APRF-23 · Platform Engineering

Purpose

Provide builders with paved roads—SDKs, templates, local evals, guardrails, and documentation—so secure and operable defaults are the path of least resistance across all domains.

Mandatory checks

Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.

DX-M1L3 · DefinedTier 2 · ProductionhybridE3
Builders shall have a versioned, owned golden-path document for deploying AI features to production that covers authentication, secrets, evals, and promote steps, reviewed within the last 12 months.
Artifact
Golden-path documentation from scaffold to production with version and owner + Evidence the doc covers auth, secrets, evals, and promote steps + Review attestation or changelog showing review within 12 months
Pass condition
A golden-path document exists with version and owner; it covers authentication, secrets, evals, and promote steps for AI features; last review is within 12 months (review measuredAt ≤365 days). If the organization does not build or deploy AI features, score NOT_APPLICABLE.
Why this control exists
Threat map
Make the controlled route to production the easiest route, so teams do not build around it.
Threats mitigated
Configuration DriftShadow AgentsInsider Misuse
Protects
RuntimeInfrastructureSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
When the compliant path is slower than the improvised one, teams route around controls and create unmanaged deployments. A documented golden path is how control coverage is achieved in practice; no adversary technique maps.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DX-M2L3 · DefinedTier 2 · ProductionhybridE3
The default AI golden-path pipeline (local and/or CI) shall run authentication, secret-scan, and basic eval checks, and failing any of them shall block merge or promote.
Artifact
CI and/or local check config covering auth, secret-scan, and basic evals + Evidence those checks are required (blocking) on merge/promote for the AI golden-path template
Pass condition
The default AI pipeline runs auth, secret-scan, and basic eval checks; failing any blocks merge or promote in the golden-path template (blocking evidence measuredAt ≤90 days). If no AI build/promote surface, score NOT_APPLICABLE.
Why this control exists
Threat map
Let builders detect control failures before merge rather than at release.
Threats mitigated
Secret LeakageIdentity SpoofingConfiguration Drift
Protects
SecretsIdentityRuntime
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Shifting mandatory-control checks into local and CI workflows catches auth, secret, and evaluation failures at the cheapest point to fix them. The contribution is coverage and consistency; the specific techniques are mapped on the underlying controls such as SEC2-R1.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

Evidence required

Review attestation within 12 months
Versioned AI golden-path documentation with owner
Golden path documentation
Template/repository inventory
Support ownership for AI platform

Recommended checks

Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.

DX-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Scaffolding templates shall exist for agents, RAG, and MCP with authentication, secrets, and logging defaults enabled, and either ≥1 new service used a template in the last 90 days or an adoption target is documented.
Artifact
Scaffolding template repo/catalog covering agents, RAG, and MCP + Evidence auth, secrets, and logging defaults are enabled in those templates + Adoption metrics (≥1 use in 90 days) or documented adoption target
Pass condition
Templates exist for agents, RAG, and MCP with auth, secrets, and logging defaults on; ≥1 new service used a template in the last 90 days or an adoption target is documented (adoption proof measuredAt ≤90 days). If none planned and no AI surface, score NOT_APPLICABLE.
Why this control exists
Threat map
Make safe configuration the starting point for new agent, RAG, and MCP services.
Threats mitigated
Configuration DriftPrompt InjectionSecret Leakage
Protects
RuntimePromptsSecrets
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Templates encode safe defaults so each new service does not re-derive them, usually incorrectly and under time pressure. The security benefit is that correct configuration is the default rather than an afterthought.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DX-R2L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Developers shall be able to run the core AI eval subset locally or via a one-command inner loop before opening a PR, and the last sampled AI PR (≤30 days) shall show pre-PR eval evidence or a documented waiver.
Artifact
Local/inner-loop eval runner docs and package or script entrypoint + Evidence the core eval subset runs in one command (or documented equivalent) + Sample AI PR (≤30 days) with pre-PR eval evidence or documented waiver
Pass condition
A local or one-command inner-loop runner exists for the core AI eval subset; the last sampled AI PR (≤30 days) shows pre-PR eval evidence or a documented waiver (sample/waiver measuredAt ≤30 days). If no AI eval surface, score NOT_APPLICABLE.
Why this control exists
Threat map
Let builders run evaluations before opening a pull request.
Threats mitigated
MisinformationHallucinated Actions
Protects
ModelsPromptsUsers
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Fast inner-loop evaluation means quality problems are found by the author rather than by the release gate or a customer. This is a developer experience control with no adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DX-R3L5 · OptimizingTier 3 · Mission CriticalhybridE3
Time-to-safe-production and policy-bypass rate shall be defined with formulas, published for ≥30 consecutive days, and bypass rate shall have an alert or review threshold with a named owner.
Artifact
Definitions/formulas for time-to-safe-production and policy-bypass rate + Dashboard or weekly report with ≥30 consecutive days of series + Bypass-rate alert or review threshold with named owner
Pass condition
Both metrics are defined with formulas; published for ≥30 consecutive days; bypass rate has an alert or review threshold with a named owner (series / ownership proof measuredAt ≤90 days). If the organization lacks an AI platform or paved road with enough traffic to measure the required metrics, score NOT_APPLICABLE.
Why this control exists
Threat map
Measure whether the paved road is actually being used.
Threats mitigated
Configuration DriftShadow Agents
Protects
RuntimeAudit Trail
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Bypass rate is a direct measure of control coverage erosion, and a rising rate means posture is degrading even while individual checks still pass. This is a governance metric with no adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
DX-R4L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
A named owner team and a support channel shall exist for the AI platform / paved road, with either a published response SLA proven by a recent test ping or a listed on-call rotation.
Artifact
Platform ownership record naming the owner team for the AI paved road + Support channel (Slack, ticket queue, or equivalent) documented + Test-ping within published SLA (≤90 days) or listed on-call rotation
Pass condition
Named owner team and support channel are documented for the AI platform / paved road; either a test ping met the published SLA within 90 days, or an on-call rotation is listed (support proof measuredAt ≤90 days). If the organization operates neither an AI platform nor a paved road, score NOT_APPLICABLE.
Why this control exists
Threat map
Give the AI platform a named owner and a support channel so problems have somewhere to go.
Threats mitigated
Shadow Agents
Protects
RuntimeSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
An unsupported platform is abandoned in favour of unmanaged alternatives. Ownership and support keep teams on the controlled path; no adversary technique maps.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

More detailPhilosophy, failures, practices, validations, examples, crosswalks, and evolution

Engineering philosophy

Platform engineering is a cross-cutting control, not a peer readiness domain. Friction on unsafe paths and speed on safe ones determine whether other pillars are actually followed.

Why it matters

If the approved gateway is hard and the raw provider key is easy, builders will bypass controls. DX debt becomes security and reliability debt.

Common failures

No internal AI platform or golden paths
Docs that explain policy but not how to comply
Slow security review with no self-serve checklists
Local development that cannot run evals or policy checks
Stale or ownerless golden-path wiki without annual review
Generic service deploy docs missing AI auth/secrets/evals/promote sections

Severity & risk

Severity: medium; Impact if violated
Risk level: medium; Typical residual risk (impact × likelihood)

Engineering best practices

Default SDKs inject tracing, auth, and budget headers
Provide copy-paste threat model and APRF checklist stubs
Measure and reduce friction for approved tools
Celebrate teams that use paved roads in readiness reviews

Automatic validations

Template CI that fails if safe defaults are removed
Telemetry on gateway vs direct-provider usage
Lint rules guiding builders to approved libraries
Repo golden-path doc heuristics (platform-golden-path collector)
Imported review attestation under imports/platform-golden-path/

Manual validations

Builder interviews on friction points
Periodic DX reviews with security and platform teams

Examples

create-agent CLI scaffolds an agent with budgets, authz hooks, and eval stubs
A PR template links to the APRF pillar checklist for the feature type

References

Crosswalks

§7 Support
ISO/IEC 42001 · partial
C4.1 AI Workload Sandboxing & Validation
OWASP AI Application Security Verification Standard (AISVS) · partial
C4.2 AI Hardware Security
OWASP AI Application Security Verification Standard (AISVS) · partial
C4.3 Edge & Distributed AI Security
OWASP AI Application Security Verification Standard (AISVS) · partial
L4 Deployment & Infrastructure
CSA MAESTRO (Multi-Agentic Threat Model) · supports
CC5 Control Activities
SOC 2 Trust Services Criteria · evidence-for
Operational Excellence Operational Excellence
AWS Well-Architected Framework · aligns-with
Level 3 Hardened builds
SLSA (Supply-chain Levels for Software Artifacts) · partial

Future evolution

Shared open-source APRF linters, project templates, and inner-loop conformance checks adopted across ecosystems.