Doctrine / Theology

The Heresies of Platform Engineering

A platform is an institution. Its failure modes look like ideology: hidden mutation, unowned guardrails, and bureaucracy disguised as safety.

Return to Archive Governance Initiation

Text

Authored as doctrine; evaluated as systems craft.

Doctrine

Platform engineering becomes dangerous when it stops respecting operational truth. A platform is not an opinionated product; it is the substrate for failure. It must make failure legible, bounded, and recoverable.

Kubblai doctrine names heresy as any practice that increases systemic ambiguity while claiming to increase safety.

Prefer legibility over magic.
Prefer reversible paths over enforced funnels.
Prefer ownership and accountability over centralized gatekeeping.

Heresy: invisible mutation

Mutation without a paper trail is drift by design. Mutating webhooks, templating layers, and sidecar injection can be valid, but only when the resulting intent is visible and auditable.

When operators cannot explain why an object looks the way it does, incidents become folklore.

Document every mutation with examples and field ownership expectations.
Expose admission logs and latencies; set budgets and alerts.
Provide a way to render ‘effective configuration’ deterministically.

Heresy: brittle golden paths

Golden paths are useful until they are enforced without escape hatches. A platform that cannot handle legitimate variance becomes a shadow platform: teams route around it, duplicating risk.

A disciplined platform offers defaults, not commandments.

Ship defaults with documented override mechanisms.
Make deviations explicit, time-bound, and reviewed.
Avoid coupling every workflow to a single control-plane extension.

Heresy: guardrails without exit ramps

Guardrails must include break-glass posture. In an incident, you may need to temporarily relax constraints—safely, measurably, and with compensations.

The Order values systems that can degrade gracefully rather than fail closed unpredictably.

Define emergency bypass procedures for admission, policy, and automation.
Log and audit every bypass; treat it as a change with a rollback plan.
Train the on-call rotation on the bypass posture before the outage.

Heresy: governance as punishment

Governance exists to keep platforms safe, not to make teams beg. When policy becomes punitive, teams hide their work. Hidden work is where incidents breed.

Serious governance is service: clear standards, fast review, and measured enforcement.

Prefer progressive enforcement: warn → enforce with exceptions → tighten.
Keep policy explainable under stress; avoid complex, surprising rules.
Measure throughput and safety together; tradeoffs must be explicit.

Canonical Link

Canonical URL: /library/the-heresies-of-platform-engineering