landing-zone-ownership

Type: decision

Decision

What the landing zone template declares, the platform owns and maintains; everything else in the subscription belongs to the application team.

Why

Without a declared boundary, application teams cannot act in their own subscription without checking with the platform first.

Violations

• Management lock applied to a platform-owned resource preventing Deployment Stack teardown.

Links

• deployment-declarative-lifecycle — Resources removed from Bicep are removed from Azure.
• job-function-scoped-roles — Platform engineers are exempted from Deployment Stack deny assignments — they can modify platform-declared resources directly.

← Back to knowledge graph