Strategic decisions behind the platform.

Why this mattered

Enterprise customers needed to see what was happening across every workspace they owned — posture, drift, audit history — but those workspaces had been configured independently for years. Every ask for visibility kept colliding with the operational control each team already held.

Tradeoff · Impact

We separated the two. Visibility aggregates up to the enterprise tier; day-to-day administration stays with each workspace. Organisation-wide oversight could finally scale without touching the boundaries the teams running it already trusted.

Why this mattered

Provisioning conflicts and drift compounded the moment an enterprise had more than a handful of workspaces. The platform was modelling identity it didn't actually own — and every disagreement between platform state and IdP state turned into a support ticket.

Tradeoff · Impact

We gave up the ability to edit identity locally and gained the ability to reason about it correctly. The IdP became upstream — explicitly, in the data model and on the surface — and every downstream conflict picked up one predictable resolution. Read-only states stopped feeling restrictive and started reading as truth.

Why this mattered

Setup completion didn't mean the system was healthy. Certificates expired, provisioning quietly broke, syncs failed at three in the morning — and admins were the last to know, often hearing about it from their support contact instead of the product.

Tradeoff · Impact

The setup screen stopped pretending to be a one-time wizard. It reports its own state — the four observable conditions of an SSO connection, the validation outcome of a SCIM mapping — so the page that configured the integration is also the page that tells you it is still working.

Why this mattered

Most of the operational risk in an enterprise account lives in the years after a teammate joins — guest access that lingers past the project, temporary roles that never expire, inactive accounts that quietly retain permissions long after the team has moved on.

Tradeoff · Impact

We modelled membership as a lifecycle instead of a setting. Six named states, the transitions between them, and three rules that stay true across all of them — so the interface could answer questions the configuration page never asked, and the data model finally matched how teams already think about who belongs.

Why this mattered

The home of a governance platform that opens to a configuration page answers the wrong question first. The reason admins actually open it on a Monday is operational — what changed, what needs attention, what's healthy across the workspaces they look after.

Tradeoff · Impact

The dashboard became the home. Configuration moved one click away, but the page now leads with posture — workspaces grouped by health, attention items pinned to the top, an activity feed grounded in real signal. The shape of the page finally matches the shape of the question.