platform-engineering

Platform engineering for AI-assisted and agentic software development — the four levels of agentic development, workspace-level governance for AI coding agents (including regulated industries), and the AI-native platform blueprint (model hubs, GPU templates, golden paths for AI workloads). Use when introducing coding agents to an org, designing agent governance/permissions/audit, planning AI/GPU infrastructure, or assessing readiness to increase agent autonomy.

Capstone skill — reads every .platform/** artifact plus platform-blueprint's reference model and renders one organization-specific IDP/ADP blueprint document (Markdown or Notion), scored against an agentic-DevOps maturity rubric. Use when synthesizing discovery, persona, workload, product, permissions, and work-tracking findings into a single reviewable deliverable for platform leadership.

Discovers real infrastructure across cloud and on-prem/local providers (Azure, AWS, GCP, Kubernetes) and normalizes it into the shared Resource schema. Use when starting a platform blueprint for a specific organization and no inventory exists yet, or when the inventory needs to be refreshed against current state.

Normalizes Azure RBAC/Entra ID, AWS IAM, and Kubernetes RBAC into one IdentityBinding model, then flags over-privileged, cross-boundary, orphaned, and unowned access. Use when mapping permissions boundaries or auditing IAM/RBAC posture for a discovered environment.

Clusters discovered identity bindings and org group data into discrete platform personas mapped onto the five-plane model, including emerging agent personas (Cluster Doctor, coding agents). Use when defining who a platform serves, building a persona-aware onboarding flow, or scoping which stakeholders a golden path must satisfy.

Packages discovered workloads and golden-path patterns into a self-service product catalog — each entry a golden path with an SLA and an owning persona. Use when defining what a platform's self-service menu should contain, deciding whether a capability should be exposed as a product versus a one-off request, or reviewing catalog sprawl.

Adapter-based bridge from discovered platform entities (personas, workloads, permission gaps) to whatever work-tracking system the org already uses — Linear, Jira, GitHub, or Azure DevOps — detected at runtime. Never files a ticket silently; always drafts for human approval. Use when a discovered gap (unowned resource, over-privileged binding, missing workload owner) needs to become a tracked, assignable piece of work.

Groups discovered resources into Score-style workload definitions with a closed type taxonomy (web-service, batch-job, ml-training, data-pipeline). Use when normalizing raw infrastructure into meaningful application-level units, defining what "a workload" means for a specific platform, or scoping autoscaling/resource-request defaults per workload type.

Cloud Development Environments (CDEs) as a platform capability — preconfigured on-demand workspaces, the inner-loop counterpart to an IDP. Use when evaluating or rolling out CDEs (Coder, Gitpod, Codespaces, DevPod), fixing slow onboarding or works-on-my-machine problems, securing source code off laptops, or provisioning controlled environments for AI coding agents.

Kubernetes cluster lifecycle management as a platform product — Day 0 blueprints, Day 1 provisioning, Day 2 operations, and fleet management at scale. Use when designing cluster architecture, planning upgrades or patching, managing multiple clusters, defining cluster templates/blueprints, setting up GitOps drift control, or fixing snowflake-cluster operations.

Reference architecture for scaffolding an Internal Developer Platform — the five-plane model, platform personas and what each consumes/creates, golden paths, design principles, and the sovereignty decision axis. Use when designing or reviewing an IDP, choosing platform tooling (portal, orchestrator, IaC, CD), defining golden paths and self-service workflows, planning an AI/ML platform, or evaluating cloud vs sovereign architecture.

Observability as a platform capability — OpenTelemetry standardization, cross-signal correlation, auto-instrumentation, dashboards-as-code, and SLO-based reliability. Use when designing or reviewing platform observability, instrumenting services, choosing telemetry tooling, setting up dashboards/alerts, defining SLOs/SLIs/error budgets, or diagnosing why incidents take too long to resolve.

Vulnerability management as a platform capability — shift down (not left), hardened base images, policy-as-code guardrails, SBOMs, and self-service remediation. Use when designing platform security, handling CVE scanning and prioritization, choosing security tooling (Trivy, Grype, Syft, OPA, Kyverno), setting patch SLAs and metrics, or breaking a team out of CVE triage toil.

Current platform engineering benchmarks and trends (2025 State of Platform Engineering Vol 4, n=518; State of AI in Platform Engineering, n=242) for justifying platform decisions with data. Use when building a business case for platform investment, benchmarking a platform team (budget, metrics, maturity, adoption), countering defunding risk, or grounding claims about AI's actual role in platform teams.