is not a flaw in the concept. It is a feature of the territory.

An architect fluent across these meanings, who can move between strategic and operational and who understands what each perspective is asking, is not navigating confusion. They know which question they are answering and why. Most organisations do not.

Where this goes

The nature distinction is the foundation. What sits above it is a conditions layer: a structured way of asking whether a capability holds in the environment it must actually operate in. That is the subject of the second post in this series:

Image without description
  • Jacco Meijer
  • |
  • Mar 16, 2026

  1. Having a capability and being able to exercise it are not the same thing

Formal capability is not real capability. A conditions layer for testing whether a capability holds in the environment it must actually operate in.


References

  • ArchiMate: The Open Group. ArchiMate 3.2 Specification. Document Number: C226. Published October 2022.
  • OAA Standard (Operations Architecture): The Open Group. Operations Architecture Standard.
  • Sen, A. (1999). Development as Freedom. Oxford University Press.
  • Nussbaum, M.C. (2011). Creating Capabilities: The Human Development Approach. Harvard University Press.
  • UNDP Human Development Reports: United Nations Development Programme.
  • The Open Group Architecture Framework (TOGAF): The Open Group. TOGAF Standard, various editions.
  • Zachman, J.A. (1987). A Framework for Information Systems Architecture. IBM Systems Journal, 26(3).
  • BIZBOK Guide: Business Architecture Guild. A Guide to the Business Architecture Body of Knowledge.

Other posts

Image without description
  • Jacco Meijer
  • |
  • Mar 23, 2026

  1. What we do is not the same as how we do it

Six failure modes that follow when that distinction collapses. A diagnostic instrument for architects who need to know not just what went wrong but which mismatch drove it.

Image without description
  • Jacco Meijer
  • |
  • Mar 16, 2026

  1. Having a capability and being able to exercise it are not the same thing

Formal capability is not real capability. A conditions layer for testing whether a capability holds in the environment it must actually operate in.

Image without description
  • Jacco Meijer
  • |
  • Feb 2, 2026

Four architects and the limits of personality

Why legal, empirical and behavioural limits keep personality tools and role frameworks apart

Image without description
  • Jacco Meijer
  • |
  • Jan 5, 2026

Four architects and why we need all of them

What sounds like a casual observation is actually a structural truth: architecture isn’t about personalities, but about competing stances your organisation cannot afford to miss.

Image without description
  • Jacco Meijer
  • |
  • Oct 22, 2025

What cyber security mistakes do organizations still make?

A brief check on how the AI response for this question compares to real life experience.

Image without description
  • Jacco Meijer
  • |
  • Oct 19, 2025

Risk analysis for software development

By systematically identifying and assessing potential risks, teams can reduce uncertainty and prevent costly issues.

Image without description
  • Jacco Meijer
  • |
  • Oct 18, 2025

Security controls for software development

Exploring how security controls protect and improve every stage of the DevSecOps workflow.

Image without description
  • Jacco Meijer
  • |
  • Oct 17, 2025

Software development security

On risk assessments, security controls and the complexity of securing the Software Development Lifecycle (SDLC)

Image without description
  • Jacco Meijer
  • |
  • Oct 14, 2025

Canonical controls with Enterprise Risk and Security Management

How to use the SCF canonical control objectives with ERSM in Archimate

Image without description
  • Jacco Meijer
  • |
  • Oct 7, 2025

ISO 27000, ISA 62443, NIS2, BIO, NIST CSF and NIST SP 800-53

How to align the steadily increasing number of cyber security frameworks, standards and regulations?

Image without description
  • Jacco Meijer
  • |
  • Aug 15, 2025

Asset security

Information asset identification and classification from a security perspective

Image without description
  • Jacco Meijer
  • |
  • Aug 8, 2025

Data security

Data identification, data roles and data classification from a security perspective

Image without description
  • Jacco Meijer
  • |
  • Jul 25, 2025

Threat modeling, security frameworks and Enterprise Architecture

Combining ISO 27001, NIST CSF and threat modeling with Enterprise Architecture strengthens all elements

Image without description
  • Jacco Meijer
  • |
  • Jul 18, 2025

Threat modeling as part of a risk framework

Threat modeling in the context of ISO 27001 and NIST CSF

Image without description
  • Jacco Meijer
  • |
  • Jul 11, 2025

Cyber security risk frameworks

Managing cyber security risk with ISO 27001 and NIST CSF

Image without description
  • Jacco Meijer
  • |
  • Jun 27, 2025

NIST CSF Tiers for cyber security risk governance and management

NIST CSF 2.0 contains useful tiers for Capability Maturity Modeling in Enterprise Architecture

Image without description
  • Jacco Meijer
  • |
  • Jun 20, 2025

Archimate risk assessment elements

A few simple specializations for working with risk assessments in Archimate

Image without description
  • Jacco Meijer
  • |
  • Jun 13, 2025

Security principles in Enterprise Architecture

Adding security principles to Enterprise Architecture for NIST CSF and ISO 27001

Image without description
  • Jacco Meijer
  • |
  • Jun 6, 2025

Combining ISO 27001 and NIST CSF

How to use ISO 27001 and NIST Cyber Security Framework together

Image without description
  • Jacco Meijer
  • |
  • May 1, 2025

CISSP certification and Enterprise Architecture

How do the CISSP certification domains relate to Enterprise Architecture and the ArchiMate layers?

Image without description
  • Jacco Meijer
  • |
  • Apr 23, 2025

Architect roles in the ArchiMate context

An ArchiMate model that maps architect roles to the ArchiMate framework layers.

Image without description
  • Jacco Meijer
  • |
  • Mar 18, 2025

Visualizing IT Architecture in three languages, UML, C4 and ArchiMate

What are the differences and what are these languages most used for?

Image without description
  • Jacco Meijer
  • |
  • Feb 18, 2025

OAuth 2.0 and OpenID Connect Sequence Diagrams

Technical specs can be hard to read. While still highly technical, the UML Sequence Diagrams provided in this blog are a lot easier to understand.

Image without description
  • Jacco Meijer
  • |
  • Jan 9, 2025

OWASP and CISSP

OWASP recommendations from the independent information security certification CISSP.

Image without description
  • Jacco Meijer
  • |
  • Mar 21, 2024

UI Library with MDX documentation

Using the simple Render JSX plugin for Esbuild this post shows how to setup a simple UI library.

Image without description
  • Jacco Meijer
  • |
  • Mar 20, 2024

Render JSX plugin for Esbuild

Transform Esbuild generated JSX bundles to HTML pages.

Image without description
  • Jacco Meijer
  • |
  • Mar 19, 2024

Esbuild as a static site generator for MDX

Static site generators gain popularity. This blog is about using Esbuild as a static site generator for MDX.

Image without description
  • Jacco Meijer
  • |
  • Mar 18, 2024

11ty and Github pages

Simplifying the Contentful-Gatsby-Netlfy trio.

Image without description
  • Jacco Meijer
  • |
  • Jun 30, 2022

NPM7 and @npmcli/arborist

@npmcli/arborist is a powerful library that handles the new NPM 7 workspaces. This blog is about a simple make tool that uses the library.

Image without description
  • Jacco Meijer
  • |
  • May 12, 2022

Comparing React app, Nextjs and Gatsby

A new React project starts with a React toolchain. Main tools in the chains are SSR, React server components and GraphQL.

Image without description
  • Jacco Meijer
  • |
  • May 10, 2022

Versioning strategy for NPM modules

It is important to be able to bump the version of a NPM package without side effects.

Image without description
  • Jacco Meijer
  • |
  • Apr 12, 2022

React component themes and CSS variables

Creating React components with flexible themes by using CSS variables.

Image without description
  • Jacco Meijer
  • |
  • Mar 21, 2022

Content modeling with variants

The efficiency of a variant field in a content model.

Image without description
  • Jacco Meijer
  • |
  • Mar 12, 2022

Documentation

Documenting a software project is challenging. Here's a few simple guidelines that help a team writing clear documentation.

Image without description
  • Jacco Meijer
  • |
  • Mar 11, 2022

Javascript history

In 1986 David Ungar and Randall B. Smith developed Self at Xerox PARC. Inspired by Java, Scheme and Self Brendan Eich created Javascript in 1995.

Image without description
  • Jacco Meijer
  • |
  • Mar 10, 2022

On Javascript transpilers, bundlers and modules

There's Javascript transpilers, modules, bundles and bundlers. This is a brief overview of all of these.

Image without description
  • Jacco Meijer
  • |
  • Feb 11, 2022

Agile Scrum

The Agile Scrum framework is flexible enough to be used in many different ways. Here's one way of working.

Image without description
  • Jacco Meijer
  • |
  • Jan 20, 2022

What happened to Wheelroom?

Founded in 2018. Started to fly in 2020 and abandoned in 2021. What happened?

Image without description
  • Jacco Meijer
  • |
  • Jan 19, 2022

Contentful, Netlify and Gatsby four years later

What did we learn from using Contentful for four years?

Image without description
  • Jacco Meijer
  • |
  • Jan 18, 2022

Typescript interface for React UI components

How to define an interface for React UI components that prevents breaking changes.

Image without description
  • Jacco Meijer
  • |
  • Jan 17, 2022

Naming React components

What's in a name? A clear naming strategy helps developers communicate. Most devs rather spend time writing component code than wasting time on a good component name.