Internal — Engineering Operating Model
Internal reference for the Propel team. Not customer-facing. How we work, and why that is the product.
Positioning: shift-left as a service
Traditionally, DevOps was a gate — devs wrote code and threw it over the wall; a central team owned infra, deployments, and ops. Every handoff was a queue, and every queue was cycle time.
Shift-left flips it: teams own what they build end to end — they contribute to IaC, deploy through paved paths, and monitor their own services — while the platform team owns what makes that possible. The point isn't devs doing more work; it's removing the wait.
Our differentiator against traditional DevOps-as-a-gate providers:
We give your team paved paths and we operate the platform underneath them, so your developers ship end-to-end — safely. Shift-left as a service.
DORA has backed this model for a decade. Its recent theme is directly relevant to us: AI amplifies whatever culture it lands in — strong process gets faster, dysfunction just fails faster. So our platform investment isn't overhead; it's precisely what turns AI-assisted development into a throughput multiplier instead of a risk multiplier.
Where we're already strong
- IaC that devs contribute to and deploy through — OpenTofu + Terragrunt, a versioned module library, and blueprints.
- A paved path — GitHub Actions + OIDC as the standard deploy road.
- AI self-service — tooling like Claude lets a dev work with our modules without being an infra expert. The guardrails (policy-as-code, pinned module versions, tests) are what make that safe.
We've technically shifted left. This is the mindset we lead with.
Where we need to close the gap (tooling → operating model)
1. Start simple, review where it matters
- Standard path? Go — start on the IaC, review at the PR. The paved path is the review: the module library, policy-as-code, and CI tests already encode the guardrails, so a human gate before you start is pure queue.
- Off the standard path? Bring a simple design first, grow it only as needed.
- The bar isn't lower; it moved from a meeting into the platform.
2. Async-first communication
- Decisions happen async, in channels, with a short written record — not on calendars.
- Email back-and-forth and missed meetings that resync a week later are pure cycle-time tax. A missed meeting should never block a decision, because the decision was meant to happen in-channel anyway.
- Meetings are reserved for genuinely divergent / high-bandwidth problems.
3. Defined expectations = internal SLOs
Undefined expectations mean everyone holds a different one and nobody's wrong — so a missed sync silently becomes a one-week slip. Write them down the same way we write customer SLAs:
| Interaction | Target (ratify per team) |
|---|---|
| PR review turnaround (standard path) | e.g. < 1 business day |
| Design feedback (off-path) | e.g. < 2 business days |
| Cross-team delivery commitment | agreed per work item, tracked |
| Full-time vs part-time capacity | explicit % and response window |
Make delay a visible number, not a tolerated norm.
4. Measure it (DORA)
Turn opinions into numbers we can watch move. Track all four DORA keys, not just the speed pair — for a company operating client infra under SLAs, the stability pair is what we sell.
| DORA key | Dimension | Why it matters to us |
|---|---|---|
| Lead time for changes | Speed | Already measuring. Core shift-left signal. |
| Deployment frequency | Speed | Already measuring. Flow through the paved path. |
| Change failure rate | Stability | This is our managed-services quality promise. |
| Failed-deployment recovery time | Stability | Same metric as customer SLA restore time. |
Elite performance is doing all four at once — speed and stability rise together, they aren't a trade-off. The two stability keys double as our SLA evidence, so internal metrics and customer promises converge on one dashboard.
How this shows up across scenarios
| Scenario | Operating-model emphasis |
|---|---|
| Launch | Teach the client team the paved-path + start-simple model as part of handover |
| Launch & Manage | We operate the platform; client devs self-serve on top; DORA metrics reported |
| Takeover | Introduce paved paths incrementally; measure baseline DORA first |
| Incubate | Full Propel operating model; metrics travel to the client at graduation |
| Embed | Transfer the culture, not just the code — this page's principles are a deliverable |
Delivery foundations (internal standards, applied per scenario)
The reusable substrate behind every engagement. Depth is applied per scenario (see each scenario page for the client-facing version).
- Landing zone — Control Tower / LZA / AFT to vend accounts with SCP guardrails, org CloudTrail → log archive, security tooling, tagging. One repeatable stamp.
- IaC & modules — Two-repo model:
propel/infrastructure-modules(versioned, our IP) + per-client<client>-infrastructure-live(thin,customer.hclexternalises accounts/domains). Modules pinned by version, never local-path. (Novamera'scloudops-infrastructureis the reference to migrate to this.) - CI/CD — GitHub Actions + OIDC (no static keys); Atlantis → a TACOS (Spacelift/env0/Scalr) with in-account runners past ~5–10 clients. Policy-as-code (OPA/Conftest) + drift detection.
- Observability — thin control plane (Grafana + Uptime Kuma) querying each client in place; telemetry stays client-side. Full platform comparison, cost/TCO, and log-privacy model on the Observability & Logging page.
- Logging & residency — Retention lives client-side; we query in place, never centralise raw logs. Decide practical vs strict per client.
- Security & compliance — SCPs + GuardDuty/Security Hub/Config/Inspector baseline; OPA policy gates; pursue Propel's own SOC 2; BAAs for PHI.
- Secrets — Secrets Manager / SSM, placeholder-seed +
ignore_changes, OpenTofu state encryption. No secrets in git or state. - FinOps — Budgets + Cost Anomaly Detection + enforced tagging per client. (The $2k/mo forgotten-SageMaker case is why this is non-negotiable.)
- Backup/DR — AWS Backup as code, per-resource RTO/RPO, tested restores.
- Incident & on-call — Severity model, runbooks linked from alerts, status page, blameless postmortems.
The observability offering — platform comparison, honest cost/TCO (including the maintenance tax), and the client-facing log-privacy & PII model — has its own page: Observability & Logging →.
Principles (hold on every scenario)
- Client data and state stay client-side (exception: Incubate, until graduation).
- Query-in-place, don't centralise.
- OSS / cheap first; paid SaaS only when ops cost exceeds the licence.
- Reusable modules are Propel IP; live config is the client's.
- Everything is handover-ready by construction — no exit should need a migration project.
- Shared responsibility is written and signed before build starts.
Status: v0.2 draft · Owner: Propel CloudOps · Review quarterly.