We design the platform before the workloads arrive: where the boundaries are, who owns what, how a failure is contained, and what the bill looks like at the end of the quarter. Then we write it down so your team can run it without us.
Landing zones
Development, staging and production are separate environments with their own boundaries, not one environment with naming rules. Guardrails are applied at creation, so a workload cannot be placed outside the baseline. The baseline includes identity, logging and retention from the first resource.
A guardrail that can be bypassed is not a guardrail.
Network
Each zone has its own address space and its own policy. Traffic between zones is admitted by an explicit rule, and the rule is recorded. Hybrid links to on-premises systems and external partners are separate paths with their own failover, so a partner connection failing does not take the estate with it.
Every flow between zones can be traced to the rule that admitted it.
Observability
Events, metrics and traces are collected at the datapath and kept long enough to answer a question about last quarter, not only last hour. Alerting is written against the signal that matters to the service, and incident readiness means the dashboards exist before the incident.
Retention is part of observability, not an afterthought.
Governance
Rules are enforced at creation rather than audited afterwards, so a non-compliant resource is refused rather than found later. Cost is measured against the workloads that generate it, and the control that reduces it is a policy, not a monthly report.
Enforcement at creation beats discovery at audit.