HS logo
back to work
case study · Dec 2025 – Feb 2026

StackGate

A self-service internal developer platform that turns plain-English PostgreSQL requests into structured specs, classifies risk, routes policy-based approvals, and provisions databases with a complete audit trail.

Next.js 15TypeScriptPrismaClaudeAzureTerraform
system diagramgithub repo

The problem

Infra requests get lost across tickets, Slack, and tribal knowledge, with inconsistent approvals and no audit trail. StackGate makes the plain-English request the input and produces a governed, auditable provisioning workflow.

What it does

  • Plain-English intake: Claude parses a database need into a structured PostgreSQL spec (deterministic regex fallback if the API is down).
  • A policy engine classifies each request low / medium / high risk and a cost band from environment, tier, vCores, storage, HA, networking, and data class.
  • Approval routing: low-risk auto-approves; medium and high route to approvers with rationale, comments, and full ticket-level audit history.
  • Role-based views (requester, approver, admin): dashboard, approvals inbox, ticket timeline, and a resource handoff card.

how it fits together

StackGate · architecture

NL request → governed, reviewable provisioning

Plain-English database requests become risk-classified, policy-approved infrastructure as code with a full audit trail.

  1. Natural-language request
    "I need a small Postgres for a staging app…" → Claude parse (deterministic regex fallback).
  2. Structured spec + validation
    Environment, tier, vCores, storage, HA, networking, data classification.
  3. Policy engine · risk + cost
    Nine deterministic rules classify low / medium / high risk plus an estimated monthly cost band.
  4. Low risk → auto-approve
    Straight to the provisioning queue.
    Med / high → approvers
    Transactional, status-guarded, self-approval blocked.
  5. Provisioning adapter
    Simulation or guarded Azure (az CLI). Live calls gated to a low-risk eligibility envelope, else auto-fallback to simulation.
Terraform plan
reviewable IaC
Key Vault ref
no plaintext secret
Resource handoff
+ audit events
Decommission
destroy-on-date
Next.js 15 · TypeScript · Prisma · SQLite · Claude · Terraform · Azure PostgreSQL · Azure CLI · Key Vault

product screens

Dashboard: the internal platform control plane, request stats, approval attention with risk + cost bands, and a workflow snapshot.
A provisioned ticket: the auto-approval rationale, the ready PostgreSQL resource with its Key Vault secret reference (no plaintext password), and the full audit timeline.
Approvals inbox: medium and high-risk requests routed for review with risk and cost context.

key engineering decisions

Real access control, not a mock user

A server-owned, HMAC-signed session; every route derives the actor server-side, blocking spoofing and self-approval, and approvals commit in one transaction so two approvers can't double-provision.

Guarded live cloud provisioning

A strict eligibility envelope of 9 hard limits gates real Azure calls; anything outside it falls back to simulation to cap blast radius and cost.

results & outcomes

  • Plain-English requests become traceable workflows with consistent approvals and a full audit trail (13 event types).
  • Spoofing, self-approval, and double-provisioning eliminated (server-owned sessions plus transactional approvals, 409 on conflict), covered by an end-to-end smoke test across the three risk paths.
  • A guarded Azure path that's safe by construction, falling back to simulation outside a 9-limit low-risk envelope.
deep dive
Letting AI open the door, but never skip the lock

How StackGate turns plain-English infra requests into governed workflows: a deterministic risk and cost policy engine, an LLM that only proposes, and Terraform that references secrets instead of embedding them.

back to all work