Phase 15 — Principal Architecture, FinOps & Capstone
Difficulty: ⭐⭐⭐⭐⭐ (the synthesis) | Estimated Time: 1–2 weeks (15–25 hours) Prerequisites: every prior phase — this is where they converge
Why This Phase Exists
Fourteen phases each built one engine: ARM's deployment graph (P01), Terraform's plan engine (P02), the OAuth2/OIDC/JWT flows (P03), the RBAC + Policy evaluator (P04), the landing-zone inheritance resolver (P05), the NSG + route engine (P06), the OCI registry + AKS scheduler (P07), the CI/CD DAG + OIDC federation (P08), the API gateway (P09), the Service Bus broker + Event Grid retry (P10), the Functions scale controller + Durable replay (P11), Key Vault envelope encryption + Managed Identity (P12), the KQL engine (P13), and the reliability primitives — SLA composition, retry, circuit breaker (P14).
Each was a mechanism. A senior engineer knows the mechanisms. A principal composes them into a platform and defends the composition with numbers — which is a different skill, and the one this phase builds. The capstone is the moment the fourteen engines stop being fourteen manuals and become one system you can architect, score, and admit deployments into.
Two truths organise this phase, both the natural conclusion of Phase 00's "make correct tradeoffs on one control plane":
- The Well-Architected review is a repeatable method, not an opinion. Given any design, you score it against the five pillars — Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency — from the evidence (the composed SLA, the security posture, the bill), name the pillar you trade, and write the ADR. The lab makes the method executable.
- FinOps and DR are arithmetic you do before the review. "Make it cheaper" and "survive a region loss" are not vibes; they are levers with numbers — right-sizing, reservations, scale-to-zero, lifecycle tiers, egress avoidance; and RPO/RTO, active-passive vs active-active, region pairs. A principal quantifies both.
Skip this phase and you have fourteen impressive components and no platform — exactly the failure mode that keeps strong engineers stuck below principal: they can build any one thing and cannot compose, score, and defend the whole.
What "Capstone" Means Here
The capstone is the integration lab: a Platform model that takes a proposed
Deployment and runs compact re-implementations of the prior phases' checks —
identity (P03), authorization (P04), policy (P04), security posture (P12), SLA (P14),
cost (P00) — then admits or rejects it and emits a Well-Architected scorecard and
a generated ADR. It is small by design (each check is a few dozen lines) but real:
the deny-wins ordering, the confused-deputy aud check, the serial-vs-redundant SLA,
the $-shaped bill are all correct. Run by a human, this function is a principal
design review.
Concepts
- The Well-Architected review as a method. The five pillars as a scoring function; how to score a design 0..100 per pillar from evidence; how the same two designs flip winners when the workload's weights change (P00's lesson, now applied to a whole platform); producing the ADR.
- The Architecture Decision Record (ADR). Context (the forces and numbers), Decision (one sentence), Alternatives (the dial each turned wrong for our numbers), Consequences (what to monitor, what would reverse it). The durable, auditable artifact a review produces.
- FinOps — the cost levers, quantified. Right-sizing, reservations / savings plans, autoscale + scale-to-zero, storage lifecycle tiers, egress avoidance, dev/test shutdown — each with the arithmetic that says how much it saves and what it costs in latency or operability.
- Multi-region & DR. Active-passive vs active-active; RPO (data-loss window) and RTO (time-to-recover); Azure region pairs; failover via Front Door health probes; and the cost of each tier of redundancy (the SLA gain vs the doubled bill).
- The reference architecture. The secure event-driven serverless platform that composes the whole track: landing zone (P05) → identity, JWT, RBAC (P03–P04) → private networking (P06) → API gateway (P09) → events, Service Bus / Event Grid (P10) → serverless, Functions / Durable (P11) → Key Vault + Managed Identity (P12) → observability (P13) → reliability (P14). The admission gate is its control point.
Labs
Lab 01 — Platform Capstone: the Admission Gate (flagship, implemented)
| Field | Value |
|---|---|
| Goal | Build the platform admission gate: given a proposed Deployment (identity token, the action + scope it wants, the resource's policy properties, its network exposure, Managed-Identity vs stored secret, an availability chain, a cost model), run the prior phases' checks and admit or reject it — rejecting on invalid token (401), unauthorized (403), or any policy deny (403) — then score it on the five Well-Architected pillars and emit a generated ADR. |
| Concepts | composing identity (P03), RBAC deny-wins (P04), Azure Policy effects (P04), security posture (P12), SLA composition + cost (P00/P14) into one fail-closed decision; the Well-Architected review as a function; the ADR as the artifact. |
| Steps | 1. Deployment/AvailabilityLink/CostLine with validation; 2. check_identity (iss/aud/exp/nbf, no sig); 3. check_authorization (deny-wins RBAC, segment-aware scope); 4. check_policy → violations + has_deny_violation; 5. check_security_posture (rewards MI/private/KV/CMK); 6. composite_sla / monthly_cost / downtime; 7. well_architected_score (five pillars); 8. admit — the gate + scorecard + ADR. |
| How to Test | pytest test_lab.py -v — identity pass/fail (expired, wrong aud, nbf, leeway); authorization deny-wins + scope; policy violations (public PII, no HTTPS) + clean pass + audit; posture rewards MI/private and penalizes secret/public; SLA + cost math; admit rejects on each gate and admits the good case with a populated scorecard + non-empty ADR; well_architected_score returns all five pillars; determinism. |
| Talking Points | "Walk me through what your platform does between a deploy request and a created resource." "Why is the reject a 401 here and a 403 there?" "Compose the SLA of this chain — show me the number, then tell me which pillar to trade." "Where does a stored secret cost you in the score, and why?" |
| Resume bullet | Built an end-to-end Azure platform admission gate composing JWT claim validation, RBAC deny-wins, Azure Policy deny effects, SLA composition, and cost modeling into one fail-closed decision with a Well-Architected scorecard and generated ADR. |
→ Lab folder: lab-01-platform-capstone/
How This Phase Integrates Every Prior Phase
The capstone is the place every engine plugs in. The admission gate is the control-plane request path of Phase 00 — authenticate → authorize → validate (policy) → score — made concrete, with each step a distilled prior phase:
| Phase | Engine built there | How the capstone uses it |
|---|---|---|
| P00 | WAF tradeoff + SLA/cost modeler | the five-pillar scorer; composite_sla, monthly_cost, the ADR habit |
| P01 | ARM deployment graph + idempotent PUT | the request the gate fronts: an idempotent control-plane write |
| P02 | Terraform plan/diff engine | the IaC the deploy request comes from; what-if is the gate's dry run |
| P03 | OAuth2/OIDC/JWT validator | check_identity — iss/aud/exp/nbf, the confused-deputy aud guard |
| P04 | RBAC + Policy evaluator | check_authorization (deny-wins) + check_policy (deny/audit effects) |
| P05 | landing-zone inheritance resolver | the management-group scope the policies + RBAC are assigned at |
| P06 | NSG + route engine, Private Link | the public_network posture flag; private endpoints for PII |
| P07 | OCI registry + AKS scheduler | the container image the serverless/AKS workload deploys |
| P08 | CI/CD DAG + OIDC federation | the pipeline that calls the gate; OIDC = no stored secret |
| P09 | API gateway (JWT scope + rate limit) | the edge that verifies the signature before the gate sees claims |
| P10 | Service Bus broker + Event Grid retry | the async tier in the availability chain; at-least-once + DLQ |
| P11 | Functions scale controller + Durable | the compute the deployment provisions; scale-to-zero (FinOps) |
| P12 | Key Vault + Managed Identity | check_security_posture — MI vs secret, Key Vault, CMK |
| P13 | KQL engine + alert rules | the observability the scorecard's findings feed; DLQ-depth alerts |
| P14 | SLA composition + retry + circuit breaker | composite_sla, the redundant-link math, the reliability pillar |
The integrated scenario the whole track has pointed at (Phase 00 named it) is the
secure event-driven serverless platform: Front Door → APIM → Functions/Durable →
Service Bus/Event Grid → Cosmos via Private Endpoint, secrets in Key Vault via Managed
Identity, all under a landing-zone policy baseline, observed by Azure Monitor, made
reliable by SLA-composed redundancy. The capstone's admit() is the gate that lets a
deployment into that platform only if it clears identity, authorization, and policy
— and scores it so the reviewer can defend the call.
Deliverables Checklist
-
Lab 01 implemented; all tests pass against
solution.pyand yourlab.py. - You can draw the admission path (identity → authz → policy → score) and name the HTTP-shaped status each gate returns on failure (401 / 403 / 403).
- You can compose the reference architecture's SLA chain in your head and say which pillar is weakest and what you'd trade to fix it.
- You can list the FinOps levers and, for each, the number that decides whether it's worth pulling (the staleness cost, the commitment term, the egress GB).
- You can state RPO and RTO for active-passive vs active-active and the cost gap.
- You can write the one-paragraph ADR the gate generates, by hand, for a real design — and say what would reverse the decision.
Guides in This Phase
- HITCHHIKERS-GUIDE.md — the 30-second model of a principal review, the numbers, the war stories; read first.
- WARMUP.md — the full zero-to-principal primer on the review method, FinOps, DR, and the reference architecture; read slowly.
- BROTHER-TALK.md — the candid, off-the-record version: what being the principal in the room actually feels like.
Key Takeaways
- The job is composition: fourteen engines become one platform, and the principal skill is admitting deployments into it correctly and defending the design with numbers.
- The Well-Architected review is a repeatable method, not a taste: score each pillar from evidence, name the trade, write the ADR.
- FinOps and DR are arithmetic — the cost levers and the RPO/RTO tiers each have a number; "cheaper" and "more available" are not free and you quantify the price.
- The gate fails closed. Identity, authorization, and policy are hard rejects in that order; the scorecard is advice. Deny by default is the security posture the whole track defends, and the capstone is where it all comes together.