An internal platform must decide how much of the underlying infrastructure to hide. What determines the right abstraction level, and what happens at each extreme?

What determines it

The distribution of what teams actually need, not the average. A platform designed for the median team is too restrictive for the most demanding one and too complex for the simplest — and the most demanding team is usually the one whose workload justifies the platform's existence.

The two extremes

Too abstract: teams cannot express legitimate requirements, so they bypass the platform entirely for the one thing it does not support. One missing capability produces total defection, because there is no way to opt out of a piece.

Too thin: the platform is a wrapper over raw infrastructure, teams must understand everything anyway, and the abstraction adds a layer of indirection without removing any cognitive load. This is the more common failure, because it is what a platform becomes when it accretes options rather than making choices.

The resolution

A high-level default with graduated escape hatches. The common case is one command; the unusual case can override one component; the genuinely exceptional case can drop to the underlying primitives while keeping the rest of the platform's services.

The escape hatch is not an admission of failure — it is what prevents a single missing capability from costing you a customer.

The property that makes the abstraction survivable

It must not leak in ways that surprise. An abstraction that hides infrastructure until something fails, at which point the team must understand the layer they were told not to think about, has transferred the hardest part of the work to the least prepared moment.

So: expose the underlying state when debugging, make the mapping from abstraction to reality inspectable, and document the failure modes of the layer you are hiding.

The test

Adoption, voluntary and measured. If teams use it, the level is right for them. If a segment bypasses, ask them why — they have already done the analysis of why it did not fit, and it is usually two or three specific capabilities rather than a philosophical objection.