platform · architecture · ai

Platforms, {quietly}.

I lead a team that builds internal platforms: pipeline templates, Terraform modules, shared workflows, governance as code. The teams that use them mostly never think about them. That's the point.

azureidentityrbacterraform· 2026-10-21

Custom roles in a nutshell

Built-in Azure roles are cut for jobs, not tasks. How to find the few actions a task needs, why the first custom role gets made by hand, and how to move role definitions into Terraform with an identity of their own.

read →

more writing

Privileged access with PIM

Eligible instead of member, the activation policy and what it asks of the person activating, the three PIM systems that share a name, and why the approval step cannot be automated, only made faster.2026-09-25 · 14 minazureidentityrbacgovernance

Security groups at scale

Assigned versus dynamic membership, nesting that keeps the group count sane, groups managed from Terraform by convention, and the line between creating groups and managing who is in them.2026-09-18 · 13 minazureidentityrbacterraform

Azure identity, from startup to enterprise

Permissions inherit downward and nothing lower takes them back. That one rule decides when direct assignments stop working, when you need security groups, and when you need PIM and administrative units. A maturity ladder with the symptoms that tell you which rung you are on.2026-09-11 · 12 minazureidentityrbacgovernance
$ ls writing/ --all → 13 articles