FIELD AWAKE / 01 · THE PLATFORM. A first-person application of the Edge Method to a project I lived through, run backwards.
This is not a case study either, though for the opposite reason from Awake / 001. There I had no access, but here I had all of it: I designed the platform, I ran the team, the audit was on our work, and the report that proved the architecture was the group’s, not ours. What I did not have in 2023 was the method. This is the method run backwards over a decision I took before I had words for it, with the documents open on the desk.
The employer is not named, and neither is the audit firm. Both did their jobs. The numbers are theirs; the argument is mine.
The opening question is the same one:
If this platform did not exist, would we build this platform?
01 · The trigger
The platform worked by 2023, and that was the problem. A research prototype that had been pushed into production in 2020 because a business unit wanted it, and then another, and then another, was now the thing several countries’ call centres used to tell a customer whether a claim was covered and up to what amount. That was two million claims a year, three and a half thousand agents, and millions of API calls a month. The team that had invented it was still the team running it, fifteen people, and we had never had a quiet quarter to become an operation rather than a lab.
The signs were the usual ones. Releases went out once a quarter because every release needed a customer’s approval, so nobody released. Those releases took ten to thirty minutes, or three hours when there was a database migration. There was one test environment, shared by functional testing and release testing, so the developers were blocked when a release was being tested. Monitoring consisted of several tools, none of which owned the job; the audit would later write, accurately, that “today we find out when things are already broken”. Load grew in the spring, resources were multiplied by five to keep up, and the bill followed. Nobody had been counting. Cost accounting, in the auditors’ phrase, was “almost nonexistent”.
Then one component failed in May, and the product was unusable until it was fixed, because one thing failing took everything down, and it took three hours to reach the right people at the platform team that owned the firewall in front of us.
A new manager arrived and did the right thing: she asked someone from outside to look. There were two audits: the first, in February, on the code and the delivery process, and the second, in September, on infrastructure and reliability.
Assets are not capability. The platform had a cluster, a gateway, a pipeline, monitoring tools, a DevOps team and a business that loved it. None of that was the capability the business actually consumed, which was a correct coverage answer in under a second, every time, for a price that did not surprise anyone.
02 · Forget the platform
Remove the platform from the room for thirty minutes: no cluster, no microservices, no gateway fork, no pipeline, no organisation chart, no audit.
There is one mandate: an agent is on the phone with a customer and needs to know whether the claim is covered, with the limit, the excess and the exclusions, in the time it takes to ask the questions. There are several countries, and several insurance products per country, each with many versions, because a contract signed in 2021 is still the contract in 2024 even if the product has changed twice since. There are millions of these a month.
What would we build?
03 · What the clean-sheet company would build
An immutable product
The single most important property of the thing being computed is that it must not change under the customer’s feet. A published version of an insurance product is a legal object. Once it is in production it is frozen; a change is a new version; the old one stays exactly as it was for as long as any contract refers to it. The clean-sheet company makes immutability the default and rollback a property of storage, not a procedure.
A computation that is stateless and cheap to be wrong about
The coverage check is a question-and-answer computation over a logical representation of the contract: given what we know, is the situation inside the contract, and if not, what is missing? Nothing about it needs a server that stays up. It needs to exist, be invoked, answer, and disappear. The clean-sheet company packages the interpreter and the compiled product together, as one unit that can be invoked from nothing.
A cost that follows usage to zero
If the computation is invoked only when an agent asks, then the cost should be zero when nobody asks. An idle cluster is a cost the customer pays for a property the customer does not consume. The clean-sheet company pays per call and is happy to explain the bill.
Versioning owned by the customer, not the vendor
Every production incident that had ever hurt us came from the same shape: we updated something central, and a customer’s product, which relied on a behaviour we considered a bug, broke. The clean-sheet company puts the version in the customer’s hands: they publish, they test, they roll back, and two versions of the interpreter can live in production at the same time without anyone asking us.
None of this is exotic. It is the design that falls out when you stop starting from the cluster. That design already existed on our whiteboard in 2023, and part of it in code. What it lacked was permission.
04 · The audit, verbatim
The September report was thorough and, on most of its pages, right. It said there was modern tooling, GitOps, infrastructure as code, a skilled team, managed databases, and autoscaling in place. Then came the list: no observability strategy; too many tools; no business metrics; one test environment; no service level objectives; secrets encrypted in the repository with the keys beside them; a forked gateway that only one person understood; a platform team that answered tickets rather than collaborating; post-mortems done by email; cost accounting that had started only after the spring. Every one of those was true, and we fixed every one of them over the following year. I would sign that list today.
Then came the architecture. Two sentences carried the verdict.
“The platform is currently not resilient, but this should be fixed with new architecture. This has to be confirmed once the future architecture is in production.”
“Nothing concretely proving that the new architecture is going to work properly in production.”
Read those again, because they are reasonable, and that is what makes them dangerous. The auditors did not say the design was wrong. They said it was unproven and asked for proof before production, which is what an auditor is paid to ask for. The trouble is that the only proof of an architecture is the architecture running. Load tests on a laptop, which we had, were correctly judged “not enough”. They had not seen the modelled cost, which we also had, and would not have believed it: the spoken version of the objection, which I remember better than the written one, was that serverless projects always go over budget, that they always fail, and that it would never be that cheap.
So the situation was this: a design that could only be proven by running, and a governance instinct that wanted the proof first. Every transformation I have seen since has had this shape.
05 · Three rights, applied to my own edge
The method gives an edge three rights, granted before it is built. Nobody had granted them in 2023; we took them, in the order the situation allowed.
Architecture rights
We owned the design. This was the one right we had by accident, because the platform had been born as research and nobody in the core had a competing architecture to impose. The audit could ask for proof; it could not redesign the thing. That mattered more than I understood at the time.
Production rights
We took real work, not a proof of concept: the read side of a real product, in a real country, with real agents on the phone, moved to the functions while the microservices kept serving everything else. Then another product followed. The functions were doing the business’s work from the first week, or they were doing nothing.
Inheritance rights
This is the one nobody grants you, and the one we did not have. There was no agreed rule that said: if the functions beat the cluster on the numbers, the work moves. What we had instead was the group’s monthly availability report, a document produced whether we liked its contents or not, on a platform classified High criticality, external, 24/7. We made that report the referee. Twelve consecutive months of it would be the inheritance clause we had not been given.
06 · The map
An Awake produces a map. Here is the one I would have drawn in 2023, of the one workflow that mattered: the coverage check, from the agent’s question to the answer, with each component placed by how evolved it is, and the antibodies drawn on the nodes where they sat.
Three things on this map are worth more than the rest.
First, look at the top left. The product and the interpreter sit at custom and genesis, and they stay there. They are the judgment: the people who know the contract, and the logic that represents it. Nothing at the edge touched them. The edge rebuilt how the answer was served, not what the answer was. An edge that reaches into the judgment is not an edge; it is a second core.
Second, look at the arrow on the functions. The component moves right, hard, from something we built and ran to something we invoke and pay for. That is the whole economic argument in one arrow: a coverage check became a utility, priced per call, and the bill went from a line someone had to defend to a line nobody noticed.
Third, look where the antibodies cluster. They sit not on the product, not on the interpreter, but on the cluster, the test environment, the cost line, and on the functions themselves, at the exact point where the component was trying to move from built to bought. That is where antibodies always concentrate: where a thing that used to need people stops needing them.
07 · The antibodies, by name
None of these were people. I want to be exact about that, because the people in this story were competent and acting in good faith, the auditors included. The antibodies were a ticket queue, a release calendar, a shared environment and a sentence.
“Prove it before it runs.” It was the audit’s ask, and it is the strongest antibody on the map, because it is indistinguishable from prudence. It sits on the one component that can only be proven by running. Every organisation has a version of this sentence; it is what governance sounds like when it has no way to run an experiment.
The ticket queue. The cluster was managed by a platform team we reached by ticket. The audit called it “less of a collaboration and more of a task delegation”. Three hours to reach the right people during an incident is not a people problem; it is what a request-and-response model does under load. The edge’s answer was not a better ticket. It was to need fewer tickets: a function has no cluster to ask permission from.
“UAT is blocked.” One environment had two jobs. Whoever was testing a release blocked whoever was building. The audit recommended a second environment, and it was right; but notice what the functions did to the problem. A product version is its own deployable unit, so a customer tests their version without touching anyone else’s. The bottleneck did not get a second lane. It stopped being a bottleneck.
Nobody owns the bill. Cost accounting appeared in the spring because the bill did. With a cluster, cost is a capacity decision someone makes once a year and defends when it goes wrong. With a function, cost is a number on every invocation. It is very hard not to own a bill that arrives per call.
08 · What we baselined, and what we measured
A real Awake fixes the benchmarks before the run. We fixed ours, without the vocabulary, in the summer of 2023.
Before, on the cluster. Infrastructure cost about ten thousand dollars a month. A single failing component could take availability to zero, and had, in May. Releases were quarterly: ten to thirty minutes without a migration, up to three hours with one, out of hours, with customer approval. There was one environment.
The prediction. We predicted fifteen dollars a month for the read side on functions, at the traffic of the time. That number was not a guess. We costed it on the cloud provider’s own pricing, invocation by invocation, including the parts people forget: the network, the compute time per call, the storage of fifty thousand deployed artefacts. I am still proud of that spreadsheet, and I still think the reason the number was not believed is that nobody expected it to have been done.
After. The first months on the functions cost eight dollars. The full year 2024 showed zero minutes of outage, twelve months out of twelve, on the group’s own availability report: both products, High criticality, 24/7. The round trip with computation was under fifty milliseconds at the eightieth percentile. The bill in 2026 is about forty dollars a month, with traffic and the number of functions roughly four times what they were in 2023, which is what linear means.
The microservices stayed where they made sense, on the editing side, where a product is authored and the full platform is a reasonable thing to want. The plan to move the compiler and the publisher to functions was written only after the read side had its year. Nothing was switched off before the number existed.
09 · The prediction, in the past tense
The signature of this series is a dated, falsifiable prediction. This episode has one; it was made in 2023 and it can be scored.
We said: fifteen dollars a month, and it will run. The auditors said, in writing, that nothing proved it would run, and, in the room, that it would never be that cheap and that these projects always fail.
Scored in 2024, it came to eight dollars and a year without an outage minute. Scored again in 2026, it came to forty dollars at four times the load. The prediction held on both counts, and the objection was wrong on both. I do not say that to score a point against the auditors, who were right about everything else on their list. I say it because the shape of the objection is the shape of every “prove it first” a CEO will hear this year about an AI workflow, and the only answer that has ever worked is the one we gave: a date, a metric, and a run beside the old way.
“Prove it before it runs” produces documents. “Run it beside, and measure” produces the number.
10 · The decision
The Awake decision, run backwards, is not hard to write, and I would write it the same way for a client tomorrow.
EDGE. Rebuild the read side from zero, beside the cluster. Leave the product and the interpreter alone; they are the judgment. Fix the benchmarks before the run: cost per month, minutes of outage, round trip. Make the referee a document nobody on the team controls. Give it twelve months. If the edge wins, the work moves, product by product, and the compiler and publisher follow. If it loses, the cluster is still there and nothing has been lost but the experiment.
The number to watch: minutes of outage per month on the group’s report, and dollars per month on the provider’s bill.
Scored: 2024 and 2026, above.
What is documented, and what is remembered
Documented: the two audit reports and their findings, quoted above; the group’s monthly availability report for 2024; the developer-summit talk my tech lead and I gave in 2024, which recorded the cost figures and the design; the application overview written in late 2023; the architecture-board material from 2020. Remembered: the spoken form of the cost objection; the exact wording of the ticket-queue frustration during the May incident; my own state of mind.
This episode cannot show the inside of the audit firm’s reasoning, which I have not asked for and which is theirs, or whether the same design would have been approved faster in a company with an experiment-running culture. I suspect so, and that suspicion is the consultancy.
What an actual Awake would need
Inside a company facing its own version of this, I would want one workflow, its economics, its cycle time, its decision rights, its active antibodies, and the name of the document that will be the referee. Then we would design the workflow again as if the company were created today, run the two versions side by side, and let the report decide.
Don’t transform your company. Build the one that replaces it.
A note on the method: writing this episode changed it too. The referee rule, that the benchmark must be a document the edge does not control, comes from here. So does the distinction between an edge that rebuilds how the answer is served and one that reaches into the judgment. Both are now in the Edge Method.
Frequently asked questions
How do you prove a new architecture before switching the old one off?
You do not. You run the new one beside the old one on real work, with benchmarks fixed in advance and a referee document the team does not control, for long enough that the number is not luck. Twelve months of a monthly availability report is a good length. Load tests and cost models are inputs to the decision to run; they are not proof.
What is a Field Awake?
It is a first-person application of the Edge Method to a project the author lived through, run backwards: what the map would have shown, what the three rights would have been, what the antibodies were, and what actually happened. Outside-in Awakes (the 001 series) use only public evidence about other companies. Field Awakes use the author’s own documents, with the employer unnamed.
Was the audit wrong?
On the process, no; every finding was correct and was acted on. On the architecture, it asked for proof before production, which is a reasonable ask that cannot be met for an architecture, only for a running system. The report itself said the verdict “has to be confirmed once the future architecture is in production”. It was.
Does serverless always go over budget?
It does not if the cost is modelled per invocation before the design is chosen, including network and compute time, and if cost follows usage by construction. Our prediction was fifteen dollars a month; the first months were eight; three years later, at four times the load, it is about forty. What goes over budget is capacity that is bought in advance and defended afterwards.
Sources
- The external audits of February and September 2023 (code and delivery; infrastructure and reliability), commissioned by the group’s operations division. Internal; quoted verbatim where marked, unattributed.
- The group’s monthly infrastructure and application availability report, 2024. Internal.
- “From microservices to serverless: availability and cost reduction by (at least) two orders of magnitude”, developer summit talk, 2024, with the platform’s tech lead. Internal.
- Developing a Legal Specification Protocol: Technological Considerations and Requirements, Stanford CodeX white paper, 2019, for what a computed contract is.
- AWS Lambda pricing, for the model behind the fifteen-dollar prediction.
- The corporate immune system and Wardley maps for AI transformation, on this site, for the map and the antibodies.