Built-in Azure roles are cut for jobs, not tasks. How to find the few actions a task needs, why the first custom role gets made by hand, and how to move role definitions into Terraform with an identity of their own.2026-10-21 · 11 minazureidentityrbacterraform
Eligible instead of member, the activation policy and what it asks of the person activating, the three PIM systems that share a name, and why the approval step cannot be automated, only made faster.2026-09-25 · 14 minazureidentityrbacgovernance
Assigned versus dynamic membership, nesting that keeps the group count sane, groups managed from Terraform by convention, and the line between creating groups and managing who is in them.2026-09-18 · 13 minazureidentityrbacterraform
Permissions inherit downward and nothing lower takes them back. That one rule decides when direct assignments stop working, when you need security groups, and when you need PIM and administrative units. A maturity ladder with the symptoms that tell you which rung you are on.2026-09-11 · 12 minazureidentityrbacgovernance
Four months of AI configuration grew into a five-folder system with version control and a nightly linter. Then Anthropic published new context-engineering rules, I audited what the thing actually believed, and cut long-term memory by 82 percent.2026-09-04 · 6 minaiworkflow
Two people moved just under 5,000 Azure resources into a different tenant. Production took two and a half hours because Dev took two days. The landmines, the verification discipline, and why the first environment is research and development, not delivery.2026-08-21 · 6 minazuremigrationterraformidentity
We deleted the pipeline checks from branch protection and merging got stricter. A convention-based PR gate for when your checks run outside GitHub, and the seven design decisions behind it.2026-07-10 · 5 mingithubplatformgovernance
The preset architecture behind one opinionated Renovate configuration across 50+ repos: two composed presets, a 14-day soak window, provider grouping, and the tradeoffs.2026-05-29 · 8 minrenovateterraform
Why we deliberately wait 14 days before adopting any new dependency version, how security advisories bypass the hold, and what the delay actually costs.2026-05-22 · 2 minrenovategovernance
Coding gives you reps every day. Architecture and leadership do not. Thirteen architecture katas, a leadership trainer that role-plays the hard conversation back at you, and a Friday audit that refuses the phrase "good week" without evidence.2026-05-15 · 7 minaiworkflow
Four layers that make an AI assistant useful across four roles: a learned-instincts loop, a brand-voice profile built from 300 Slack messages, auto-detected operating modes, and the ten guardrail sections nobody talks about.2026-04-27 · 5 minaiworkflow
One JSON file lists the repositories. Terraform decides their settings, team permissions, and branch protection. Plus the honest part: what the provider cannot do and how we work around it.2025-09-05 · 6 mingithubterraformgovernance
GitHub teams that mirror Azure AD groups, synced on a schedule by Terraform. Group discovery by prefix, nested-group filtering, and the email-to-username lookup problem nobody warns you about.2025-08-19 · 6 mingithubterraformidentity