Purpose
Provide builders with paved roads—SDKs, templates, local evals, guardrails, and documentation—so secure and operable defaults are the path of least resistance across all domains.
Engineering philosophy
Platform engineering is a cross-cutting control, not a peer readiness domain. Friction on unsafe paths and speed on safe ones determine whether other pillars are actually followed.
Why it matters
If the approved gateway is hard and the raw provider key is easy, builders will bypass controls. DX debt becomes security and reliability debt.
Common failures
- No internal AI platform or golden paths
- Docs that explain policy but not how to comply
- Slow security review with no self-serve checklists
- Local development that cannot run evals or policy checks
Mandatory checks
Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.
Builders shall have a documented golden path for deploying AI features to production
- Artifact
- Golden-path documentation with steps from scaffold to production
- Pass condition
- Doc exists with version/owner; covers auth, secrets, evals, and promote steps; reviewed ≤ 12 months
Local or CI self-serve checks shall cover critical mandatory controls (auth, secrets, basic evals)
- Artifact
- CI/local check config covering auth, secrets, and basic evals
- Pass condition
- Default AI pipeline runs auth, secret-scan, and basic eval checks; failing any blocks merge/promote in the golden-path template
Ownership and support channel shall exist for the AI platform/paved road
- Artifact
- Platform ownership record + support channel (on-call, Slack, ticket queue)
- Pass condition
- Named owner team and support channel documented; channel responds to a test ping within published SLA or has on-call rotation listed
Recommended checks
Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.
Scaffolding templates for agents, RAG, and MCP with safe defaults
- Artifact
- Scaffolding template repo/catalog for agents, RAG, and MCP with default security settings + adoption metrics
- Pass condition
- Templates exist for agents, RAG, and MCP with auth, secrets, and logging defaults on; ≥1 new service used a template in the last 90 days or adoption target is documented
Inner-loop eval runners developers can run before PR
- Artifact
- Local/inner-loop eval runner docs + package + sample developer run log before a recent PR
- Pass condition
- Developers can run the core eval subset locally or in a one-command inner loop; last sampled AI PR (≤30 days) shows pre-PR eval evidence or documented waiver
DX metrics: time-to-safe-production and bypass rate
- Artifact
- Platform DX dashboard (or weekly report) with time-to-safe-production and policy-bypass rate definitions + last 30 days series
- Pass condition
- Both metrics are defined with formulas; published for ≥30 consecutive days; bypass rate has an alert or review threshold with a named owner
Evidence required
- Golden path documentation
- Template/repository inventory
- Support ownership for AI platform
Severity & risk
- Severity
- medium
- Impact if violated
- Risk level
- medium
- Typical residual risk (impact × likelihood)
Engineering best practices
- Default SDKs inject tracing, auth, and budget headers
- Provide copy-paste threat model and APRF checklist stubs
- Measure and reduce friction for approved tools
- Celebrate teams that use paved roads in readiness reviews
Automatic validations
- Template CI that fails if safe defaults are removed
- Telemetry on gateway vs direct-provider usage
- Lint rules guiding builders to approved libraries
Manual validations
- Builder interviews on friction points
- Periodic DX reviews with security and platform teams
Examples
- create-agent CLI scaffolds an agent with budgets, authz hooks, and eval stubs
- A PR template links to the APRF pillar checklist for the feature type
References
Crosswalks
§7 Support
ISO/IEC 42001 · partial
CC5 Control Activities
SOC 2 Trust Services Criteria · evidence-for
Operational Excellence Operational Excellence
AWS Well-Architected Framework · aligns-with
Level 3 Hardened builds
SLSA (Supply-chain Levels for Software Artifacts) · partial
Future evolution
Shared open-source APRF linters, project templates, and inner-loop conformance checks adopted across ecosystems.