Internal Developer Platform  ·  View 07 of 21  ·  Structure

Layered Architecture

Eight layers, of which exactly two hold truth.

Editable source SVG draw.io All views
Surfaces Developer Portal Backstage on AKS Platform CLI Platform API the primary surface Generated Docs Intent Catalog Descriptor in the team repo Deployment Intent Infrastructure Intent Golden Path Pin template version Paved road Scaffolder Template Registry versioned Shared Pipeline consumed, not copied Drift and Update Bot Guardrails Policy Source policy as code Signed Bundle OCI in ACR Advisory Evaluation PR and pipeline Admission Evaluation binding Exception Register named · expiring Reconciliation Workload Reconciler Argo CD Infra Reconciler Terraform runners Provisioning State locked · RPO 0 Drift Detection Runtime and resources AKS Fleet namespace per component Managed Databases Messaging Service Bus DNS and Ingress Catalog and insight Software Catalog rebuildable projection Dependency Graph DORA and Adoption Data Explorer Cost by Owner Identity and audit Microsoft Entra ID groups · entitlements Workload Identity no static secrets Key Vault Broker Audit Store append-only · 7 years writes intent generates cached locally applies observed state Internal Developer Platform — Layered Architecture Application we own Interface / broker External / third party Data store Security / platform Decision point Queue / topic synchronous event / async Only two layers hold truth: intent in the team's repository, and the runtime's own state. Every other layer is derived and rebuildable. v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Intent sits in the team's repository as its own layer, above everything the platform owns, because that is where the source of truth lives (ADR-01).
  • Guardrails are a layer, not a property of the paved road above them — the two are drawn apart so no view can imply that leaving the road removes a control (ADR-05).
  • Catalog and insight sit below the runtime because they are derived from it, not the other way round (ADR-09).

Reads as

  • Downward is dependency, not request flow. The runtime does not call the portal, and the portal is never in a production request path (ADR-12).
  • Identity and audit span every layer rather than sitting at the bottom of a stack, which is why they are drawn as a band of their own.

Risks

  • A layered picture invites a layered team structure. The guardrail layer is authored by security and operated by the platform team; splitting ownership along the drawn lines would put two owners on one policy source.
  • Eight layers is at the edge of what a layered view can carry; the component view exists because this one deliberately omits interactions.
◀  Journey — Debug a Service the Platform Generated All views Container and Component View  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 21 views · 16 architecture decision records07-layered-architecture