platform · architecture · ai

Platforms, {quietly}.

I lead a team that builds internal platforms: pipeline templates, Terraform modules, shared workflows, governance as code. The teams that use them mostly never think about them. That's the point.

terraformgovernancetutorial· 2026-11-03

Removed cannot take one item out of a for_each. Moved can.

A list drives a for_each, prevent_destroy guards every item, and one item has to leave Terraform while the real thing stays in place. Three obvious attempts fail, and the command that works skips review. One moved block and one removed block do it in a reviewed pull request, with a plan that shows nothing destroyed.

read →

more writing

Custom roles in a nutshell

Built-in Azure roles are cut for jobs, not tasks. How to find the few actions a task needs, why the first custom role gets made by hand, and how to move role definitions into Terraform with an identity of their own.2026-10-21 · 11 minazureidentityrbacterraform

Privileged access with PIM

Eligible instead of member, the activation policy and what it asks of the person activating, the three PIM systems that share a name, and why the approval step cannot be automated, only made faster.2026-09-25 · 14 minazureidentityrbacgovernance

Security groups at scale

Assigned versus dynamic membership, nesting that keeps the group count sane, groups managed from Terraform by convention, and the line between creating groups and managing who is in them.2026-09-18 · 13 minazureidentityrbacterraform

Azure identity, from startup to enterprise

Permissions inherit downward and nothing lower takes them back. That one rule decides when direct assignments stop working, when you need security groups, and when you need PIM and administrative units. A maturity ladder with the symptoms that tell you which rung you are on.2026-09-11 · 12 minazureidentityrbacgovernance
$ ls writing/ --all → 14 articles