[ { "id": "01-system-context", "title": "Internal Developer Platform — System Context", "layout": "context", "system": { "label": "Internal Developer Platform", "sub": "Paved road · guardrails" }, "groups": [ { "side": "left", "title": "People", "nodes": [ { "id": "dev", "label": "Product Engineer", "kind": "actor", "rel": "scaffolds · deploys", "dir": "in" }, { "id": "lead", "label": "Tech Lead", "kind": "actor", "rel": "owns components", "dir": "in" }, { "id": "plat", "label": "Platform Engineer", "kind": "actor", "rel": "ships the road", "dir": "in" }, { "id": "sec", "label": "Security Engineer", "kind": "actor", "rel": "authors policy", "dir": "in" } ] }, { "side": "right", "title": "Azure estate", "nodes": [ { "id": "sub", "label": "Landing Zone", "kind": "external", "rel": "subscriptions" }, { "id": "aks", "label": "AKS Fleet", "kind": "external", "rel": "runs workloads" }, { "id": "paas", "label": "Managed Data Services", "kind": "external", "rel": "provisioned" } ] }, { "side": "top", "title": "Source and supply chain", "nodes": [ { "id": "git", "label": "GitHub Enterprise", "kind": "external", "rel": "intent", "kind2": "bidirectional" }, { "id": "acr", "label": "Container Registry", "kind": "external", "rel": "signed images" } ] }, { "side": "bottom", "title": "Governance and money", "nodes": [ { "id": "entra", "label": "Microsoft Entra ID", "kind": "security", "rel": "entitlements" }, { "id": "cost", "label": "Cost Management", "kind": "external", "rel": "spend", "kind2": "batch" }, { "id": "grc", "label": "Risk and Audit", "kind": "external", "rel": "evidence", "kind2": "batch" } ] } ], "note": "The platform is a tenant of the landing zone, not its owner: it provisions inside subscriptions the landing zone hands it.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "Internal Developer Platform — High-Level Architecture", "layout": "flow", "chain": true, "stages": [ { "title": "Ask", "nodes": [ { "id": "h-portal", "label": "Developer Portal", "kind": "app", "sub": "Backstage" }, { "id": "h-cli", "label": "Platform CLI", "kind": "app" } ] }, { "title": "Declare", "nodes": [ { "id": "h-scaf", "label": "Scaffolder", "kind": "app", "sub": "golden paths" }, { "id": "h-repo", "label": "Team Repository", "kind": "external", "sub": "intent · source of truth" } ] }, { "title": "Build", "nodes": [ { "id": "h-ci", "label": "Shared Pipeline", "kind": "app", "sub": "GitHub Actions" }, { "id": "h-reg", "label": "Signed Artefact", "kind": "store", "sub": "ACR · attested" } ] }, { "title": "Check", "nodes": [ { "id": "h-adv", "label": "Advisory Policy", "kind": "decision", "sub": "in the pull request" }, { "id": "h-bind", "label": "Admission Policy", "kind": "security", "sub": "binding · unbypassed" } ] }, { "title": "Reconcile", "nodes": [ { "id": "h-gitops", "label": "Workload Reconciler", "kind": "app", "sub": "Argo CD" }, { "id": "h-infra", "label": "Infra Reconciler", "kind": "app", "sub": "Terraform runners" } ] }, { "title": "Run", "nodes": [ { "id": "h-aks", "label": "Shared AKS Runtime", "kind": "platform", "sub": "namespace per component" }, { "id": "h-res", "label": "Managed Resources", "kind": "store", "sub": "SQL · bus · DNS" } ] }, { "title": "Observe", "nodes": [ { "id": "h-cat", "label": "Software Catalog", "kind": "store", "sub": "projection" }, { "id": "h-ins", "label": "Adoption and DORA", "kind": "app", "sub": "platform's scoreboard" } ] } ], "note": "The portal writes intent into the team's repository and stops. Everything downstream reconciles towards that declaration.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "03-actors-and-journeys", "title": "Internal Developer Platform — Actors and Their Core Journeys", "layout": "actors", "groups": [ { "title": "The people who ship product", "kind": "boundary", "actors": [ { "id": "a-dev", "label": "Product Engineer", "sub": "900 of them", "goal": "Get my service running in production today, without learning the cloud account model or filing a ticket.", "journeys": [ { "id": "j-new", "label": "Create and ship a service", "sub": "≤ 2 h to first deploy" }, { "id": "j-prov", "label": "Add a database", "sub": "≤ 12 min" }, { "id": "j-deploy", "label": "Release a change", "sub": "≤ 25 min to prod" } ] }, { "id": "a-lead", "label": "Tech Lead", "sub": "140 teams", "goal": "Know what my team owns, what it costs, and what is failing its controls — on one page.", "journeys": [ { "id": "j-own", "label": "Review what we own" }, { "id": "j-drift", "label": "Clear template drift" }, { "id": "j-off", "label": "Argue for leaving the road" } ] }, { "id": "a-oncall", "label": "On-Call Engineer", "sub": "03:00, alone", "goal": "Understand a service I did not write, on a substrate I have never seen, before the page escalates.", "journeys": [ { "id": "j-debug", "label": "Debug a paved-road service", "sub": "the leaky abstraction" }, { "id": "j-roll", "label": "Roll back a release", "sub": "≤ 5 min" } ] } ] }, { "title": "The people who own the platform", "kind": "onprem", "actors": [ { "id": "a-plat", "label": "Platform Engineer", "sub": "12 of them", "goal": "Change something once and have it land across 1,400 components without breaking anyone's Friday.", "journeys": [ { "id": "j-path", "label": "Publish a golden path" }, { "id": "j-mig", "label": "Drive a migration", "sub": "1,400 components" }, { "id": "j-support", "label": "Answer a support request" } ] }, { "id": "a-sec", "label": "Security Engineer", "sub": "authors the controls", "goal": "Have a control apply to every running workload, including the ones that never touched a template.", "journeys": [ { "id": "j-policy", "label": "Ship a binding guardrail" }, { "id": "j-exc", "label": "Rule on an exception" }, { "id": "j-cov", "label": "Report control coverage" } ] }, { "id": "a-fin", "label": "FinOps Analyst", "sub": "one per estate", "goal": "Attribute every pound of cloud spend to a team without a reconciliation spreadsheet.", "journeys": [ { "id": "j-attr", "label": "Trace spend to an owner" }, { "id": "j-idle", "label": "Reclaim idle resources" } ] } ] }, { "title": "Who this is not for", "kind": "plain", "actors": [ { "id": "a-user", "label": "End Customer", "sub": "never sees it", "goal": "Get a product that changes faster and breaks less, and never hear the word platform.", "journeys": [ { "id": "j-none", "label": "Benefits invisibly", "sub": "lead time · failure rate" } ] }, { "id": "a-lz", "label": "Landing Zone Team", "kind": "external", "sub": "the platform's landlord", "goal": "Hand out subscriptions and network with a policy floor, and not be asked about anyone's Helm chart.", "journeys": [ { "id": "j-sub", "label": "Issues subscriptions" }, { "id": "j-floor", "label": "Sets the Azure Policy floor" } ] } ] } ], "note": "Three engineer-facing personas, not one: the person creating a service, the person owning it a year later, and the person woken by it are rarely the same human.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "04-journey-ship-a-new-service", "title": "User Journey — Product Engineer Creates and Ships a New Service", "layout": "journey", "actor": { "label": "Product Engineer", "sub": "third week on the team", "goal": "Have a real service serving real traffic before the end of the day", "trigger": "A story that needs a new component, and a sprint that ends Friday", "success": "Running in production, owned, observable, and passing every control" }, "phases": [ { "title": "Decide", "sub": "which path" }, { "title": "Scaffold", "sub": "one action" }, { "title": "Provision", "moment": true, "sub": "≤ 12 min" }, { "title": "Build", "sub": "shared CI" }, { "title": "Ship to prod", "moment": true }, { "title": "Own it" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Picks a golden path" } ], [ { "label": "Names it and its team" } ], [ { "label": "Declares a database" } ], [ { "label": "Writes the actual code" } ], [ { "label": "Merges to main" } ], [ { "label": "Adds an alert rule" } ] ] }, { "title": "Where", "kind": "touch", "cells": [ [ { "label": "Portal catalogue" } ], [ { "label": "Portal · or CLI" } ], [ { "label": "Pull request" } ], [ { "label": "Editor" } ], [ { "label": "Pull request" } ], [ { "label": "Component page" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Shows 5 paths" } ], [ { "label": "Repo · pipeline · IaC" }, { "label": "Catalog entry" } ], [ { "label": "Reconciles intent" }, { "label": "Identity · secret path" } ], [ { "label": "Builds · signs" }, { "label": "Advisory verdict" } ], [ { "label": "Admission check" }, { "label": "Canary and analysis" } ], [ { "label": "Wires cost · on-call" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Delighted", "Fine", "Frustrated" ], "points": [ 1, 2, 0, 2, 1, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "Which path fits?" } ], [], [ { "label": "Quota refused it" } ], [], [ { "label": "Waits on the canary" } ], [] ] } ], "note": "The trough is a quota rejection during provisioning. It is survivable only because the message names the team's quota and the person who can raise it, rather than returning a cloud error code.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "05-journey-platform-migration", "title": "User Journey — Platform Engineer Drives a Change Across 1,400 Components", "layout": "journey", "actor": { "label": "Platform Engineer", "sub": "one of twelve", "goal": "Retire a template version everyone is still on, without becoming the reason a team missed a release", "trigger": "A base image reaching end of support in 90 days", "success": "Zero components below the supported floor, and no ticket raised to get there" }, "phases": [ { "title": "Measure", "sub": "who is where" }, { "title": "Publish", "sub": "new version" }, { "title": "Automate", "sub": "1,180 PRs" }, { "title": "Chase the tail", "moment": true }, { "title": "Enforce", "moment": true }, { "title": "Retire" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Reads the drift report" } ], [ { "label": "Ships template v9" } ], [ { "label": "Opens the update PRs" } ], [ { "label": "Talks to 40 teams" } ], [ { "label": "Sets the floor to v8" } ], [ { "label": "Deletes v7" } ] ] }, { "title": "Where", "kind": "touch", "cells": [ [ { "label": "Adoption dashboard" } ], [ { "label": "Template registry" } ], [ { "label": "Bot PRs" } ], [ { "label": "Chat · office hours" } ], [ { "label": "Policy bundle" } ], [ { "label": "Changelog" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "1,180 track · 220 fork" } ], [ { "label": "Canary component first" } ], [ { "label": "PR per tracking repo" } ], [ { "label": "Nothing — forks manual" } ], [ { "label": "Advisory, then binding" } ], [ { "label": "Drift returns to zero" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "In control", "Working", "Stuck" ], "points": [ 1, 2, 2, 0, 1, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [], [ { "label": "PR fatigue in teams" } ], [ { "label": "220 forks, by hand" } ], [ { "label": "Feels like a mandate" } ], [] ] } ], "note": "The trough is the forked tail: 16% of components absorb most of the migration effort. That ratio, not the portal, is what decides whether twelve engineers can serve nine hundred.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "06-journey-oncall-golden-path", "title": "User Journey — On-Call Engineer Debugs a Service the Platform Generated", "layout": "journey", "actor": { "label": "On-Call Engineer", "sub": "03:14, six months in", "goal": "Find out why a service I did not write is failing, on a runtime I have never had to look at", "trigger": "An SLO burn alert on a component scaffolded by someone who has left the team", "success": "Cause understood or rolled back, inside the 30-minute escalation window" }, "phases": [ { "title": "Paged", "sub": "alert fires" }, { "title": "Orient", "moment": true }, { "title": "Look inside", "moment": true, "sub": "it leaks" }, { "title": "Decide" }, { "title": "Recover", "sub": "≤ 5 min" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Opens the alert link" } ], [ { "label": "Reads component page" } ], [ { "label": "Needs the pod itself" } ], [ { "label": "Chooses rollback" } ], [ { "label": "Confirms recovery" } ] ] }, { "title": "Where", "kind": "touch", "cells": [ [ { "label": "Pager" } ], [ { "label": "Component page" } ], [ { "label": "Escape hatch · kubectl" } ], [ { "label": "Platform CLI" } ], [ { "label": "Dashboards" } ] ] }, { "title": "What the platform does", "kind": "system", "cells": [ [ { "label": "Routes to owning rota" } ], [ { "label": "Deploys · deps · docs" } ], [ { "label": "Grants scoped read" } ], [ { "label": "Rollback, pipeline-free" } ], [ { "label": "Records the event" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Confident", "Coping", "Lost" ], "points": [ 1, 2, 0, 1, 2 ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "Owner group is stale" } ], [ { "label": "Never seen the substrate" } ], [], [] ] } ], "note": "This is the journey that prices the abstraction question. Every concept the golden path hides is a concept somebody meets for the first time at 03:00, which is why the escape hatch is a designed path rather than a leak.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "07-layered-architecture", "title": "Internal Developer Platform — Layered Architecture", "layout": "bands", "bands": [ { "name": "Surfaces", "nodes": [ { "id": "l-portal", "label": "Developer Portal", "kind": "app", "sub": "Backstage on AKS" }, { "id": "l-cli", "label": "Platform CLI", "kind": "app" }, { "id": "l-api", "label": "Platform API", "kind": "integration", "sub": "the primary surface" }, { "id": "l-docs", "label": "Generated Docs", "kind": "app" } ] }, { "name": "Intent", "nodes": [ { "id": "l-desc", "label": "Catalog Descriptor", "kind": "external", "sub": "in the team repo" }, { "id": "l-dep", "label": "Deployment Intent", "kind": "external" }, { "id": "l-infra", "label": "Infrastructure Intent", "kind": "external" }, { "id": "l-pin", "label": "Golden Path Pin", "kind": "external", "sub": "template version" } ] }, { "name": "Paved road", "nodes": [ { "id": "l-scaf", "label": "Scaffolder", "kind": "app" }, { "id": "l-tpl", "label": "Template Registry", "kind": "store", "sub": "versioned" }, { "id": "l-pipe", "label": "Shared Pipeline", "kind": "app", "sub": "consumed, not copied" }, { "id": "l-drift", "label": "Drift and Update Bot", "kind": "app" } ] }, { "name": "Guardrails", "accent": "#e1d5e7", "nodes": [ { "id": "l-pol", "label": "Policy Source", "kind": "security", "sub": "policy as code" }, { "id": "l-bundle", "label": "Signed Bundle", "kind": "security", "sub": "OCI in ACR" }, { "id": "l-adv", "label": "Advisory Evaluation", "kind": "decision", "sub": "PR and pipeline" }, { "id": "l-adm", "label": "Admission Evaluation", "kind": "security", "sub": "binding" }, { "id": "l-exc", "label": "Exception Register", "kind": "security", "sub": "named · expiring" } ] }, { "name": "Reconciliation", "nodes": [ { "id": "l-argo", "label": "Workload Reconciler", "kind": "app", "sub": "Argo CD" }, { "id": "l-tf", "label": "Infra Reconciler", "kind": "app", "sub": "Terraform runners" }, { "id": "l-state", "label": "Provisioning State", "kind": "store", "sub": "locked · RPO 0" }, { "id": "l-detect", "label": "Drift Detection", "kind": "app" } ] }, { "name": "Runtime and resources", "nodes": [ { "id": "l-aks", "label": "AKS Fleet", "kind": "platform", "sub": "namespace per component" }, { "id": "l-sql", "label": "Managed Databases", "kind": "store" }, { "id": "l-bus", "label": "Messaging", "kind": "queue", "sub": "Service Bus" }, { "id": "l-net", "label": "DNS and Ingress", "kind": "integration" } ] }, { "name": "Catalog and insight", "nodes": [ { "id": "l-cat", "label": "Software Catalog", "kind": "store", "sub": "rebuildable projection" }, { "id": "l-graph", "label": "Dependency Graph", "kind": "store" }, { "id": "l-dora", "label": "DORA and Adoption", "kind": "app", "sub": "Data Explorer" }, { "id": "l-cost", "label": "Cost by Owner", "kind": "app" } ] }, { "name": "Identity and audit", "accent": "#e1d5e7", "nodes": [ { "id": "l-entra", "label": "Microsoft Entra ID", "kind": "security", "sub": "groups · entitlements" }, { "id": "l-wi", "label": "Workload Identity", "kind": "security", "sub": "no static secrets" }, { "id": "l-kv", "label": "Key Vault Broker", "kind": "security" }, { "id": "l-audit", "label": "Audit Store", "kind": "store", "sub": "append-only · 7 years" } ] } ], "edges": [ { "from": "l-api", "to": "l-desc", "label": "writes intent", "kind": "sync" }, { "from": "l-scaf", "to": "l-desc", "label": "generates", "kind": "sync" }, { "from": "l-bundle", "to": "l-adm", "label": "cached locally", "kind": "sync" }, { "from": "l-argo", "to": "l-aks", "label": "applies", "kind": "sync" }, { "from": "l-aks", "to": "l-cat", "label": "observed state", "kind": "async" } ], "note": "Only two layers hold truth: intent in the team's repository, and the runtime's own state. Every other layer is derived and rebuildable.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "08-platform-components", "title": "Internal Developer Platform — Container and Component View", "layout": "nested", "boxes": [ { "title": "Experience plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Surfaces", "kind": "plain", "nodes": [ { "id": "c-portal", "label": "Portal", "kind": "app", "sub": "Backstage" }, { "id": "c-cli", "label": "CLI", "kind": "app" } ] }, { "title": "Platform API", "kind": "plain", "nodes": [ { "id": "c-api", "label": "Platform API", "kind": "integration", "sub": "one behaviour surface" }, { "id": "c-auth", "label": "Entra Auth", "kind": "security" } ] } ] }, { "title": "Generation plane — the paved road, which a team may leave", "kind": "boundary", "dir": "row", "children": [ { "title": "Scaffolding", "kind": "plain", "nodes": [ { "id": "c-scaf", "label": "Scaffolder", "kind": "app" }, { "id": "c-tpl", "label": "Template Registry", "kind": "store", "sub": "5 paths, versioned" } ] }, { "title": "Currency", "kind": "plain", "nodes": [ { "id": "c-drift", "label": "Drift Reporter", "kind": "app" }, { "id": "c-bot", "label": "Update PR Bot", "kind": "app", "sub": "tracking repos only" } ] } ] }, { "title": "Enforcement plane — guardrails, which no team may leave", "kind": "trust", "dir": "row", "children": [ { "title": "Authoring", "kind": "plain", "nodes": [ { "id": "c-pol", "label": "Policy Repository", "kind": "security", "sub": "single source" }, { "id": "c-sign", "label": "Bundle Signer", "kind": "security" } ] }, { "title": "Evaluation", "kind": "plain", "nodes": [ { "id": "c-adv", "label": "Advisory Evaluator", "kind": "decision", "sub": "≤ 90 s" }, { "id": "c-adm", "label": "Admission Webhook", "kind": "security", "sub": "≤ 250 ms p99" } ] }, { "title": "Relief", "kind": "plain", "nodes": [ { "id": "c-exc", "label": "Exception Register", "kind": "security", "sub": "expiring" } ] } ] }, { "title": "Reconciliation plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Workloads", "kind": "plain", "nodes": [ { "id": "c-argo", "label": "Argo CD", "kind": "app", "sub": "sharded by team" }, { "id": "c-roll", "label": "Progressive Delivery", "kind": "app" } ] }, { "title": "Infrastructure", "kind": "plain", "nodes": [ { "id": "c-tf", "label": "Terraform Runner", "kind": "app", "sub": "module registry" }, { "id": "c-state", "label": "State and Locks", "kind": "store" } ] } ] }, { "title": "Knowledge plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Catalog", "kind": "plain", "nodes": [ { "id": "c-ing", "label": "Descriptor Ingester", "kind": "app" }, { "id": "c-cat", "label": "Catalog Store", "kind": "store", "sub": "PostgreSQL" }, { "id": "c-rec", "label": "Runtime Reconciler", "kind": "app", "sub": "declared vs observed" } ] }, { "title": "Insight", "kind": "plain", "nodes": [ { "id": "c-metrics", "label": "Metrics Store", "kind": "store", "sub": "Data Explorer" }, { "id": "c-audit", "label": "Audit Store", "kind": "store", "sub": "immutable blob" } ] } ] } ], "outside": [ { "id": "c-git", "label": "GitHub Enterprise", "kind": "external", "sub": "intent + source" }, { "id": "c-acr", "label": "Container Registry", "kind": "external" }, { "id": "c-aks", "label": "AKS Fleet", "kind": "external" }, { "id": "c-azure", "label": "Azure Resource Manager", "kind": "external" } ], "edges": [ { "from": "c-api", "to": "c-git", "label": "commits intent", "kind": "sync" }, { "from": "c-adm", "to": "c-aks", "label": "admits or denies", "kind": "sync" }, { "from": "c-tf", "to": "c-azure", "label": "reconciles", "kind": "sync" } ], "note": "Generation and enforcement are separate planes and share no component. They meet only at the runtime, which is the point of the whole design; the reconcilers' own applies are drawn in the data-flow and deployment views.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "09-integration-surface", "title": "Internal Developer Platform — Integration Surface", "layout": "hub", "left": { "title": "Consumers", "nodes": [ { "id": "i-portal", "label": "Developer Portal", "kind": "app", "rel": "REST" }, { "id": "i-cli", "label": "Platform CLI", "kind": "app", "rel": "REST" }, { "id": "i-ci", "label": "Team Pipelines", "kind": "external", "rel": "OIDC" }, { "id": "i-grc", "label": "Risk and Audit", "kind": "external", "rel": "evidence", "kind2": "batch" } ] }, "centre": { "title": "Platform API", "nodes": [ { "id": "i-api", "label": "Platform API", "kind": "integration", "sub": "versioned · deprecated on notice" }, { "id": "i-evt", "label": "Platform Event Bus", "kind": "queue", "sub": "Service Bus" }, { "id": "i-wh", "label": "Webhook Receiver", "kind": "integration", "sub": "Git and cloud events" } ] }, "right": { "title": "Systems the platform drives", "nodes": [ { "id": "i-git", "label": "GitHub Enterprise", "kind": "external", "rel": "repos", "dir": "out", "kind2": "bidirectional" }, { "id": "i-arm", "label": "Azure Resource Manager", "kind": "external", "rel": "provision", "dir": "out" }, { "id": "i-aks", "label": "AKS Fleet", "kind": "external", "rel": "apply", "dir": "out", "kind2": "bidirectional" }, { "id": "i-entra", "label": "Microsoft Entra ID", "kind": "security", "rel": "tokens", "dir": "out" } ] }, "note": "Every human surface is a client of the same API. Key Vault, Azure Monitor and Cost Management are omitted: the platform grants and exports to them rather than driving them.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "10-data-flow", "title": "Internal Developer Platform — Data Flow", "layout": "flow", "chain": true, "stages": [ { "title": "Declared", "nodes": [ { "id": "d-desc", "label": "Catalog Descriptor", "kind": "external", "sub": "team repo" }, { "id": "d-int", "label": "Deploy and Infra Intent", "kind": "external" }, { "id": "d-pol", "label": "Policy Source", "kind": "security" } ] }, { "title": "Ingested", "nodes": [ { "id": "d-ing", "label": "Descriptor Ingester", "kind": "app", "sub": "webhook driven" }, { "id": "d-bundle", "label": "Bundle Builder", "kind": "app", "sub": "signs · publishes" } ] }, { "title": "Acted on", "nodes": [ { "id": "d-argo", "label": "Workload Reconciler", "kind": "app" }, { "id": "d-tf", "label": "Infra Reconciler", "kind": "app" }, { "id": "d-adm", "label": "Admission Evaluator", "kind": "security" } ] }, { "title": "Observed", "nodes": [ { "id": "d-k8s", "label": "Runtime State", "kind": "platform", "sub": "AKS fleet" }, { "id": "d-arm", "label": "Resource Graph", "kind": "external", "sub": "Azure" }, { "id": "d-git", "label": "Repo Activity", "kind": "external", "sub": "commits · PRs" } ] }, { "title": "Projected", "nodes": [ { "id": "d-cat", "label": "Software Catalog", "kind": "store", "sub": "PostgreSQL" }, { "id": "d-graph", "label": "Dependency Graph", "kind": "store" }, { "id": "d-facts", "label": "Event and Metric Facts", "kind": "store", "sub": "Data Explorer" } ] }, { "title": "Consumed", "nodes": [ { "id": "d-page", "label": "Component Page", "kind": "app" }, { "id": "d-dora", "label": "DORA and Adoption", "kind": "app" }, { "id": "d-cov", "label": "Control Coverage", "kind": "app", "sub": "for audit" } ] } ], "edges": [ { "from": "d-cat", "to": "d-argo", "label": "owner lookup", "kind": "sync", "route": "gutter" }, { "from": "d-facts", "to": "d-page", "label": "cost · deploys", "kind": "batch" } ], "note": "Nothing flows the other way into the declared column: the platform never writes to a team's repository except as a pull request a human merges.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "11-storage-zones", "title": "Internal Developer Platform — Storage Zones by Ownership", "layout": "nested", "boxes": [ { "title": "Truth — owned by product teams, never by the platform", "kind": "trust", "dir": "row", "children": [ { "title": "Team repositories", "kind": "plain", "nodes": [ { "id": "s-desc", "label": "Catalog Descriptors", "kind": "store", "sub": "RPO 0 · Git" }, { "id": "s-dep", "label": "Deployment Intent", "kind": "store" }, { "id": "s-inf", "label": "Infrastructure Intent", "kind": "store" } ] } ] }, { "title": "Platform-owned truth — losing this loses knowledge nothing can rebuild", "kind": "boundary", "dir": "row", "children": [ { "title": "Provisioning", "kind": "plain", "nodes": [ { "id": "s-state", "label": "Terraform State", "kind": "store", "sub": "RPO 0 · RTO 1 h" }, { "id": "s-lock", "label": "State Locks", "kind": "store" } ] }, { "title": "Evidence", "kind": "plain", "nodes": [ { "id": "s-audit", "label": "Audit Events", "kind": "store", "sub": "immutable · 7 years" }, { "id": "s-exc", "label": "Exception Register", "kind": "store" } ] }, { "title": "Supply chain", "kind": "plain", "nodes": [ { "id": "s-img", "label": "Signed Images", "kind": "store", "sub": "ACR · 400 d if shipped" }, { "id": "s-att", "label": "Attestations", "kind": "store" }, { "id": "s-pol", "label": "Policy Bundles", "kind": "store", "sub": "signed · OCI" } ] } ] }, { "title": "Projections — rebuildable from truth and the runtime", "kind": "boundary", "dir": "row", "children": [ { "title": "Catalog", "kind": "plain", "nodes": [ { "id": "s-cat", "label": "Component Records", "kind": "store", "sub": "RTO 4 h" }, { "id": "s-rel", "label": "Relations", "kind": "store", "sub": "9,000 edges" } ] }, { "title": "Insight", "kind": "plain", "nodes": [ { "id": "s-met", "label": "DORA and Adoption", "kind": "store", "sub": "3 years daily" }, { "id": "s-hist", "label": "Deploy History", "kind": "store", "sub": "400 days" }, { "id": "s-cost", "label": "Cost Facts", "kind": "store", "sub": "daily export" } ] } ] }, { "title": "Ephemeral — deliberately not backed up", "kind": "plain", "dir": "row", "children": [ { "title": "Working data", "kind": "plain", "nodes": [ { "id": "s-logs", "label": "Pipeline Logs", "kind": "store", "sub": "180 days" }, { "id": "s-cache", "label": "Bundle Cache", "kind": "store", "sub": "last known good" }, { "id": "s-sess", "label": "Portal Session State", "kind": "store", "sub": "RPO 24 h" } ] } ] } ], "edges": [ { "from": "s-desc", "to": "s-cat", "label": "rebuilds", "kind": "batch" }, { "from": "s-pol", "to": "s-cache", "label": "cached at the edge", "kind": "async" } ], "note": "Zones are drawn by what a loss would cost, not by technology. Only the second band has an RPO of zero; the third can be rebuilt, and the fourth is allowed to disappear.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "12-data-model", "title": "Internal Developer Platform — Core Data Model", "layout": "er", "canvas": { "width": 1720, "cols": 4 }, "rowGap": 260, "entities": [ { "id": "team", "name": "team", "row": 0, "col": 1, "kind": "store", "attrs": [ "team_id PK", "entra_group_id unique", "cost_centre", "on_call_rota" ] }, { "id": "comp", "name": "component", "row": 1, "col": 1, "kind": "store", "attrs": [ "component_id PK", "team_id FK -> team", "lifecycle enum", "tier enum", "tmpl_version_id FK", "tracks_template bool" ] }, { "id": "path", "name": "golden_path", "row": 0, "col": 0, "kind": "store", "attrs": [ "path_id PK", "kind_of_workload", "supported_floor", "owner_team_id FK" ] }, { "id": "tmpl", "name": "template_version", "row": 1, "col": 0, "kind": "store", "attrs": [ "tmpl_version_id PK", "path_id FK -> golden_path", "semver", "published_at", "retired_at null" ] }, { "id": "env", "name": "environment", "row": 2, "col": 1, "kind": "store", "attrs": [ "env_id PK", "component_id FK -> component", "name dev|stg|prod", "subscription_id" ] }, { "id": "res", "name": "resource", "row": 2, "col": 0, "kind": "store", "attrs": [ "resource_id PK", "env_id FK -> environment", "kind catalogue entry", "size named", "azure_resource_id", "reclaim_after null" ] }, { "id": "dep", "name": "deploy", "row": 2, "col": 2, "kind": "store", "attrs": [ "deploy_id PK", "env_id FK -> environment", "digest FK -> artefact", "actor_id", "outcome enum", "rolled_back_at null" ] }, { "id": "art", "name": "artefact", "row": 2, "col": 3, "kind": "store", "attrs": [ "digest PK", "commit_sha", "builder_identity", "attestation_uri", "sbom_uri" ] }, { "id": "pol", "name": "policy", "row": 0, "col": 3, "kind": "store", "attrs": [ "policy_id PK", "version", "strength advisory|binding", "bundle_digest" ] }, { "id": "ev", "name": "evaluation", "row": 0, "col": 2, "kind": "store", "attrs": [ "eval_id PK", "policy_id FK -> policy", "subject_ref", "point pr|pipeline|admission", "verdict", "evaluated_at" ] }, { "id": "exc", "name": "exception", "row": 1, "col": 3, "kind": "store", "attrs": [ "exception_id PK", "policy_id FK -> policy", "component_id FK -> component", "approver_id not requester", "expires_at not null" ] }, { "id": "rel", "name": "dependency", "row": 1, "col": 2, "kind": "store", "attrs": [ "from_component_id FK", "to_component_id FK", "kind calls|reads|publishes", "discovered_from" ] } ], "relations": [ { "from": "path", "to": "tmpl", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "tmpl", "to": "comp", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "team", "to": "comp", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "comp", "to": "rel", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "comp", "to": "env", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "env", "to": "res", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "env", "to": "dep", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "art", "to": "dep", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "pol", "to": "ev", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "pol", "to": "exc", "label": "1 : N", "from_side": "s", "to_side": "n" } ], "note": "Ownership hangs off one edge, team to component; everything attributable resolves through it. Two foreign keys are deliberately not drawn — exception.component_id and evaluation.subject_ref — because they cross the whole model and the picture is clearer without them.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "13-scaffold-to-first-deploy", "title": "Critical Flow — From Golden Path to First Production Deploy", "layout": "sequence", "lifelines": [ { "id": "eng", "label": "Product Engineer", "kind": "actor" }, { "id": "api", "label": "Platform API", "kind": "integration" }, { "id": "scaf", "label": "Scaffolder", "kind": "app" }, { "id": "git", "label": "Team Repository", "kind": "external" }, { "id": "ci", "label": "Shared Pipeline", "kind": "app" }, { "id": "pol", "label": "Policy Evaluator", "kind": "security" }, { "id": "rec", "label": "Reconciler", "kind": "app" }, { "id": "aks", "label": "AKS Runtime", "kind": "platform" } ], "messages": [ { "from": "eng", "to": "api", "label": "choose a golden path", "kind": "call" }, { "from": "api", "to": "scaf", "label": "scaffold component", "kind": "call" }, { "from": "scaf", "to": "git", "label": "repo · intent · pipeline ref", "kind": "call" }, { "from": "scaf", "to": "api", "label": "catalog descriptor", "kind": "return" }, { "from": "api", "to": "eng", "label": "repo url · next step", "kind": "return" }, { "from": "git", "to": "ci", "label": "push event", "kind": "async" }, { "from": "ci", "to": "ci", "label": "build · sign · attest", "kind": "self" }, { "from": "ci", "to": "pol", "label": "advisory evaluation", "kind": "call" }, { "from": "pol", "to": "ci", "label": "verdict ≤ 90 s", "kind": "return" }, { "from": "ci", "to": "git", "label": "pin image digest in intent", "kind": "call" }, { "from": "git", "to": "rec", "label": "intent changed", "kind": "async" }, { "from": "rec", "to": "aks", "label": "apply desired state", "kind": "call" }, { "from": "aks", "to": "pol", "label": "admission check", "kind": "call" }, { "from": "pol", "to": "aks", "label": "deny — no owner label", "kind": "error" }, { "from": "pol", "to": "aks", "label": "admit ≤ 250 ms p99", "kind": "return" }, { "from": "aks", "to": "rec", "label": "converged", "kind": "return" }, { "from": "rec", "to": "api", "label": "deploy fact", "kind": "async" }, { "from": "api", "to": "eng", "label": "running · component page", "kind": "return" } ], "note": "Message 14 is the failure that must never be a surprise: the same policy source produced message 9, so an advisory pass followed by an admission deny is a platform defect, not a normal outcome.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "14-provisioning-reconciliation", "title": "Internal Developer Platform — Self-Service Provisioning by Reconciliation", "layout": "flow", "chain": true, "stages": [ { "title": "Declare", "nodes": [ { "id": "p-cat", "label": "Resource Catalogue", "kind": "app", "sub": "40 kinds · named sizes" }, { "id": "p-int", "label": "Infrastructure Intent", "kind": "external", "sub": "in the team repo" } ] }, { "title": "Admit", "nodes": [ { "id": "p-quota", "label": "Quota Check", "kind": "decision", "sub": "per team · per env" }, { "id": "p-budget", "label": "Budget Check", "kind": "decision" }, { "id": "p-class", "label": "Classification Check", "kind": "security", "sub": "region · data class" } ] }, { "title": "Plan", "nodes": [ { "id": "p-mod", "label": "Module Registry", "kind": "store", "sub": "versioned Terraform" }, { "id": "p-plan", "label": "Plan and Lock", "kind": "app", "sub": "idempotent" } ] }, { "title": "Apply", "nodes": [ { "id": "p-run", "label": "Runner Pool", "kind": "app", "sub": "workload identity" }, { "id": "p-arm", "label": "Azure Resource Manager", "kind": "external" } ] }, { "title": "Attribute", "nodes": [ { "id": "p-tag", "label": "Owner and Cost Tags", "kind": "security", "sub": "applied at creation" }, { "id": "p-id", "label": "Workload Identity", "kind": "security" }, { "id": "p-sec", "label": "Key Vault Path", "kind": "security", "sub": "granted, not copied" } ] }, { "title": "Converge", "nodes": [ { "id": "p-state", "label": "State Store", "kind": "store", "sub": "RPO 0" }, { "id": "p-drift", "label": "Drift Detector", "kind": "app", "sub": "≤ 5 min p95" }, { "id": "p-orph", "label": "Orphan Reclaimer", "kind": "app", "sub": "notice · grace · reclaim" } ] } ], "edges": [ { "from": "p-drift", "to": "p-plan", "label": "re-plan", "kind": "async", "route": "gutter" }, { "from": "p-run", "to": "p-state", "label": "records", "kind": "sync" } ], "note": "A partially failed apply is resumed from the same declaration rather than reconstructed, which is the property an imperative portal cannot offer.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "15-guardrail-evaluation-lanes", "title": "Internal Developer Platform — One Policy Source, Two Evaluation Points", "layout": "swimlane", "stages": [ "Author", "Publish", "Pull request", "Pipeline", "Admission", "Report" ], "laneHeaderWidth": 190, "lanes": [ { "title": "Policy source", "cells": [ [ { "id": "g-src", "label": "Policy as Code", "kind": "security", "sub": "reviewed by two" } ], [ { "id": "g-sign", "label": "Signed Bundle", "kind": "security", "sub": "OCI artefact" } ], [], [], [], [ { "id": "g-ver", "label": "Version in Every Verdict", "kind": "store" } ] ] }, { "title": "On the paved road", "cells": [ [], [ { "id": "g-pull1", "label": "Bundle Pulled", "kind": "app" } ], [ { "id": "g-pr", "label": "Advisory Verdict", "kind": "decision", "sub": "explains itself" } ], [ { "id": "g-gate", "label": "Build Gate", "kind": "decision" } ], [ { "id": "g-adm1", "label": "Admitted", "kind": "platform" } ], [ { "id": "g-drift", "label": "Drift Reported", "kind": "app" } ] ] }, { "title": "Off the road", "cells": [ [], [ { "id": "g-pull2", "label": "Bundle Pulled", "kind": "app" } ], [ { "id": "g-none1", "label": "No Advisory Check", "kind": "risk" } ], [ { "id": "g-none2", "label": "No Shared Pipeline", "kind": "risk" } ], [ { "id": "g-adm2", "label": "Same Admission Check", "kind": "security", "sub": "identical policy" } ], [ { "id": "g-cov", "label": "Counted in Coverage", "kind": "app", "sub": "≥ 99%" } ] ] }, { "title": "Exception path", "cells": [ [ { "id": "g-req", "label": "Exception Requested", "kind": "integration" } ], [ { "id": "g-app", "label": "Approved by Another", "kind": "security", "sub": "expiry required" } ], [ { "id": "g-shown", "label": "Shown in the PR", "kind": "app" } ], [], [ { "id": "g-admx", "label": "Admitted with Expiry", "kind": "decision" } ], [ { "id": "g-reg", "label": "Standing Register", "kind": "store", "sub": "≤ 25 active" } ] ] }, { "title": "Evidence", "cells": [ [ { "id": "g-rev", "label": "Change Audited", "kind": "store" } ], [ { "id": "g-dig", "label": "Digest Recorded", "kind": "store" } ], [ { "id": "g-v1", "label": "Verdict Stored", "kind": "store" } ], [ { "id": "g-v2", "label": "Verdict Stored", "kind": "store" } ], [ { "id": "g-v3", "label": "Verdict Stored", "kind": "store" } ], [ { "id": "g-aud", "label": "Control Evidence Export", "kind": "store", "sub": "7 years" } ] ] } ], "note": "The third lane is the point of the design: a component that never touched a template meets exactly the same binding check as one the platform generated.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "16-deployment-architecture", "title": "Internal Developer Platform — Deployment Architecture on Azure", "layout": "nested", "boxes": [ { "title": "Tenant root management group — Azure Policy floor set by the landing zone", "kind": "cloud", "dir": "row", "children": [ { "title": "Platform subscription", "kind": "boundary", "nodes": [ { "id": "z-ctl", "label": "Control Plane AKS", "kind": "platform", "sub": "3 zones · uk-south" }, { "id": "z-pg", "label": "Catalog PostgreSQL", "kind": "store", "sub": "zone redundant" }, { "id": "z-acr", "label": "Container Registry", "kind": "store", "sub": "geo-replicated" }, { "id": "z-kv", "label": "Key Vault", "kind": "security", "sub": "HSM backed" } ] }, { "title": "Workload subscription — production", "kind": "boundary", "nodes": [ { "id": "z-p1", "label": "Shared AKS · uk-south", "kind": "platform", "sub": "namespace per component" }, { "id": "z-p2", "label": "Shared AKS · uk-west", "kind": "platform", "sub": "paired region" }, { "id": "z-pd", "label": "Managed Databases", "kind": "store" }, { "id": "z-pb", "label": "Service Bus", "kind": "queue" } ] }, { "title": "Workload subscription — non-production", "kind": "boundary", "nodes": [ { "id": "z-n1", "label": "Shared AKS · dev and stage", "kind": "platform", "sub": "cheaper node pools" }, { "id": "z-nd", "label": "Managed Databases", "kind": "store", "sub": "no production data" } ] }, { "title": "Sandbox subscription", "kind": "boundary", "nodes": [ { "id": "z-sb", "label": "Experimental Workloads", "kind": "platform", "sub": "lifecycle: experimental" } ] } ] }, { "title": "Inside every shared cluster", "kind": "trust", "dir": "row", "children": [ { "title": "Platform namespaces", "kind": "plain", "nodes": [ { "id": "z-adm", "label": "Admission Webhook", "kind": "security", "sub": "3 replicas · local bundle" }, { "id": "z-argo", "label": "Argo CD Shard", "kind": "app" }, { "id": "z-otel", "label": "Telemetry Agents", "kind": "platform" } ] }, { "title": "Tenant namespaces", "kind": "plain", "nodes": [ { "id": "z-ns", "label": "Component Namespace", "kind": "app", "sub": "quota · limits · identity" }, { "id": "z-net", "label": "Default-Deny Network Policy", "kind": "security" } ] } ] } ], "outside": [ { "id": "z-entra", "label": "Microsoft Entra ID", "kind": "security", "sub": "tenant wide" }, { "id": "z-gh", "label": "GitHub Enterprise", "kind": "external" }, { "id": "z-mon", "label": "Azure Monitor", "kind": "external" } ], "edges": [ { "from": "z-ctl", "to": "z-p1", "label": "applies", "kind": "sync" }, { "from": "z-adm", "to": "z-acr", "label": "pulls bundle", "kind": "async", "route": "gutter" }, { "from": "z-entra", "to": "z-ns", "label": "workload identity", "kind": "sync" } ], "note": "The cluster is the shared-fate unit: a namespace boundary is cheap and an upgrade is not. The paired region carries the platform's own recovery, not an active second copy of every tenant.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "17-release-pipeline", "title": "Internal Developer Platform — Shared Pipeline and Environments", "layout": "flow", "chain": true, "stages": [ { "title": "Source", "nodes": [ { "id": "r-pr", "label": "Pull Request", "kind": "external" }, { "id": "r-ref", "label": "Pipeline Reference", "kind": "app", "sub": "consumed, not copied" } ] }, { "title": "Build", "nodes": [ { "id": "r-build", "label": "Build", "kind": "app", "sub": "ephemeral runner" }, { "id": "r-sign", "label": "Sign and Attest", "kind": "security", "sub": "provenance · SBOM" } ] }, { "title": "Gate", "nodes": [ { "id": "r-adv", "label": "Advisory Policy", "kind": "decision" }, { "id": "r-test", "label": "Tests and Scans", "kind": "decision" } ] }, { "title": "Dev and stage", "nodes": [ { "id": "r-dev", "label": "Dev", "kind": "platform", "sub": "auto on merge" }, { "id": "r-stg", "label": "Stage", "kind": "platform", "sub": "same artefact" } ] }, { "title": "Production", "nodes": [ { "id": "r-adm", "label": "Admission Check", "kind": "security", "sub": "binding" }, { "id": "r-can", "label": "Canary", "kind": "app", "sub": "automated analysis" }, { "id": "r-full", "label": "Full Rollout", "kind": "platform" } ] }, { "title": "Recover", "nodes": [ { "id": "r-back", "label": "Rollback", "kind": "app", "sub": "≤ 5 min · pipeline-free" }, { "id": "r-rec", "label": "Deploy Record", "kind": "store", "sub": "400 days" } ] } ], "edges": [ { "from": "r-can", "to": "r-back", "label": "signal breach", "kind": "error" }, { "from": "r-sign", "to": "r-adm", "label": "digest verified", "kind": "sync", "route": "gutter" } ], "note": "One artefact is promoted through every environment. A rebuild per environment would make the thing tested and the thing running two different objects.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "18-observability", "title": "Internal Developer Platform — Observability Matrix", "layout": "grid", "laneHeaderWidth": 190, "columns": [ "Scaffold", "Provision", "Build", "Admit", "Run", "Report" ], "rows": [ { "title": "Platform SLIs", "cells": [ [ { "id": "o-1", "label": "Time to First Deploy", "kind": "app", "sub": "≤ 2 h p95" } ], [ { "id": "o-2", "label": "Provision Latency", "kind": "app", "sub": "≤ 12 min p95" } ], [ { "id": "o-3", "label": "Commit to Prod", "kind": "app", "sub": "≤ 25 min p95" } ], [ { "id": "o-4", "label": "Admission Latency", "kind": "app", "sub": "≤ 250 ms p99" } ], [ { "id": "o-5", "label": "Reconcile Lag", "kind": "app", "sub": "≤ 5 min p95" } ], [ { "id": "o-6", "label": "Catalog Freshness", "kind": "app", "sub": "≤ 10 min p95" } ] ] }, { "title": "Tenant outcomes", "cells": [ [ { "id": "o-7", "label": "New Components", "kind": "store", "sub": "60 / month" } ], [ { "id": "o-8", "label": "Quota Rejections", "kind": "store" } ], [ { "id": "o-9", "label": "Deploy Frequency", "kind": "store", "sub": "5,200 / week" } ], [ { "id": "o-10", "label": "Denials by Policy", "kind": "store" } ], [ { "id": "o-11", "label": "Change Failure Rate", "kind": "store" } ], [ { "id": "o-12", "label": "Time to Restore", "kind": "store" } ] ] }, { "title": "Adoption", "cells": [ [ { "id": "o-13", "label": "Path Chosen", "kind": "app" } ], [], [ { "id": "o-14", "label": "Shared Pipeline Share", "kind": "app" } ], [ { "id": "o-15", "label": "Off-Road Admissions", "kind": "risk", "sub": "shadow estate" } ], [ { "id": "o-16", "label": "Template Drift", "kind": "app", "sub": "≤ 2 versions" } ], [ { "id": "o-17", "label": "Adoption Curve", "kind": "app", "sub": "≥ 70% by month 12" } ] ] }, { "title": "Assurance", "cells": [ [], [ { "id": "o-18", "label": "Attribution Complete", "kind": "security" } ], [ { "id": "o-19", "label": "Unsigned Artefacts", "kind": "security", "sub": "target zero" } ], [ { "id": "o-20", "label": "Control Coverage", "kind": "security", "sub": "≥ 99%" } ], [ { "id": "o-21", "label": "Active Exceptions", "kind": "security", "sub": "≤ 25" } ], [ { "id": "o-22", "label": "Audit Export", "kind": "store", "sub": "7 years" } ] ] }, { "title": "Cost", "cells": [ [], [ { "id": "o-23", "label": "Spend by Team", "kind": "store" } ], [ { "id": "o-24", "label": "Build Minutes", "kind": "store" } ], [], [ { "id": "o-25", "label": "Idle and Orphaned", "kind": "store" } ], [ { "id": "o-26", "label": "Platform Share of Spend", "kind": "app", "sub": "≤ 3%" } ] ] }, { "title": "Experience", "cells": [ [ { "id": "o-27", "label": "Errors Self-Solved", "kind": "app" } ], [], [], [ { "id": "o-28", "label": "CI Pass, Admit Fail", "kind": "risk", "sub": "a defect, not noise" } ], [ { "id": "o-29", "label": "Support Requests", "kind": "store", "sub": "≤ 40 / week" } ], [ { "id": "o-30", "label": "Satisfaction by Path", "kind": "app", "sub": "≥ 4.0 / 5" } ] ] } ], "note": "Blank cells are deliberate. The bottom-right quadrant is the platform's own scoreboard: a product that is not chosen has failed, however green the top two rows are.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "19-component-lifecycle", "title": "Internal Developer Platform — Component Lifecycle", "layout": "cycle", "centre": { "label": "Component Lifecycle" }, "nodes": [ { "id": "y-scaf", "label": "Scaffolded", "kind": "app", "sub": "template version pinned" }, { "id": "y-exp", "label": "Experimental", "kind": "app", "sub": "sandbox · light guardrails" }, { "id": "y-prod", "label": "Production", "kind": "platform", "sub": "full guardrails · SLO" }, { "id": "y-drift", "label": "Drifting", "kind": "risk", "sub": "behind the template" }, { "id": "y-updated", "label": "Updated or Forked", "kind": "decision", "sub": "a recorded choice" }, { "id": "y-dep", "label": "Deprecated", "kind": "app", "sub": "no new dependants" }, { "id": "y-ret", "label": "Retired", "kind": "app", "sub": "resources de-provisioned" } ], "ringLabels": [ "promoted", "tier declared", "template moves on", "team decides", "back to current", "successor named", "catalog entry archived" ], "note": "There is no state in which a component has no owner. The lifecycle exists so that a component nobody can name is caught as a transition failure rather than discovered in a cost report.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "20-security-trust-zones", "title": "Internal Developer Platform — Trust Zones", "layout": "zones", "zones": [ { "title": "Engineer's device and network", "kind": "trust", "nodes": [ { "id": "t-dev", "label": "Engineer", "kind": "actor", "sub": "Entra + device policy" }, { "id": "t-cli", "label": "Platform CLI", "kind": "app", "sub": "no stored secret" } ] }, { "title": "Platform surfaces", "kind": "trust", "nodes": [ { "id": "t-portal", "label": "Developer Portal", "kind": "app" }, { "id": "t-api", "label": "Platform API", "kind": "integration", "sub": "entitlement checked" } ] }, { "title": "Platform control plane", "kind": "trust", "nodes": [ { "id": "t-scaf", "label": "Scaffolder", "kind": "app" }, { "id": "t-tf", "label": "Infra Reconciler", "kind": "app", "sub": "high privilege" }, { "id": "t-pol", "label": "Policy Publisher", "kind": "security" }, { "id": "t-argo", "label": "Workload Reconciler", "kind": "app" } ] }, { "title": "Tenant runtime", "kind": "trust", "nodes": [ { "id": "t-ns", "label": "Component Namespace", "kind": "platform", "sub": "default-deny egress" }, { "id": "t-adm", "label": "Admission Webhook", "kind": "security", "sub": "in-cluster" } ] }, { "title": "Data and secrets", "kind": "trust", "nodes": [ { "id": "t-db", "label": "Managed Databases", "kind": "store", "sub": "private endpoint" }, { "id": "t-kv", "label": "Key Vault", "kind": "security", "sub": "grants, never copies" }, { "id": "t-audit", "label": "Audit Store", "kind": "store", "sub": "operators cannot edit" } ] } ], "edges": [ { "from": "t-cli", "to": "t-api", "label": "user token · OIDC", "kind": "sync" }, { "from": "t-api", "to": "t-tf", "label": "entitlement, then act", "kind": "sync" }, { "from": "t-tf", "to": "t-kv", "label": "creates path", "kind": "sync", "route": "gutter" }, { "from": "t-argo", "to": "t-ns", "label": "scoped to one team", "kind": "sync" }, { "from": "t-ns", "to": "t-kv", "label": "own secret", "kind": "sync" }, { "from": "t-adm", "to": "t-audit", "label": "verdict written", "kind": "async" } ], "note": "The control plane is the highest-privilege zone in the estate, so it carries the same guardrails it enforces. Tenant-to-database traffic is omitted: it is a private endpoint inside the data zone and adding it would say nothing the node already says.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } }, { "id": "21-identity-and-access", "title": "Identity and Access — From a Person to a Workload Credential", "layout": "sequence", "lifelines": [ { "id": "u", "label": "Engineer", "kind": "actor" }, { "id": "e", "label": "Microsoft Entra ID", "kind": "security" }, { "id": "a", "label": "Platform API", "kind": "integration" }, { "id": "c", "label": "Catalog", "kind": "store" }, { "id": "t", "label": "Infra Reconciler", "kind": "app" }, { "id": "k", "label": "Key Vault", "kind": "security" }, { "id": "w", "label": "Workload Pod", "kind": "platform" } ], "messages": [ { "from": "u", "to": "e", "label": "sign in · device policy", "kind": "call" }, { "from": "e", "to": "u", "label": "token with group claims", "kind": "return" }, { "from": "u", "to": "a", "label": "provision a database", "kind": "call" }, { "from": "a", "to": "c", "label": "who owns this component?", "kind": "call" }, { "from": "c", "to": "a", "label": "owning group", "kind": "return" }, { "from": "a", "to": "a", "label": "group claim vs owner", "kind": "self" }, { "from": "a", "to": "u", "label": "not your component", "kind": "error" }, { "from": "a", "to": "t", "label": "reconcile declared intent", "kind": "async" }, { "from": "t", "to": "e", "label": "federated credential", "kind": "call" }, { "from": "t", "to": "k", "label": "create path · grant identity", "kind": "call" }, { "from": "w", "to": "e", "label": "workload identity token", "kind": "call" }, { "from": "e", "to": "w", "label": "short-lived token", "kind": "return" }, { "from": "w", "to": "k", "label": "read own secret", "kind": "call" }, { "from": "k", "to": "w", "label": "secret value", "kind": "return" }, { "from": "a", "to": "c", "label": "audit event", "kind": "async" } ], "note": "Message 7 is the whole access model: entitlement is derived from catalog ownership, so there is no separate access list to fall out of date when a team reorganises.", "meta": { "v": "1.0", "owner": "Platform Architecture", "date": "2026-09" } } ]