Operational Patterns

Patterns and recommendations for security, observability, CI/CD, database migrations, and environment management. Use when generating the Security Architecture, Observability, and DevOps Blueprint deliverables.

Security Architecture

Auth Strategy Selection

API Security Checklist

Every REST API service should implement these protections:

Data Protection

OWASP Top 10 Quick Reference

When assessing security, check against these common threats:

1. •Broken Access Control — Ensure authorization checks on every endpoint, not just authentication
2. •Cryptographic Failures — Don't store passwords in plaintext (use bcrypt/argon2 via auth provider), don't log tokens
3. •Injection — Parameterized queries, input validation, no eval/exec of user input
4. •Insecure Design — Rate limit auth endpoints, implement account lockout, use CAPTCHA on public forms
5. •Security Misconfiguration — Remove default credentials, disable debug mode in production, review CORS
6. •Vulnerable Components — Keep dependencies updated, run npm audit / pip audit in CI
7. •Authentication Failures — Use a managed auth provider, implement MFA for admin roles
8. •Data Integrity Failures — Verify webhook signatures, validate JWT signatures, use CSP headers
9. •Logging Failures — Log auth events, access denials, and input validation failures
10. •SSRF — Validate and whitelist URLs before making server-side requests

Observability

Observability Stack Recommendations

Structured Logging

All services should use structured JSON logging:

{
  "level": "info",
  "timestamp": "2026-02-07T10:30:00.000Z",
  "service": "api-server",
  "requestId": "req_abc123",
  "userId": "usr_xyz",
  "action": "create_order",
  "duration_ms": 145,
  "message": "Order created successfully"
}

Logging rules:

• •Use log levels consistently: error (broken), warn (degraded), info (business events), debug (dev only)
• •Include requestId for request correlation across services
• •Include userId for audit trail (mask in logs if compliance requires)
• •Never log: passwords, tokens, full credit card numbers, API keys
• •Always log: auth failures, permission denials, input validation errors, external API errors

Key Metrics to Track

Health Check Pattern

Every service exposes /health with tiered checks:

{
  "status": "healthy",
  "service": "api-server",
  "version": "1.2.3",
  "uptime_seconds": 86400,
  "checks": {
    "database": { "status": "healthy", "latency_ms": 5 },
    "redis": { "status": "healthy", "latency_ms": 2 },
    "external_api": { "status": "degraded", "latency_ms": 1500, "note": "slow but responding" }
  }
}

• •/health — quick liveness check (returns 200 if process is running)
• •/health/ready — readiness check (returns 200 only if all dependencies are reachable)
• •Used by load balancers, container orchestrators, and monitoring

CI/CD Pipeline

Pipeline Templates by Provider

GitHub Actions (recommended for most projects):

Stages: lint → test → build → deploy

Triggers:
  - Push to main → deploy to production
  - Push to develop → deploy to staging
  - Pull request → run lint + test only
  - Manual dispatch → deploy to any environment

Pipeline stages:

Branch Strategy Selection

Environment Promotion

Feature branch → PR review → merge to develop → auto-deploy to staging →
manual promote to production (merge develop → main) → auto-deploy to production

For simpler projects:

Feature branch → PR review → merge to main → auto-deploy to production

Database Migrations

Migration Tool Selection

Migration Strategy

Common Migration Patterns

Environment Strategy

Environment Definitions

Config Management

Environment variable categories:

Config validation:

• •Validate all environment variables on service startup using Zod, envalid, or pydantic-settings
• •Fail fast with clear error messages if required vars are missing
• •Log which environment the service is running in (but never log secret values)

Feature Flags

Choosing What to Include

Not every project needs all operational patterns. Use this guide:

When generating blueprints, match the depth to the project's stage and complexity. Don't overwhelm an MVP with enterprise patterns.