The Platform Team's Nine-Month Backlog
Helio Commerce has 12 product teams, 65 services, and a six-person tooling team. Jenkins is the official CI server, but teams also use GitHub Actions, GitLab CI, CircleCI, and three homegrown scripts; 38% of builds fail, and half of those failures are attributed to environment drift. Secrets are stored in 23 repositories; deployment steps live in a wiki that is updated irregularly. The tooling team's backlog is nine months long, and teams routinely bypass it by requesting production access directly. Leadership has approved an internal developer platform (IDP) with a 'golden path' for build, deploy, and observability. The tooling team proposes building a portal, a pipeline abstraction, and a Kubernetes operator in the first quarter. Product teams say they will adopt the platform only if it is faster than their current workaround. The security team wants mandatory scanning, but the platform team has no mandate to enforce it.
1. What should the platform team build first, and what should it explicitly not build? Justify using the symptoms.
Read the worked answer
The symptoms point to build reliability, environment drift, secrets sprawl, and inconsistent deployment as the highest-cost problems. The first increment should be a golden path for the most common service type: a standardized CI template, environment provisioning that matches test and production, secrets management, and a deployment path with rollback. Integrate security scanning into that template. This addresses the 38% build failure rate, half of which is environment drift, and the 23 repositories holding secrets. Do not build a portal, a pipeline abstraction, or a Kubernetes operator first. Those are expensive and assume adoption. A portal without a reliable path is a facade; an operator adds a new platform to operate. Start with two pilot teams and measure time to first deployment, build failure rate, secret exposure, and the number of workarounds. If the golden path is not faster than the current bypass, adoption will fail. The platform should be a product with users, not a compliance gate.
2. How can the platform team avoid becoming the new nine-month bottleneck while still offering a golden path?
Read the worked answer
Make the platform a product with a product manager, user research, and a published roadmap. Define a platform SLO, such as time to provision a service or time to get a build result, and measure it. Offer self-service APIs and templates so teams do not file tickets to the platform team. Keep the golden path opinionated but not mandatory; provide a clear contribution model so product teams can improve shared templates. Buy commodity capabilities such as CI runners, secret storage, and observability rather than building them. Limit the first version to one service type and two runtimes, and say no to exceptions that require bespoke platform work. Publish a support policy and an escalation path. Measure platform lead time for changes and the percentage of teams using the golden path without intervention. If the platform team is still the only group that can change a pipeline, the bottleneck has moved, not disappeared. A nine-month backlog often means too much scope and too little self-service.
3. Security wants mandatory scanning, but the platform team has no enforcement mandate. What adoption and enforcement strategy would you recommend?
Read the worked answer
Make the secure path the easiest path. Put scanning into the golden path template so teams get it by default rather than by request. Start with non-blocking findings for low and medium severity, and block only high-severity findings in the deployment path, with a documented exception process and an owner. Pilot this with the two platform pilot teams and measure findings, false positives, and time to remediate. If the platform path is faster and produces fewer security issues, adoption becomes a pull rather than a push. Then ask for an executive mandate that production deployment must use the golden path or an approved exception. Without a mandate, enforcement by the six-person platform team will become a review queue and teams will bypass it. If a mandate is impossible, use transparency: publish which services use the path and which do not, and let risk owners decide. Do not rely on a mandate alone; it creates compliance theater if the path is slow.