Internal Developer Platform · View 21 of 21 · Assurance
The message that matters
- Message 7 — "not your component" — is the whole access model: entitlement is derived from catalog ownership, so there is no separate access list to fall out of date when a team reorganises (ADR-10).
- Workload identity is federated to Entra with no secret to rotate, distribute or leak (ADR-15).
- Every privileged action writes an audit event as a matter of course, not as an option a deployment can disable.
Consequences
- A wrong owner in the catalog is now an access-control fault, not a metadata fault — which is why an empty owning group is treated as an incident.
- Bulk re-attribution on a reorganisation moves entitlements with it, and the history of who owned what is retained.
Assumptions
- Entra groups are already the organisation's team structure, and are kept current by joiner-mover-leaver processes outside this platform (stated assumption).
- Token lifetimes short enough that revocation through group membership is effective within the hour.
