Hey there! Welcome to Platform Weekly. Your weekly haul of platform engineering bargains. Every week, we fill your basket with the best of what the community is building (and this time, we actually checked the price tags).
Plus…
The State of Platform Engineering Vol. 5 survey is open! Your answers shape the next State of Platform Engineering report, and with AI shaking up pretty much everything, this one matters more than ever. Tell us what’s really happening in your platform team. Take the survey here.
Cost is going to be your problem. Here’s what to do about it.
Cost ownership is increasingly moved into the loving embrace of the platform team. We launched our first-ever FinOps market guide this week, and hot damn, it feels good to share that what we’ve been talking about in PW for almost 2 years is becoming more and more true.
Responsibility for AI and agent economics is still far from decided across the board. It often lands with FinOps, platform engineering, a dedicated AI leadership function, or engineering management, and evidence from the field shows every permutation - but when we compare trends across all our research and the best teams. My gut tells me it’ll be us who owns it.
The only way to control spend in the AI era is to shift it into the platform. This won’t be our last market guide - and you know I’ll be watching this closely.
But the market guide is much more than that. Florian, Dilek, and I dug into what this new frontier means for platform teams. The big takeaways:
Shift down, not just left (shocker!). A cost estimate in the PR is nice, but it’s one more signal for an already overloaded dev. It’s no surprise that only 39% of respondents actually enjoy FinOps work. Encode the sensible default into the golden path so nobody has to decide, and you improve both your cost outcomes and the general happiness of everyone involved.
Your bill goes way beyond the cloud. Beyond public cloud (84%), 41% of respondents also manage AI tool spend and 38% manage SaaS. A financial layer that only sees cloud billing is blind to whole categories of what you answer for.
Fewer tokens doesn’t mean better. I might love caveman as much as the next guy, but use little token, but no use brain, maybe big problem. If you cut tokens by over-compressing context, limiting experimentation or blocking teams from delivering value, you’re losing dollars to save pennies.
Recommendations are cheap. Safe execution isn’t. 77% rank workload optimization and waste reduction in their top three priorities for the next 12 months. But a priority doesn’t cut a bill. What actually moves spend is action with rollback, SLO awareness, and graduated autonomy, not another endless list of recommendations that no one is going to read.
The important caveat in all of this. More spend does not automatically mean bad (Just as more spend in our Tokenmaxxing phase didn’t automatically mean good 6 months ago).
The CEO of Coder said on stage at our Platform Leaders Summit in Silicon Valley a few weeks ago that 1% of his engineers drive 40% of the company’s token cost, and 5% drive 80%. Are they wasting tokens? Maybe, maybe not. The point is that cost isn’t bad on its own. It’s a question of whether that cost is getting value.
A team spending four million to earn twelve million should invest more, not less. Unit economics is how you make that case to finance.
The full guide also maps the vendor landscape into five archetypes and lays out four moves for your platform team. Go grab it before your next costathon ;)
SHA pinning isn’t the security blanket you think it is
Whaaat? A second section in Platform Weekly? Let’s do this! I want to share something cool from my friends at Chainguard, who are running a community webinar on October 20th. There is more code than ever flowing through CI, and every run trusts third-party code someone else wrote. It’s the same problem in every conversation in every category, but security is where it’s most urgent to fix. More code means more runs trusting actions by version tag, and the go-to answer from a lot of platform teams right now is “pin everything to a SHA.” Voilà, problem solved. WRONG(ish).
A SHA is a tamper seal. It proves nobody opened the jar since you sealed it, but it tells you nothing about what’s inside. Seal a poisoned one (*cough* tj-actions/changed-files if you pinned mid-attack *cough*) and you’ll keep eating the poison over and over and over. And your sealed jar can still reach for other jars nobody ever checked ;)
The only way to solve the problem is by solving it before it’s a problem. Revolutionary! And the only way to do that is by building it directly into the platform. Take a look.
As always… stay crunchy 🥐
Quick bites
Highlight of the week
House of Kube is back in Salt Lake City during KubeCon! Free entry, no KubeCon ticket needed. Craft cocktails, house and techno, and the best platform engineering conversations that never make it onto a stage. Grab your spot here. See you on the dance floor?
Upcoming webinars
October 29, 19:00 CEST - Join Sonny Shi from Stacklet to learn about making coding agents policy-aware for Terraform and Kubernetes, plus runtime enforcement for what slips through. Save your spot here.
From the community
Every PlatformCon talk, past and present, is on the Platform Engineering YouTube channel.