Enterprise software development has long been plagued by a fundamental disconnect: the gap between architectural intent and actual implementation. Static diagrams gather dust while code evolves, compliance reviews create month-long bottlenecks, and architectural decisions become lost knowledge scattered across documentation that nobody reads. Morgan Stanley felt this pain acutely until they decided to solve it with code.
On August 15, 2025, Morgan Stanley open-sourced CALM (Common Architecture Language Model) v1.0 through FINOS, marking a pivotal moment for the DevOps community. This isn’t just another tool release; it’s a battle-tested solution that has already streamlined over 1,400 internal deployments at Morgan Stanley and accelerated production timelines by months.
The Problem: Architecture’s DevOps Bottleneck
“Architecture is a critical part of the software development lifecycle,” explains Trevor Brosnan, Morgan Stanley’s global head of technology strategy, architecture, and modernization. “Architecture decisions are complex to change, so getting it right the first time is imperative.”
Traditional architecture documentation creates friction in modern DevOps pipelines. Teams spend weeks navigating security reviews, compliance checks, and architectural approvals that should be automated. Morgan Stanley’s engineers grew weary of these software development holdups, recognizing the problem went deeper than code, all the way to the basic building blocks of applications.
The banking giant’s solution emerged from a simple yet powerful insight: if infrastructure can be code, and configuration can be code, why can’t architecture be code too?
CALM: Architecture as Code Reimagined
CALM enables software architects to define, validate, and visualize system architectures in a standardized, machine-readable format, bridging the gap between architectural intent and implementation. Built on a JSON Meta Schema, CALM transforms architectural designs into executable specifications that both humans and machines can understand.
The framework structures architecture into three primary components: nodes (services, databases, networks), relationships (how components interact), and metadata (additional context and constraints). This modular approach allows architects to model everything from high-level system overviews to detailed microservices architectures.
Distinguished Engineer Matthew Bain explains that CALM “translates the design of an application into code, automating and continuously updating design diagrams, applying security and compliance controls along the way.”
Real-World Impact: From Months to Minutes
The numbers tell the story. CALM has already supported more than 1,400 internal deployments at Morgan Stanley, significantly speeding up the process of getting apps from development into production and shortening review processes by months. More broadly across the industry, CALM is already being used to document architectures of existing systems, enable pattern-based automated security approvals, and has underpinned well over 2,000 application deployments.
The secret lies in automation. Instead of manually shepherding applications through compliance reviews, CALM enables pattern-based approvals. “If you don’t want to use CALM and you want to go and use something that’s not a standardized pattern, you’re going to have to involve all the risk people,” notes Jim Gough, distinguished engineer and API platform lead architect.
This approach transforms the economics of enterprise software delivery. Pre-approved architectural patterns become reusable assets, enabling teams to deploy confidently without reinventing security and compliance wheels.
DevOps Integration: CI/CD for Architecture
CALM’s true power emerges in its seamless integration with modern DevOps workflows. The framework treats architectural definitions like any other code asset, version-controlled, testable, and automatable. Teams can validate architectural compliance in their CI/CD pipelines, catching design issues before they reach production.
The CALM CLI provides immediate feedback on architectural decisions, enabling real-time validation during development. This shifts compliance left in the development lifecycle, transforming potential deployment roadblocks into preventable design issues.
Key benefits for DevOps teams include machine-readable architecture definitions that eliminate manual interpretation errors, version control for architectural changes that provides clear change history, and real-time feedback on compliance violations that prevent downstream issues.
Beyond Financial Services
While CALM emerged from Morgan Stanley’s financial services requirements, its applications extend far beyond banking. Any organization dealing with complex system architectures, regulatory compliance, or lengthy approval processes can benefit from architecture as code.
The framework addresses universal DevOps challenges: maintaining consistency across distributed teams, automating compliance and security reviews, accelerating deployment cycles, and creating reusable architectural patterns that encode organizational best practices.
As one FINOS contributor noted, “This one is a no-brainer for everyone. You can have validation of your architecture from your security team faster, which means you move faster to production, which is good for the business.”
“Morgan Stanley’s open-sourcing of CALM represents a genuine innovation that turns architecture into a machine-readable, dynamic asset rather than a static liability,” according to Mitch Ashley, VP and Practice Lead Software Lifecycle Engineering, The Futurum Group. “This move bridges a critical gap in enterprise DevOps by enabling automated security and compliance validation. In large, complex organizations, architecture-as-code could become the key to unlocking the next phase of agentic AI, where autonomous systems can now interpret and enforce architectural integrity.”
Getting Started with CALM
CALM is available now through FINOS as an open-source project. The framework includes a CLI for generating, validating, and visualizing architectures, along with comprehensive documentation and examples. Organizations can start small by codifying existing architectural patterns before expanding to full architecture-as-code workflows.
The timing couldn’t be better. As enterprises accelerate digital transformation initiatives, the need for scalable, automated architectural governance has never been greater. CALM provides the missing link between architectural intent and operational reality, enabling DevOps teams to move fast without breaking compliance.
Morgan Stanley’s decision to open-source this battle-tested solution represents more than corporate goodwill—it’s recognition that architecture as code benefits the entire industry. When deployment cycles accelerate and compliance becomes automated, everyone wins.
The question isn’t whether your organization needs architecture as code—it’s whether you’ll lead the transformation or follow it.
