idp-adp-architect

Organize the platform around five planes: developer control, integration and delivery, resource, security, and observability. Map category slots to tools per cloud first, then pick vendors, keeping portable invariants like Backstage, Score, Terraform/OpenTofu, a graph-based orchestrator, and OPA.

An Agentic Developer Portal is the interaction surface letting AI coding agents consume the same governed platform capabilities as humans, with identity, sandboxing, evaluation, and audit. Build it only after the underlying platform is mature, since agents amplify weaknesses in a shaky platform.

Make an explicit reuse, buy, assemble, or build decision per capability, defaulting to the least custom option that meets the requirement. Record the decision in a capability register with owner, interface, SLOs, unit cost, and an exit plan.

No. Any LLM- or agent-triggered infrastructure or environment change must route through a trusted CLI or the orchestrator API with RBAC and audit, never direct console or raw cloud API mutation. This keeps every agent action governed and logged as a Git pull request.

Treat jurisdiction as an architecture input: data residency does not equal data sovereignty. Self-host management stack components like Gitea, Keycloak, Vault, and Prometheus, use GitOps with OpenTofu as the exit mechanism, and test reconstruction on a different provider from Git alone.

Add the sixth Data and Model Management plane when workloads include training, serving, notebooks, or GPUs. It introduces a feature store, model registry with model cards, a dual-orchestrator pattern with an ML workflow orchestrator, model scanning gates, and drift observability.