Skip to content

Case study

Leading an identity migration, plan-first

De-risking a sprawling change by freezing the plan before touching code.

All case studies
PlanningLeadershipData modeling

migration doc

Artifact

cross-service

Scope

ordered

Execution

01

Situation

A significant migration of identity functionality and table design was needed across services — one of the largest efforts I've driven.

02

Task

De-risk a large change with many moving parts.

03

Action

I first drove out a written migration plan and design document — prerequisites, sequencing, and table design — got it right, then implemented against it, deliberately keeping the plan file frozen during implementation so it stayed the source of truth.

planfreezeimplementverifythe plan is the contract; the code conforms to it
Plan → freeze → implement against the plan → verify. The plan is the contract; the code conforms to it.
rbac.model — grant pathUserprincipalGroupmembershipAuthGrouprole bundlePermissionaction + scopeResourceobjectSharescoped grantbelongs toassumes rolegrants actionrecord-level
What was being migrated: the User → Group / AuthGroup → Permission → Resource / Share authorization model, re-shaped across services.

Throughout, I used git diff to define the exact blast radius and targeted tests to precisely what changed, leaning on the compiler and the test suite as the safety net for wide changes.

04

Result

  • Turned a sprawling migration into an ordered, reviewable execution.
  • Established plan-first as my default for large or risky work.
  • Kept the change auditable — every step traceable back to the frozen plan.