The Platform Engineering
Buyer's Checklist

Many vendors manage tools. Few build the underlying system. The IDP is the product, experience building it from scratch shows deliberate design thinking, not just operational familiarity.

Golden paths are the core delivery mechanism of a well-designed IDP. If they can't show you one in production, they haven't built the thing they're selling you.

Vendor lock-in is the primary long-term risk in platform engineering. A cloud-agnostic stance protects your architecture and your negotiating position for years to come.

Regulated industries have specific constraints that aren't obvious until you hit them. A partner who hasn't navigated them before will learn the hard lessons on your timeline.

Proprietary tooling means switching costs that compound over time. Open standards keep your options open and your team's skills transferable.

A full CI/CD replacement adds months of risk and disruption. Integration capability, not just greenfield capability, is the real indicator of platform maturity.

Self-service environments are the primary developer experience win. Poor UX here, slow, complex, unreliable, negates all other platform benefits.

You can't improve what you can't measure. Platform SLOs are how you demonstrate ongoing value to the business and catch degradation before it becomes an incident.

Security checks outside the developer workflow get bypassed under pressure. Policy-as-code embedded in the pipeline means compliance is automatic, not a gate you negotiate around.

Each framework has specific technical requirements. A partner who has navigated them before moves faster and makes fewer expensive assumptions than one doing it for the first time.

Secrets sprawl is the most common post-deployment security failure mode. A clear, opinionated approach to secrets management is a marker of operational maturity.

Data residency determines your GDPR exposure and your sovereignty posture. If your partner can't answer this precisely and quickly, that's a red flag.

Best-effort SLAs are not SLAs. Financial penalties align incentives, they're not punitive, they're the mechanism that makes the commitment mean something.

Platforms don't observe business hours. 24/7 coverage or a documented, tested escalation path is a minimum production requirement, not a premium feature.

You should own all code, configurations and documentation from day one. Clean offboarding terms are a sign of professional delivery, not a favour.

Unpredictable pricing destroys FinOps discipline and creates adversarial dynamics. Transparent, predictable pricing is a sign of a mature commercial relationship.

The engineer is the product. Account-manager-only relationships create information asymmetry that slows every decision and hides every problem until it's too late.

A structured onboarding and clear delivery milestones are how you avoid the "lots of activity, no visible progress" trap that characterises too many platform engagements.

Teams at different maturity stages need different approaches. A partner who only works with greenfield or only with mature platforms may be a poor fit for where you actually are.

References from regulated industries validate real delivery capability under compliance constraints, not just technical capability in unconstrained environments.