Specify · Build · Prove · Approve · Publish

Network services,
from specification to production.

[Name] is the platform for building and running network services. Describe a service of your domain in plain English: its parameters, the steps of each operation, what must be true afterwards. The platform takes the specification in, builds the service from it, proves it in the lab, and publishes it to the catalog with your name on it.

[24]
products in the catalog
[1,180]
service instances managed
100%
of changes verified before approval

F017 — Domain specifications

draft · decision 0011

The specification of the platform: one requirement per statement, each with how a solution proves it.

F017.R1 A service a domain offers MUST be contributed as a domain specification: a text file in Git, written in plain English first.

F017.R3 Every parameter MUST state where its value comes from: the orderer, the inventory, an allocation, or derived from other parameters.

F017.R7 When a domain specification is bound, the platform MUST generate from it the product folder, the resource type and the order form.

Proved by — Conformance: the l2vpn specification parses; its parameters are listed with each one's source.
# L2VPN cloud attachment
Point-to-point L2VPN across the WAN,
handed off to a cloud at a colo edge.

## Parameters
- tenant: typed by the orderer
- site A device: from the inventory, a PE
- site A VLAN: allocated per device
- route target: derived, asn:evi

## Operations
### Create
1. Allocate a VLAN on each PE
   Who: the WAN domain · System: IPAM
Level
described→bound→executable
gate passes
To bind it
  • cisco-iosxr: 1 of 2 examples with expected configuration
  • nokia-srlinux: 0 of 2 examples
  • example muc-azure not complete

Written by the WAN domain; reviewed in a merge request to the domain.

Hosting zone

one order, five domains, undone in reverse on failure
  1. 1Allocate an address rangeipam
  2. 2Allocate a VLANipam
  3. 3Derive the gatewaycode step
  4. 4Approve the zonehosting team · change record
  5. 5Create the virtual firewallfirewalls
  6. 6Wait until it is Readyprocess orchestrator
  7. 7Apply the base policyfirewalls
  8. 8Onboard the head-endonboarding
  9. 9Record the zone in the CMDBcmdb

Each step written in English first, then bound to a domain's resource type. Gateways, repetitions and events are steps too.

English
Configure the xconnect on both PEs
Who: the executor · System: NSO
Binding
Executor: generated service
Devices: wan for each siteA, siteB
Example fra-aws
fra-pe01 · VLAN 2417 · EVI 30217
# generated · do not edit
interface Gi0/0/0/3.2417 l2transport
 encapsulation dot1q 2417
 service-policy input POLICE-1G
l2vpn
 xconnect group acme
  p2p acme-fra-aws
   neighbor evpn evi 30217
evpn
 evi 30217
  bgp
   route-target 64512:30217

The product folder, the resource type, the order form and the executor's service are generated from the specification; a hand edit fails the gate.

Nothing ships unverified

deterministic gates decide
  • Specification complete, terms from the glossarypassed
  • Examples render to their expected configurationpassed
  • Scenarios in the lab · [6/6]passed
  • Predicted state: reachability delivered, no path to other VRFspassed
  • Review by the WAN domain · risk class Bwaiting

The reviewer decides on evidence; the platform never merges.

ServiceDomainOwnerClass
Hosting zonehostinghosting teamB
L2VPN cloud attachmentwanmweberB
Business internet accesswanwan teamB
Virtual firewallfirewallsfirewall teamB
Access rulefirewallsfirewall teamA–B

Every service names its domain and owner. One API behind the order form, the command line and ServiceNow.

  • acme-fra-awsL2VPN cloud attachment 1.1.0 · verified [2 min] agoReady
  • webHosting zone 1.2.0 · 9 of 9 stepsReady
  • acme-muc-azureL2VPN cloud attachment · drift reported on muc-pe02Drift
  • acme-web-httpsAccess rule · change record [CHG0041236]Waiting

Each instance is one trace from order to device: who ordered, who approved, what changed, what was verified.

Capabilities

What the platform does

Everything between a specification and a running service, so you can concentrate on the network.

Specification in your format

A service is a domain specification in plain English: parameters and where each comes from, the steps of create, modify and delete, scenarios, examples. Bound to a template or an existing executor, it generates the product folder. No new language to learn.

Generated, not hand-built

Order form, inventory mapping, NSO package and test suite are generated from the specification. Change the specification, and everything follows.

Proof before approval

Scenarios run in the lab. Predicted network state is verified. Conflicts with existing products are detected. Each domain controller's scenarios are written from outside the controller, so every solution runs the same ones. Approvers see evidence, not descriptions.

A catalog with owners

Every product carries its owner, on-call, version and risk class. Every instance shows its status, its history and its drift. Ownership lives next to the product, in the repository.

Approvals in Git

A change is a pull request with its checks attached. Review, approve, merge — the audit trail is complete without anyone writing it.

Executors apply the change

Services are applied by executors — NSO, the Check Point management API and other managers. Only executors touch devices. Post-change verification confirms the network is in the predicted state.

How it works

Five steps. You own the first and the last.

From a specification to a service in the catalog.

  1. 01You

    Specify

    Describe the service at the front door: answer questions or submit the file. The gate says its level and what binds it; a merge request goes to your domain.

  2. 02Platform

    Build

    The platform generates the form, inventory mapping, NSO package and tests.

  3. 03Platform

    Prove

    Scenarios run in the lab, predicted state is verified, conflicts are checked. Results are attached to the change.

  4. 04Approver

    Approve

    Reviewers see the evidence and the risk class, and approve in the pull request.

  5. 05You, as owner

    Publish

    The product is orderable. You see every instance, every change, every drift — and you are the one on the product page.

Ordering a service

Instances go the same way: fill in the generated form (or write the record directly), checks run, approval, applied. Same evidence, same trail.

Changing a product

Edit the specification, open a pull request. The platform rebuilds and re-proves everything; existing instances are re-verified against the new version.

Existing services

Config already in the network is imported into products through an adoption step you confirm. The platform reports what it finds; it never changes it unasked.

Click demos

See it in use

Click through how people use the platform, one activity at a time. Each demo shows the stories and features it covers, and whether it is imagined, specified or proven.

specified

A1 · Contribute a product

Contribute a domain service

  • A1.18 A domain specialist takes a service of their domain to the platform — through the interview or as a written domain specification — sees the gate's result and the level reached, and gets the merge request; the product folder is generated once it is bound
  • A1.1 A network engineer describes the service in plain language, or points at an existing configuration or script, and gets a domain specification to correct
  • A1.2 A network engineer declares in the domain specification each parameter and where it comes from: typed by the orderer, looked up in the inventory, allocated, or derived
  • A1.5 A network engineer writes what must be true after create, modify and delete, in plain sentences
  • A1.11 A domain specialist writes how their domain fulfils one operation, e.g. applying the base policy to a virtual firewall, as that operation's steps in the service's domain specification, behind the resource type that processes use

features F017 F016 F015 F032

Walk through it →

specified

A1 · Contribute a product

Describe a process

  • A1.10 A domain specialist or network engineer writes a cross-domain process step by step in plain English and has it reviewed, before any step is automated
  • A1.12 A contributor answers one question at a time and ends with a process or a domain specification in a merge request; what they cannot answer is marked not decided. From R3 an agent may conduct it
  • A1.13 A contributor binds each described step to a registered resource type or marks it a human task, and sees which steps are left
  • A1.15 A contributor takes a described process or domain flow back into the interview and answers only what is still open, until it can be bound

features F015 F016 F026 F027 F032

Walk through it →

specified

A1 · Contribute a product

Design a process

  • A1.9 A domain specialist designs a cross-domain process in a visual editor; what is saved is a text file in Git, reviewed like a product

features F026 F015 F027 F012 F032 F072

Walk through it →

specified

A4 · Order a service

Find a product, follow an order

  • A4.1 An orderer sees the products their tenant may order, with what each needs
  • A4.6 An orderer sees status per step until the service is ready, or the reason it is not

features F014 F101 F110 F111 F040 F042 F031 F024

Walk through it →

imagined

A4 · Order a service

Order a firewall rule

  • A4.2 An orderer orders from Git, the command line, a generated form or ServiceNow, and every channel behaves the same
  • A4.3 An invalid order is refused with the reason before anything is stored
  • A4.5 An orderer opens an access rule on a tenant's virtual firewall, and removes it again when it is no longer needed

features F111 F025 F041 F030 F104 F033 F062 F031

Walk through it →

specified

A4 · Order a service

Order a hosting zone

  • A4.4 An orderer stands up or updates a hosting or security zone in one flow, which raises the child orders to each domain

features F012 F111 F052 F031 F026 F072 F063

Walk through it →

specified

A7 · Operate a service

Ask the platform

  • A7.8 Anyone asks the assistant what is in the catalog, what an order is waiting for, which processes use a resource type, or what the specification says, and gets an answer with its sources

features F083 F081 F082 F040 F072 F101 F111

Walk through it →

specified

A10 · Run the platform

Configure models

  • A10.8 The platform team runs a local model by default and adds a model the customer already uses where their data protection covers it, for named purposes and data classes

features F082 F016

Walk through it →

specified

A10 · Run the platform

Register a domain

  • A10.7 A domain registers its resource types through a native controller, or through an adapter generated from the description of its existing API

features F027 F014 F032

Walk through it →

provenRuns against the lab; the test named below proves it. specifiedEvery feature shown has requirements. Nothing is built yet. imaginedShows stories whose features are not yet specified. Not built.

The catalog

Every service, with its owner

Every service the network offers, with its owner, version and status. Order from here; contribute from here.

ProductOwnerVersionRisk classInstancesStatus
l2vpn-cloud-attachmentM. Weber1.0B38Published
l3vpn-siteA. Novak2.3B412Published
internet-access-businessA. Novak1.4A690Published
dc-tenant-fabricS. Ito1.1C27Published
acl-edge-policyM. Weber0.9A13In review
sdwan-branch-overlayL. Braun0.3B—In sandbox

Sample entries. Live data on the catalog page.

The sandbox

A lab you can use without asking

Try a template against virtual devices, run your scenarios, see the rendered config — before anything becomes a product.

  • Virtual devices for every platform in the network, spun up per session.
  • Run scripts and notebooks against it if you like; keep what works.
  • Promote an experiment to a product with one command — the same checks run, and the domain specification becomes a pull request.
Open the sandbox
sandbox
$ [name] sandbox up --product l2vpn-cloud-attachment
lab ready · fra-pe01, muc-pe02, cloud-edge01 (virtual)
$ [name] scenarios run
✓ point-to-point between two sites
✓ attach AWS via colo edge, eu-central-1
✓ bandwidth change keeps existing paths
✓ delete releases VLAN and route targets
✓ second cloud on same tenant
✓ reject overlapping port allocation
6 passed · 0 failed · 41 s
$ [name] promote
pull request #418 opened · owner mweber · risk class B

For platform engineers

Products are data. The machinery is where you build.

The platform is built to be extended.

Generators

Turn a bound domain specification into the product folder, schema, form, NSO package and tests. Add a generator, and every product gains the capability.

Checks

Policies, conflict rules, verification queries. Written once, applied to every change, in CI and at admission.

Controllers

A domain offers its resource types through a native controller or an adapter in front of the API it already has. What each operation does in the domain's system is specified once, for every solution; how it runs is the solution's. Domain controllers

Skills

Encode how products are built here so the assistant drafts them the way your team would. Versioned with the platform.

Models

Local by default

The platform and its agents use language models only through model endpoints registered in the platform. The default endpoint runs locally. A model the customer already uses can be added where their data protection covers it.

Click demo: configure models →

feature F082

  • Every model use goes through a registered model endpoint. No component calls a model provider directly.
  • An endpoint declares its API, address, model, a reference to its credentials in the vault, where it runs, the data classes it may receive and the purposes it may serve.
  • An external endpoint names the data-processing agreement that covers it.
  • A request names its purpose and its data classes. It goes to an endpoint allowed for both, or it is refused with the reason. There is no fallback to an endpoint that is not allowed.
  • Endpoints change only through a merge request.
  • Every model call is recorded with endpoint, model, purpose and data classes, in the trace and audit of the work it served.

Architecture, API reference and contribution guide: [docs URL]

Getting started

Three steps to your first product

Most people finish the first two in an afternoon.

Step 1

Open the sandbox

Sign in with your network account. Pick a template you already have, or start from a catalog product as an example.

[sandbox URL] →
Step 2

Write the specification

Add two or three worked examples and the scenarios you care about. Let the assistant draft the schema, then correct it.

[guide: your first product] →
Step 3

Promote and publish

Submit the domain specification; checks run; a reviewer of your domain approves. Your product is in the catalog with your name on it.

[platform team channel] →

FAQ

Frequently asked

Do I need to write code?

No. Templates, scenarios and worked examples are the contribution. If you enjoy scripting, scripts are welcome as product components and run through the same checks.

Which system applies the changes?

The executors you already run — NSO, the Check Point management API and other managers. The platform renders products into executor calls; only executors talk to devices.

What does the assistant do?

Two things. Agents that draft — schemas from templates, scenarios from examples, explanations of failed checks — for a person to put into a pull request; the checks and the reviewers decide. The platform assistant, a side panel on every page, answers questions from what the person may read and names its sources, and proposes steps in the designer and the interview for the person to confirm. It never orders, changes, approves, merges or opens a pull request (F083). Neither applies anything. Demo: ask the platform

Does our data leave the building when an assistant helps?

Not by default: the default model endpoint is local. An external model is used only if the platform team registers an endpoint for it, through a merge request, naming the data-processing agreement that covers it. Each request names its purpose and data classes and goes only to an endpoint allowed for both; otherwise it is refused. Every call is recorded in the trace and audit. Models

What is a risk class?

A label on each product that sets how much proof is needed before it ships: Class A ships on green checks; Class B adds a second reviewer and a lab run against the current network; Class C adds staged rollout and a change window.

What happens when a check fails?

The change stops and the report names the scenario or verification that failed and what it observed. Fix the specification, push, and the checks run again.

What does a domain controller do when a domain's system says no?

Every domain follows the same rules (F027.R16–R24). A refusal fails the resource with the system's message; it is applied again only when the request changes or a person retries it. An outage is retried. Only fields declared to change in place change; any other change is refused, and the resource is deleted and created again. A controller changes only objects it created. A difference made in the domain's system is reported as Drifted and not corrected; a person applies the resource again or changes it. A resource others depend on is removed last. A removal that fails shows Deleting; an operator retries it or releases the resource. F027.R16–R24 · Domain controllers

Can I bring services that already exist?

Yes. The adoption step imports existing config into product instances and shows you the diff. Zero diff means adopted; you confirm before the platform manages it.

Who do I contact?

The platform team at [platform team channel]. Each product page also lists its owner and on-call.

Open the sandbox.

Try a template against virtual devices, run your scenarios, submit the specification. The same checks run as for every product.