A quick orientation, so we're aligned

• Tell me briefly why you've started evaluating self-service platform tooling now
• How many engineers are on your platform team, and how many active developer teams do they support Options: 1-5 engineers, 6-10 engineers, 11-20 engineers, 21+ engineers
• When did your open ticket volume first cross a threshold that felt unsustainable Options: Within the last month, 1-3 months ago, 3-6 months ago, Longer than 6 months
• Describe the exact pilot use case you plan to run first, for example environment provisioning or service onboarding
• Which of these metrics does leadership already track: ticket backlog, mean provisioning time, guardrail violations, cost of shadow accounts, or developer satisfaction Options: Ticket backlog, Mean provisioning time, Guardrail violations, Cost of shadow accounts, Developer satisfaction
• Estimate the current average lead time for a developer to get a new environment, in hours or business days Options: Under 1 hour, 1-4 hours, Same business day, 1-3 days, 3+ days
• Could you commit at least one named engineer or a dedicated FTE to lead the pilot, and if not, what would prevent you from doing so Options: Yes, dedicated FTE available, Partial allocation only, No, cannot allocate staff, Undecided

Where the current setup is quietly costing you

• If ticket volume rose by 50 percent next quarter, what would break first in your team's ability to respond
• Who in your organization notices the problem first when provisioning slows, and what do they typically escalate Options: Platform lead, Engineering manager, Site reliability, Security/compliance, Developers directly
• How often do manual provisioning steps require cross-team approvals or manual security intervention Options: Daily, Several times a week, Weekly, Monthly, Rarely
• Why do engineers bypass the platform team to create resources, for example speed, missing templates, or capability gaps Options: Speed, Missing templates, Feature gaps, Lack of trust in platform, Other
• If you could not add headcount in the next six months, which single failure mode would force you to pause any broader rollout

The pilot you think will prove everything

• Are you confident a single golden-path template will represent broader needs, or will it hide edge cases until rollout Options: Confident it will generalize, Likely to hide edge cases, Unsure, need validation
• Walk me through the exact steps a developer uses today to request and receive an environment, from ticket creation to final handoff
• Who will own the pilot acceptance criteria and where will those decisions be recorded Options: Platform lead, VP/Director of Infrastructure, Project sponsor, Cross-functional committee
• Which integrations must be in place for the pilot to operate, such as CI pipelines, secrets manager, ticketing, or identity providers Options: CI/CD, Secrets manager, Ticketing system, Identity provider, Monitoring and logging
• Would you consider the pilot a success if ticket volume drops 50 percent but average provisioning remains above one hour Options: Yes, partial success acceptable, No, both targets required, Depends on other tradeoffs

Can your organization actually run this pilot

• Do you already have the cloud accounts, IAM roles, and API access required to let automation provision resources without daily handoffs Options: All access ready, Most access available, some gaps, Significant access gaps, Unknown
• List the target environments the pilot must access, such as dev accounts, staging clusters, or on-prem regions Options: Development accounts, Staging clusters, Production-adjacent environments, On-prem environments, Other
• Estimate the headcount and percent allocation your team can commit to the pilot, expressed as FTE or percentage Options: 0.25 FTE, 0.5 FTE, 1 FTE, More than 1 FTE
• Are there regulatory or security reviews that must complete before provisioning can begin, for example internal security review or compliance sign-off Options: None, Light review only, Formal security/compliance review, External audit required
• What single missing integration, permission, or approval would stop the pilot from starting this quarter

Which alternatives are on the table and why they might not work

• Name the alternatives you are evaluating and one reason each might fail to hit your provisioning or security targets
• For your current approach to remain, what would have to be true about its cost, risk, or speed
• Has anyone internally proposed solving this with an in-house tool, and if so what deliverables and timeline were proposed Options: Yes, prototype planned, Yes, work in progress, No, not proposed, Unsure
• Rate the likelihood you will choose a commercial vendor versus an internal effort Options: Very likely vendor, Somewhat likely vendor, Undecided, Somewhat likely internal, Very likely internal
• What would make you decide today to keep the incumbent process or build in-house rather than run a pilot with a new vendor

The numbers that will unlock a decision

• Suppose the pilot halves your ticket backlog but provisioning time improves only partially, would leadership require additional work before rollout Options: Yes, more work required, No, acceptable as-is, Need to see details
• Select up to three metrics you will use to sign off on pilot success, from ticket volume, provisioning lead time, guardrail enforcement, mean time to recover, and developer satisfaction Options: Ticket volume, Provisioning lead time, Guardrail enforcement, Mean time to recover, Developer satisfaction
• Identify the decision owner and the artifacts they need to sign off, for example a metrics report, runbook, or security attestation Options: Director-level signoff, VP-level signoff, Cross-functional committee signoff, Procurement approval required
• Choose the cadence for pilot checkpoints to review progress Options: Weekly, Biweekly, Monthly
• Given the pilot meets your numeric targets, how soon could you sign a broader contract and commit to rollout Options: Immediately, Within 2 weeks, Within 1 month, Longer term

Hidden risks that derail good pilots

• Name the rollout problems, such as template sprawl or undocumented exceptions, that make you skeptical about scale
• Describe the process for maintaining golden-path templates and who would own ongoing updates after the pilot
• Identify who will handle escalations when a provisioning guardrail blocks a legitimate developer workflow Options: Platform on-call, Engineering manager, Security contact, Cross-functional committee
• Give your best estimate for how many edge cases per month you expect when the pilot supports one development team Options: 0-2, 3-5, 6-10, 10+
• Point to one governance or cultural obstacle that could cause leadership to halt expansion even if the pilot technically succeeds

What would accelerate us toward contract or stop us cold

• Would a procurement requirement for a fixed statement of work and a three-month proof window fit your timelines or be a blocker Options: Fits our timelines, Would delay us, Blocker for procurement, Unsure
• Provide the title and function of the person who will own contracting and vendor risk reviews on your side
• Choose your target start month for the pilot Options: Immediately, Within 30 days, Next quarter, Later
• Do you have procurement or security terms that must be negotiated before a pilot can begin, such as data residency or indemnity limits Options: No special terms, Standard terms only, Yes, data residency, Yes, indemnity or other limits
• Once the pilot achieves the agreed metrics, who will authorize budget and what approval steps remain
• Select the level of ongoing support you expect post-pilot Options: Seller-managed runbook and handoff, Co-managed operations, Full internal ownership after handoff
• Provide the top three risks you want us to address before starting the pilot

• Deploy Developer Portal Instance
• Configure Service Catalog and Golden Paths
• Implement Environment Provisioning Workflow
• Build Reusable Infrastructure Templates
• Integrate Existing Cloud Accounts and Clusters
• Enable Secrets and Credentials Provisioning
• Automate Kubernetes Namespace Provisioning
• Provide CI/CD Pipeline Templates for Onboarding
• Enable Environment Lifecycle Automation
• Enforce Policy-as-Code and Guardrails
• Configure Role-Based Access Controls
• Activate Audit Logging and Compliance Trails
• Port Team Provisioning Scripts into Templates

Deploy Developer Portal Instance

• For the pilot, which deployment target will host your developer portal instance (select the primary target)? Options: Public cloud region (specify provider/region in a follow-up), On-prem Kubernetes cluster, Managed cloud service, Other
• Which Git repository will you use to store the portal configuration and UI code (provide repository URL or name)?
• How will you authenticate users to the portal (select the primary identity provider or method)? Options: Single sign-on via SAML or OIDC, Internal LDAP or Active Directory, Local accounts for testing only, Other
• Provide the target Kubernetes cluster name or cloud resource group that your portal should use for staging.
• Do you require high availability for the portal in production (multiple replicas and region failover)? Options: Yes, No, Pilot only, not HA

Configure Service Catalog and Golden Paths

• Which developer workflows do you want represented as golden path templates (e.g., new service onboarding, full-stack dev environment)?
• List the service catalog entries you want in scope for the pilot (provide entry names or IDs from your service registry).
• Describe the expected input parameters your golden path templates must accept (for example environment size, runtime, DNS name pattern).
• Do you require approval gates backed by your Jira workflow before provisioning? Options: Yes, Jira approval required, No automated approval, Manual Slack approval acceptable
• Who in your team will own updating and versioning the golden path templates (role or Git handle)?

Implement Environment Provisioning Workflow

• What is your pilot team's Jira queue name and current average open ticket count for environment requests?
• For the pilot, which environment type should you automate first (development sandbox, staging, or QA)? Options: Development sandbox, Staging, QA, Other
• Identify the Terraform module repository and branch you will use for provisioning the pilot environment (provide repo path).
• Confirm the maximum acceptable provisioning lead time for the pilot measured from Jira ticket creation to environment ready in minutes. Options: 30, 60, 120, Custom
• What acceptance criteria will you use to validate the provisioning workflow for the pilot (for example: reduce your pilot team's open environment tickets by 50% and provisioning time under 60 minutes measured in Jira)?

Build Reusable Infrastructure Templates

• Specify which Terraform modules or cloud templates you require converted into reusable templates (provide repo paths).
• Name the environment variables, secrets paths, and parameter names your templates must accept.
• List any compliance tags or cost-center labels your templates must apply to resources.
• Describe the testing approach you expect for template changes (unit tests, plan diffs, pipeline checks). Options: Terraform plan in CI, Unit tests, Manual review only, Other
• Is template ownership tracked in a Git repository with branch protection and pull request reviews? Options: Yes, No, Planning to add

Integrate Existing Cloud Accounts and Clusters

• Provide the cloud account identifiers and regions you want to integrate (AWS account IDs, Azure subscription IDs, GCP project numbers).
• Enter the Kubernetes cluster names and their kubeconfig access method your team will use for integration (for example cluster1 via IAM role).
• Confirm whether cross-account IAM roles or service principals are available to your platform for provisioning actions. Options: Yes, No, Need help configuring
• Attach the list of networks or VPCs where your provisioned resources must be placed or accessed.
• Specify the evidence that will validate successful account and cluster integration (for example: successful terraform plan and ability to create a namespaced namespace in the target cluster).

Enable Secrets and Credentials Provisioning

• Who manages your secrets backend and what paths will the portal need to write to (for example Vault path or cloud secrets path)?
• State the secret rotation policy you require for provisioned credentials (rotation frequency in days). Options: 30, 90, 180, Custom
• Indicate whether you need secrets injected into pods via volume, environment variables, or an external secret operator. Options: Kubernetes secrets mounted as volume, Environment variables, External secret operator, Other
• How will you audit secret access for the pilot team (logs forwarded to SIEM, CloudTrail, or in-repo audit records)? Options: Cloud audit logs to SIEM, Cloud provider audit trail only, In-repo audit records, Other
• Are there regulatory constraints on your credential storage we must enforce (for example HIPAA, PCI, or internal policy names)? Options: Yes, No, Partially — need guidance

Automate Kubernetes Namespace Provisioning

• Name the namespace naming convention you want enforced (for example teamname-env or project-namespace).
• Choose the resource quota and limit ranges you want applied to new namespaces for the pilot. Options: Conservative (small CPU/memory), Moderate, No quotas for pilot, Custom values provided next
• Identify the network policies you want applied by default to provisioned namespaces (provide policy names or repo paths).
• Outline the admission controls or mutating webhooks that must run on namespace creation in your clusters (for example sidecar injector, resource validator).
• Select whether you need automated namespace cleanup and specify the inactivity period that should trigger it. Options: Yes, after 30 days, Yes, after 90 days, No automatic cleanup, Custom

Provide CI/CD Pipeline Templates for Onboarding

• Enter the CI system and pipeline runner your pilot team uses (for example Actions runner name or Jenkins instance).
• Select the pipeline templates you need for onboarding (build only, build and deploy, full test matrix). Options: Build only, Build and deploy, Build, test, deploy
• Enter the artifact repository and image registry your CI pipelines should publish to (provide registry URL or name).
• Choose the branch protection and release gating rules your pipelines must support (for example required tests, PR approvals). Options: Require tests pass, Require 2 approvers, Require signed commits, Custom rules
• Estimate how many onboarding pipelines you want seeded during the pilot. Options: 1, 2-3, 4+

Enable Environment Lifecycle Automation

• State the environment lifecycle stages you want automated (for example provision, scale, snapshot, decommission).
• Set the retention policy for environment snapshots and backups you require. Options: 7 days, 30 days, 90 days, Custom
• Pick the scaling triggers you require (for example CPU threshold, scheduled scale, manual request). Options: CPU threshold, Scheduled scale, Manual scale, Other
• When should environment decommission run relative to last activity in your environment (for example after inactivity window)? Options: After 24 hours, After 7 days, After 30 days, Custom
• Indicate who will approve environment teardown and how approvals should be recorded (Jira ticket, Git PR, or CI job)? Options: Jira ticket, Git PR, CI job, Other

Enforce Policy-as-Code and Guardrails

• Define the policy acceptance criteria you will use to prove guardrails function for the pilot (for example blocked resource types, denied IAM permissions, and zero policy violations in policy engine reports).
• Attach the policy language and the repository path that will hold your policy rules (for example Rego policies in a Git repo).
• Is there an existing policy catalog or compliance matrix you require implemented (attach the document name or repo path)? Options: Yes, No, Partial — will provide chapters
• Pick whether you require automated policy enforcement at plan time, apply time, runtime, or a combination. Options: Plan time, Apply time, Runtime, Combination
• Verify the escalation path when a policy violation blocks deployment by providing the on-call alias or Slack channel.

Configure Role-Based Access Controls

• Declare the RBAC model you will use for namespaces and portal actions (Kubernetes RBAC, cloud IAM, or a hybrid mapping). Options: Kubernetes RBAC, Cloud provider IAM, Hybrid mapping
• Assign the initial roles and responsibilities for the pilot by naming the environment owner, developer, and ops group handles.
• Map which Git branches or repositories will have rights to update templates and pipelines.
• Decide whether service accounts should be per-namespace or shared across environments for the pilot. Options: Per-namespace service accounts, Shared service accounts, Hybrid
• Set the expiration policy for elevated access you require (for example time-limited role assumption period). Options: 24 hours, 7 days, Permanent until revoked, Custom

Activate Audit Logging and Compliance Trails

• Configure the primary audit log sink and retention target you require (for example SIEM endpoint, S3 bucket with retention days).
• Where should Kubernetes audit logs and cloud provider audit events be forwarded for the pilot? Options: SIEM endpoint, Cloud storage bucket, Log analytics workspace, Other
• Set the minimum log retention period you require for compliance. Options: 90 days, 1 year, 3 years, Custom
• Detail the resource actions that must produce audit events in your environment (for example namespace creation, IAM role changes, secret access).
• Upload or reference the compliance standard or control IDs you must map logs to (for example CIS benchmark sections, internal control IDs).

• desired_state
• stakeholders
• gaps
• success_criteria
• current_state
• decision_readiness
• current_state
• success_criteria
• desired_state
• stakeholders
• gaps
• decision_readiness
• stakeholders
• decision_readiness
• desired_state
• current_state
• success_criteria
• gaps
• success_criteria
• desired_state
• decision_readiness
• gaps
• current_state
• decision_readiness
• decision_readiness
• decision_readiness

• Master Services Agreement (MSA)
• Statement of Work (SOW) — Pilot and Rollout
• Subscription Agreement & Order Form
• Service Level Agreement (SLA)
• Pilot Acceptance and Success Criteria Agreement
• Data Processing Agreement (DPA) (conditional)
• Support and Escalation Addendum
• Change Order Agreement

• Go-live Health Check
• First Measurement Review
• Acceptance Gate Decision
• Quarterly Success Review

• Circulate the quarter-to-date metrics snapshot and backlog status to stakeholders for asynchronous comment before the next review.
• Produce a documented pass or fail status for each pilot acceptance criterion recorded in the Pilot Evaluation stage.
• Confirm the incumbent system is either decommissioned or formally retained read-only with archived data and a closure plan.
• For any failed criteria, agree specific remediation tasks and a firm timeline to achieve acceptance.
• Publish the acceptance decision record showing pass/fail per criterion and links to the measurement evidence.
• Document the incumbent wind-down checklist and schedule any necessary data migration or archival tasks.
• Create remediation tickets for conditional failures with completion dates that trigger a final acceptance acknowledgment.
• Operational metrics review
• Confirm the open infrastructure ticket count remains at or below the operational target or has a clear plan to reach it.
• Confirm the guardrail enforcement rate is meeting the operational threshold or that remediation items are on schedule to restore it.
• Maintain a prioritized backlog with committed target dates for the top 5 items that impact adoption or compliance.
• Update the backlog with priority, acceptance criteria, and target delivery quarter for each top item.
• Open incident or bug tickets for any persistent failures and assign a remediation timeline.
• Re-confirm committed success criteria and owners
• Confirm the deployment is functionally complete and core integrations are reachable.
• Identify and document the top 3 go-live blockers with remediation actions and target dates.
• Validate that named developer users can access the portal and perform a golden-path provisioning end to end.
• Log each go-live blocker with a resolution date and a single accountable owner.
• Publish a short onboarding checklist for developer testers to confirm access and basic provisioning steps.
• Collect error logs and screenshots for any failed provisioning attempts and attach to the blocker ticket.
• Present first measurement data
• Determine whether open infrastructure ticket count is reducing toward the pilot target recorded in the Pilot Evaluation stage.
• Determine whether average provisioning lead time (hours) is decreasing toward the target recorded in the Pilot Evaluation stage.
• Agree a prioritized list of corrective actions with completion dates to close gaps before the acceptance gate.
• Publish the measurement dashboard snapshot and the raw data sources for the two metrics used in this review.
• Create tickets for each corrective action with a target completion date and acceptance criteria for verification.
• Schedule a mid-point sync if any corrective action carries risk to the acceptance timeline.
• Restate acceptance criteria and numeric targets
• Backlog and enhancement burn-down
• Root cause analysis for metric gaps
• Deployment and configuration validation
• Present outcome data against each criterion
• Document pass or fail per criterion
• Persistent issues and escalation review
• Early adoption and usage signals
• Agree corrective actions and dates
• Confirm readiness timeline to acceptance gate
• Open blockers and immediate remediation
• Incumbent system wind-down confirmation
• Short status and next steps
• Agree remediation plan and signatory action