Caressa Arias
Say hello →

Multi-tenant compliance governance platform

Contract Software Engineer · Macnew Consulting · 2026

Problem

The client needed a multi-tenant governance platform for a critical-infrastructure compliance domain (NIST RMF, NIST SP 800-53 Rev. 5, NIST SP 800-171, and CMMC). Nothing existed yet: the starting point was a product requirements document describing a domain full of ambiguity — control inheritance, Organizational Defined Parameters, Common Control Providers, and two separate governance approval chains that do not share reviewer sequences. The PRD also contradicted itself in places, so part of the work was resolving which reading was authoritative before any of it could be modeled. There was one engineer available: me.

My role

I was the sole engineer on the platform, working PRD-to-production. That meant requirements gathering and technical research, architecture planning, data modeling, implementation, estimation, deployment, and MVP execution — in a highly ambiguous, startup-style engagement. No other engineer committed to the repository during the contract.

What I owned

The whole stack. A normalized PostgreSQL/Prisma domain model of 25 models and 29 enums, evolved through 39 committed migrations, covering control inheritance, approval history, evidence versioning, and multi-tenant governance state. A centralized declarative RBAC architecture spanning 10 roles, 9 application domains, and 6 permission actions, with independently authored anti-regression tests that assert both the allowed and the denied behavior of every cell so the matrix cannot silently drift away from its test. Table-driven approval state machines for the two distinct governance chains, with progression, rollback, and cross-entity gating. Microsoft Entra ID authentication with hand-rolled JWKS validation and a Redis-backed token revocation service. Audit logging across the mutation paths in eight backend services, capturing actor, timestamp, entity, action, and before/after state. And the delivery path: GitHub Actions CI running integration tests against real PostgreSQL and Redis service containers, plus parallel Docker builds published to Azure.

Key decision

I started Common Control Providers as the simplest thing that could work — a single boolean flag on the asset record. Within two weeks it was clearly wrong: the domain needed nomination, multi-stage review, rejection, and revocation, none of which a boolean can express. I deleted the flag and rearchitected it as a stateful governance entity with its own status progression and immutable approver-history fields, deliberately stored as plain values rather than foreign keys so the historical record survives a user being removed. The tradeoff is real — those fields can’t be joined for enrichment, and the model costs more to maintain — but a compliance audit trail that disappears when someone leaves the organization isn’t an audit trail.

Result

I delivered the MVP solo, contributing more than 300 commits over the contract while the architecture, security model, and governance workflows kept evolving. I ran a self-directed internal application security audit against the deployed system and closed roughly 20 findings across severities in a single pass — authorization gaps, tenant isolation, redirect handling, secrets management, token revocation, and environment hardening — followed by reworking the Content Security Policy to eliminate unsafe-inline in favor of per-request cryptographic nonces generated in Edge middleware. Two modules were deliberately cut from MVP scope with the reasoning written down, rather than shipped half-built.

Built with: TypeScript · Next.js · NestJS · PostgreSQL · Prisma · Redis · Docker · Azure · GitHub Actions · Microsoft Entra ID