Internal Developer Platform  ·  View 15 of 21  ·  Runtime

One Policy Source, Two Evaluation Points

The same control, evaluated twice for different reasons — and identically for a component that never touched a template.

Editable source SVG draw.io All views
Author Publish Pull request Pipeline Admission Report Policy source Policy as Code reviewed by two Signed Bundle OCI artefact Version in Every Verdict On the paved road Bundle Pulled Advisory Verdict explains itself Build Gate Admitted Drift Reported Off the road Bundle Pulled No Advisory Check No Shared Pipeline Same Admission Check identical policy Counted in Coverage ≥ 99% Exception path Exception Requested Approved by Another expiry required Shown in the PR Admitted with Expiry Standing Register ≤ 25 active Evidence Change Audited Digest Recorded Verdict Stored Verdict Stored Verdict Stored Control Evidence Export 7 years Internal Developer Platform — One Policy Source, Two Evaluation Points Security / platform Data store Application we own Decision point Risk / gap Interface / broker The third lane is the point of the design: a component that never touched a template meets exactly the same binding check as one the platform generated. v 1.0 · owner Platform Architecture · date 2026-09

The lane that carries the argument

  • The off-road lane is the point of the whole design: no advisory check, no shared pipeline, and exactly the same binding admission check (ADR-05).
  • Advisory evaluation exists to be useful, binding evaluation exists to be unbypassable, and they are driven from one signed bundle so they cannot diverge (ADR-06).
  • The exception lane is drawn because relief always exists in practice; making it named, approved by another person and expiring is what stops it being a quiet policy edit (ADR-08).

Targets

  • Binding guardrail coverage ≥ 99% of production workloads including off-road ones; active exceptions ≤ 25, each expiring inside 90 days (stated assumptions).
  • Every verdict stored with its policy version, which is what makes the coverage figure auditable.

Risks

  • Fail-closed on new admissions and fail-open on running workloads is a deliberate asymmetry: an unevaluated change must not land, and a running service must never be evicted because the platform cannot think (ADR-06).
  • If advisory and binding ever diverge, engineers stop trusting the pull-request verdict — and then the platform has two checks and one useful one.
◀  Self-Service Provisioning All views Deployment Architecture on Azure  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 21 views · 16 architecture decision records15-guardrail-evaluation-lanes