You Don’t Need a Portal — You Need Paved Paths

Your internal developer platform has a portal, a service catalog, infrastructure modules, a security wiki, and a Slack channel called ask-platform. Developers still open the cloud console in an incognito window and provision databases by hand. The mismatch is structural: the IDP is monolithic in procurement and fragmented in practice. Composable platform engineering fixes that by trading the all-in-one suite for paved paths with swappable parts.

Structural artifact: portal surface versus paved paths

A monolithic IDP sells a single pane of glass. A composable IDP ships golden paths — opinionated, tested, policy-guarded routes from repository to production. Everything else is the portal: discovery, docs, and escape hatches for workloads that genuinely need bespoke infra.

flowchart LR
    subgraph Portal["Portal layer (discovery)"]
        BC[Backstage catalog]
        DOC[Runbooks + ADRs]
        AI[AI assistant plugin]
    end

    subgraph Paved["Paved paths (golden paths)"]
        TF[Infra module: service-baseline]
        OPA[OPA policies: deploy-guardrails]
        PIPE[CI template: build-test-scan-deploy]
        OBS[Observability bundle: OTel + dashboards]
    end

    subgraph Escape["Escape hatch (governed)"]
        MAN[Manual workspace]
        EXC[Exception ticket + timebox]
    end

    DEV[Developer] --> BC
    BC -->|scaffold via template| TF
    TF --> PIPE
    PIPE --> OPA
    OPA -->|allow| OBS
    OPA -->|deny| DEV
    BC -->|exception approved| EXC
    EXC --> MAN
    AI --> BC

Figure 1: Composable IDP — Backstage for discovery; infra modules, OPA, and CI templates for execution; manual path requires exception.

LeanOps’ 2026 platform engineering trends analysis documents the shift explicitly: composable platforms over monolithic IDPs, with FinOps and security embedded at provisioning time rather than bolted on post-deploy. Harness’s policy-as-code overview describes the enforcement layer: Rego policies versioned in Git, evaluated in CI and at deploy time — the mechanism that makes paved paths trustworthy without a central gatekeeper team.

Build versus buy: capability matrix

Capability	Build (custom)	Buy / adopt (Backstage, OPA, versioned modules)
Service catalog and docs	Long portal build; drifts without owners	Backstage OSS plus data contracts — faster path to MVP catalog
Deploy guardrails	Bespoke checks per service — high maintenance	OPA/Rego library in Git — one policy, all pipelines
Infra baseline	Copy-paste per team; state sprawl	Versioned module with T-shirt sizes plus cost annotation
Secrets and identity	Custom vault integration per runtime	Module wires workload identity; path enforces pattern
Observability pack	Each team picks dashboards; alert fatigue	Paved path ships OTel collector plus standard SLO dashboards
Exception workflow	Slack thread archaeology	Portal plugin: timeboxed exception with auto-expiry and audit

Integration tax of the monolithic IDP

Procuring a single developer-platform product without decomposing capabilities multiplies hidden integration cost. Platform teams absorb the following when the suite owns catalog, CI, secrets, and policy as one licence — and none of them talk to existing estate cleanly.

• Licence coupling tax: vendor upgrade cycles force simultaneous changes to CI, CD, and catalog — multi-week regression windows per release.
• VCS lock-in tax: migrating pipelines when the IDP’s source-control integration is proprietary — large migration projects for mid-size estates.
• Policy language silo tax: vendor policy DSL unlike OPA/Rego — security team maintains two rule sets (Kubernetes plus IDP).
• State partition tax: monolithic IDP wants its own state buckets; brownfield modules need import surgery per service.
• Catalog stale-data tax: without Backstage-style data contracts, service metadata drifts as teams rename owners and deprecate endpoints.
• Training tax: proprietary portal UX each quarter; composable paths reuse infra and PR workflows developers already know.
• AI assistant context tax: LLM plugins need structured catalog APIs — monolithic portals rarely expose machine-readable capability descriptors.

Boundary rules

The portal explains and discovers; paved paths execute. Anti-corruption: legacy automation stays behind a facade module until retirement — do not fork the golden path for one team. OPA policies are organisation-wide; exceptions are timeboxed tickets, not permanent policy forks. Infra modules expose T-shirt sizes (small, medium, large), not raw instance types — cost estimation is a platform feature, not a developer spreadsheet task.

Acceptance protocol: deploy through paved path in under 30 minutes

A buyer or engineer should run this test in a sandbox account without platform team hand-holding. Timer starts at empty git repository.

1. Scaffold from template. Clone org service-baseline template; run scaffold with service name and team id.
2. Open pull request. CI runs unit tests, SAST, and OPA policy check (image registry, resource tags, cost budget).
3. Merge to main. Infra module provisions runtime, IAM, secrets, OTel collector.
4. Verify deployment. Hit health endpoint on deployed URL; confirm trace in standard dashboard.
5. Prove policy enforcement. Attempt forbidden change (public object ACL) — pipeline must fail with policy violation citing Rego rule name.
6. Confirm catalog sync. Service appears in Backstage with owner, SLI, and links — no manual YAML edit.
7. Record evidence. Export CI logs or short screen recording; attach to platform assessment scorecard. Total elapsed time under 30 minutes.

Failure criteria: any manual console step, platform team Slack intervention, or undeclared secret outside the approved vault pattern — test fails, composable IDP not ready for promotion.

When bespoke platform code still makes sense

Heavily regulated bare-metal estates, mainframe adjacency, or multi-cloud with per-tenant isolation may need custom orchestration beyond standard modules. Build custom when paved-path constraints genuinely block the workload — not when a team prefers unconstrained IAM. The composable default wins when most services fit a T-shirt size and the organisation’s bottleneck is coordination, not exotic infrastructure.

Composable stack reference architecture

A minimal composable IDP for a mid-size engineering estate typically contains five versioned artefacts, each independently replaceable:

1. Backstage — software catalog, TechDocs, scaffolder templates pointing at paved-path cookiecutter.
2. Service-baseline infra module — cluster deployment, workload identity, secrets, standard tags, T-shirt CPU and memory.
3. OPA policy bundle — Rego in Git: approved registries, mandatory labels, cost ceiling, network policy.
4. CI workflow template — GitHub Actions or GitLab CI importing the above; no per-service fork.
5. Observability pack — OpenTelemetry collector sidecar, Grafana dashboards, PagerDuty routing by team label.

Swap Harness for GitLab CI without touching Backstage. Replace OPA with Kyverno for Kubernetes-only shops — the portal and module boundaries stay stable. That swap cost is measured in days, not quarters, which is the point.

FinOps and security on the golden path

LeanOps trend analysis shows FinOps guardrails moving to provisioning time — estimated monthly cost on the PR comment before merge. Encode in the infra module: cost annotation and hard fail when budget exceeded. Policy-as-code in OPA enforces the same ceiling at plan time. Developers see economics before infra exists; finance sees fewer surprise invoices.

Security-as-platform-capability means SAST, dependency scan, and image provenance run in the paved path by default — not as a ticket to AppSec. Exception path requires CISO-delegated approver and timeboxed expiry; expired exceptions trigger automated teardown alert.

Scorecard for platform buyers

After the 30-minute acceptance test, score the programme on outcomes you can observe: median time-to-first-deploy for new hires, share of services on paved path, policy violations caught pre-merge, and developer satisfaction with platform workflows. Buy catalog and policy engines. Build the golden-path modules that encode your cost, security, and observability non-negotiables. Measure the 30-minute test, not portal login counts.