An Architecture Decision Record (ADR) is a short document that captures a technical decision, the context behind it, and the consequences of choosing one option over another. It is usually lightweight, but it preserves the reasoning that would otherwise be lost in comments, tickets, or chat logs. In security work, that memory matters because controls, exceptions, and trust boundaries often depend on assumptions that are easy to forget.
ADRs help defenders explain why a system uses MFA, encryption, network segmentation, logging, or a specific cloud boundary, and what risk was accepted instead of being eliminated. They are useful during audits, incident response, and threat modeling because they show the intent behind an architecture. Attackers benefit when those decisions are undocumented: teams may keep old exceptions, weaken controls, or misconfigure changes without realizing the original security purpose. A good ADR keeps decision context close to the system it protects.