Internal Developer Platform
A self-service platform where developers scaffold services from golden-path templates and provision environments through mandatory, audited policy checks.
Built by sanjay · AI Engineering Associate
The system, up close
Real captures from the running system — the demo, screenshots and architecture come first, then the deep dive.
Demo
End-to-end walkthrough: scaffold a service, provision an environment, watch a policy rejection.
The demo shows the self-service flow and the 7-layer policy guardrails in action.
Screenshots
Architecture
Why this needed to be built
Teams running 40+ microservices lose days to service onboarding: ticket handoffs, manual config, inconsistent templates and no audit trail.
Developers wait 2–4 hours just to provision a service, policies get bypassed, and nobody has clear visibility into who owns what.
What we built, and how it changes the workflow
We built a self-service developer platform — FastAPI backend, React dashboard — where services are registered in a catalog, scaffolded from approved templates, and provisioned only after a 7-layer policy check, with every action audited.
Developers register and scaffold services from golden-path templates (FastAPI, Express) that generate source, tests, Dockerfile and CI/CD config. Every provisioning request passes seven guardrails — role, environment, template approval, template-env, naming, resource limits — with no bypass path, then runs PENDING → VALIDATING → APPROVED → PROVISIONING → COMPLETED.
RBAC enforces four roles server-side; an immutable audit trail records every action; the dashboard shows live stats and recent activity. Compared to manual onboarding, registration is ~95% faster and provisioning ~97% faster.
Core design principle
- Policy validation sits between auth and provisioning with no bypass
- RBAC enforced on every API endpoint, server-side
- Every action written to an immutable audit trail
What it can do
A focused set of capabilities that define the system — no marketable filler, only what actually runs.
Service Catalog
Register, view, search and filter services with persistent data.
Golden-path scaffolding
Generate FastAPI/Express projects with tests, Dockerfile and CI/CD from approved templates.
Self-service provisioning
Request environments through a full approval pipeline.
7-layer policy guardrails
Role, environment, template, naming and resource-limit checks before any provisioning.
RBAC
Four roles (Admin, Platform Engineer, Developer, Viewer) enforced server-side.
Audit logging
Immutable trail of every action with user, role, result and reason.
Developer dashboard
Real-time stats and recent activity.
The end-to-end workflow
The system processing path, in order.
- 1
Sign in (role)
Admin, Platform Engineer, Developer or Viewer.
- 2
Register service
Add a service to the central catalog.
- 3
Scaffold
Pick an approved template; project + tests + Dockerfile + CI/CD are generated.
- 4
Request environment
Submit a provisioning request for dev / staging / prod.
- 5
Policy check
Seven guardrails run; violations are rejected and audited.
- 6
Provision & audit
On approval, artifacts are created and the whole flow is logged.
Stack & tech choices
- Backend
- Python 3.11, FastAPI, SQLAlchemy, Pydantic
- Database
- SQLite (WAL)
- Frontend
- React 18, TypeScript, Vite
- Testing
- pytest, FastAPI TestClient
Tested, verified and honestly scoped
Validation & tests
52 tests across 8 classes cover CRUD, RBAC, policy bypass, scaffolding and audit isolation; happy and failure paths verified.
- 52 tests: auth, catalog, templates, provisioning, policy, RBAC, scaffolding, audit
- Developer production-provision rejected and logged; no resources created
- Viewer cannot provision (403); unauthorized requests return 401
Security & hardening
- No secrets committed (.env gitignored)
- Server-side RBAC on every endpoint
- Policy-before-provisioning with no bypass; Pydantic input validation; CORS allowlist
Honest limitations
Internal Developer Platform is an internally developed engineering prototype. We state limitations rather than overclaim production readiness.
- Local sandbox only — creates project files, not real cloud infra
- SQLite, not production-scale
- Header-based auth; JWT/OAuth is future work
- No real CI/CD connection or multi-tenancy
Deep-dive references
Where this can go next
Realistic next steps we've scoped — not aspirational marketing copy.
- Real cloud provisioning (AWS / GCP / Azure)
- Kubernetes operator for scaffolded services
- Git integration (auto-create repos)
- Multi-env promotion dev → staging → prod
- OIDC / SAML authentication
- Multi-tenancy
Have a similar workflow?
Zenera Labs can build a custom version for your business.
This is one of sanjay's internally developed systems. Tell us about your requirement and we'll scope a tailored build around it.
Other systems we've built internally
AI Contract Analysis & Risk Detection
Faster document review with traceable evidence — upload a contract and get risk findings with source-verified citations.
naman · Engineering Portfolio
View case study
SentinelAI — Security Log Anomaly Detection
Risk-scored alerts from security events — a full-stack Mini-SIEM with ML detection, attack-chain correlation and explainable alerts.
pragna · Engineering Portfolio
View case study
AI Data Analyst & Business Intelligence Agent
Evidence-grounded business intelligence from spreadsheets — upload CSV/XLSX, get analysis, visualizations and explained answers.
priyanka · Engineering Portfolio
View case study