What to Build, Buy, and Federate in an Enterprise AI Platform
Part 2 of 3 — AI Platform Budget Decisions
A platform team that owns domain semantics has confused control with competence. Domain authority belongs to the people who answer for domain errors.
Starting From the Right Question
If you have worked through Part 1 and confirmed that multiple squads have genuine workflow demand, you are now at the architecture decision. The instinct in most organizations is to build a comprehensive end-to-end platform. That instinct is almost always too broad.
The better question is not "What should the platform own?" but "What should the platform never own?"
What Should You Buy?
The infrastructure runtime layer is commoditized. Assigning senior engineers to write a custom model proxy gateway, token metering service, or latency routing engine is misallocated capital. These exist as production-grade open-source or SaaS products today.
| Functional Layer | Component Scope | Default Decision | Category Examples |
|---|---|---|---|
| Model Gateway | Protocol translation, provider fallback, rate limiting, token metering | Buy or open source | LiteLLM, Cloudflare AI Gateway, Portkey |
| Telemetry & Tracing | Span tracking, generation latency, token cost, raw payload logging | Buy | Langfuse, Arize, Braintrust, OpenTelemetry |
| Data Masking | PII detection, regex redaction, outbound token filtering | Buy | Presidio, Private AI, AWS Comprehend |
| Capability Contracts | Typed schemas, authority limits, validation state machines, evidence gates | Build & own | Internal domain schemas |
| Domain Evaluation | Gold-standard test corpora, task-specific assertions, regression gates | Build & own | Internal evaluation harness |
| Learning Pipeline | Override capture, edge-case curation, verified dataset consolidation | Build if volume warrants | Internal feedback collector |
Build where internal ownership creates durable domain, risk, or economic leverage that cannot be purchased from a market provider at lower cost and comparable quality. Buy where operational maturity is high and differentiation is low.
The Vendor Shelf Life Problem
The buy decision carries its own risk. The LLM observability and evaluation tooling market evolves fast. Tooling selected today may face deprecation, vendor consolidation, or functional obsolescence within twelve months. Deeply coupling application telemetry to a vendor's proprietary tracing format creates high switching costs when migrating production pipelines.
The mitigation is clean: mandate open standards at the platform integration boundary. Instrument all application code using OpenTelemetry GenAI semantic conventions rather than vendor-proprietary SDK wrappers. This treats the buy layer as an interchangeable utility backend, preserving vendor reversibility without requiring custom internal plumbing.
The Specialized Vendor Exception
Not every vendor is a commodity. A commercial provider with seven years of adjudicated domain data, HIPAA or ISO-27001 certifications, and task-specific evaluation suites that demonstrably outperform internal engineering is not a commodity buy. Maintaining an internal capability contract to preserve "strategic ownership" against that vendor is an expensive error.
Before greenlighting an internal build over a specialized vendor, answer two questions directly:
- Does the internal build create durable enterprise leverage through proprietary customer data and unique domain authority?
- Or does it introduce perpetual maintenance drag without delivering competitive differentiation?
How Should You Federate What You Build?
The structural choice product leaders face is not centralized platform vs. isolated squads. It is designing ownership across three distinct tiers so the central platform team never becomes a cognitive bottleneck on specialized domain logic:
| Layer | Primary Owner | Core Responsibilities | What It Never Touches |
|---|---|---|---|
| Tier 1: Enterprise Control Plane | Central Platform Team | Provider routing, token FinOps, PII sanitization, rate limiting, OpenTelemetry pipelines | Domain business logic, custom schemas, end-user review interfaces |
| Tier 2: Federated Domain Pods | Named Capability Steward | Typed JSON schemas, golden eval test fixtures, clinician/accountant override curation | Low-level gateway plumbing, billing pipelines, end-user UI design |
| Tier 3: Product Workflows | Decentralized Product Squads | User experience, review queues, customer handoffs, feature economics, ERP/workflow integration | Direct vendor API keys, bespoke PII redaction code |
This strict division of labor prevents the platform team from having to understand or approve changes to medical diagnostic formats or accounting line items—the single biggest reason squads bypass central platforms in production.
Staged Centralization: How Does an AI Platform Earn the Right to Expand?
The classic corporate mistake is Premature Centralization. A platform architect pitches leadership: "Let's immediately build a full enterprise AI platform with mission-critical SLAs, automated distillation, custom evaluation engines, and shared infrastructure for all ten squads."
The result is predictable: huge upfront spend, near-zero squad adoption, complaints about slow central intake queues, and a platform team that becomes an expensive organizational bottleneck.
To prevent this, centralization cannot be funded as a blank-check project. You do not get budget and mandate to build a heavier platform layer just because you have an architectural vision. Each stage must earn its right to advance through demonstrated production evidence and verified squad demand from the previous stage:
| Stage | What You Build & Own | The Expansion Gate (How You Earn the Next Stage) |
|---|---|---|
| Stage 1: Managed Access | Credentials vault, gateway routing, FinOps cost attribution, deterministic PII sanitization. | Gate to Stage 2: At least two squads solve structurally identical problems and actively request shared contracts. |
| Stage 2: Domain Capability | Named Capability Steward, typed schemas, gold-standard evaluation fixtures, override capture. | Gate to Stage 3: Consuming squads demonstrate ≥80% schema parity in production and the 3-year financial model projects positive NPV. |
| Stage 3: Shared Service | CI/CD invariants, trace consolidation, automated schema versioning, blast-radius fallbacks. | Gate to Stage 4: Organic multi-department adoption where domain-specific overlays remain minimal (reuse ratio < 0.25). |
| Stage 4: Enterprise Service | Mission-critical 99.99% SLAs, task-specific model distillation, audit-grade compliance ledgers. | Fully matured enterprise utility operating with portfolio leverage. |
Advancement gates are not optional checkpoints. They exist because un-sharing a capability is never free.
What Does Reversal Actually Cost?
Decoupling consuming squads from a shared capability contract requires three friction-heavy steps per squad: stripping shared SDKs and unwinding centralized schema bindings, rebuilding prompt assembly and retry mechanics locally, and re-establishing standalone evaluation fixtures and regression baselines.
This refactoring costs two to four engineer-weeks per squad ($16k–$32k). Across four squads, reversing an unvalidated shared service runs $64k–$128k in deadweight friction. Because reversal cost is real and non-zero, promoting a capability from Stage 2 to Stage 3 creates an unpriced balance sheet liability unless reuse economics are proven first.
Is There Actually a Shared Capability?
Before advancing a capability from Stage 2 to Stage 3, product managers must defend the centralization decision against what the architecture literature calls the Reuse Trap.
The Reuse Trap occurs when squads appear to share a capability because they process similar data types with similar tooling—while actually solving structurally incompatible domain problems.
Consider a four-squad organization where every squad extracts fields from documents:
- Squad A (Invoices): Extracts financial line items where a single missing decimal point triggers an immediate reconciliation failure. Error tolerance is near zero; provenance requires cryptographic document coordinates.
- Squad B (Vendor Onboarding): Extracts business descriptions where approximate semantic matching is acceptable. Error tolerance is moderate; latency is flexible.
- Squad C (Patient Intake): Extracts medical histories under strict HIPAA de-identification rules, immutable audit logging, and data residency constraints.
- Squad D (Marketing Collateral): Extracts campaign tags where throughput and sub-second latency dominate, with zero compliance exposure.
Centralizing these four squads into a single "Document Intelligence Service" does not create leverage. It produces a platform choked with seventeen configuration flags, domain-specific exception branches, and conflicting evaluation harnesses. The team has rebuilt the monolith.
The Domain Engineer's Objection
A skeptical domain engineer will push back legitimately:
"You're assuming squads have fundamentally different needs just because their code looks different today. But squads only built custom setups because nobody gave them a shared standard to begin with. You can't tell if their needs are truly incompatible, or if they just reinvented the wheel in silos."
This objection identifies a real blind spot. Waiting for identical schemas to emerge organically will systematically undercount legitimate reuse opportunities.
The resolution: a 2-Week Convergence Spike. Before rejecting centralization, fund a time-boxed, two-week architectural spike between two adjacent squads—tasked with drafting a unified semantic schema and joint assertion suite.
- If 80% or more of the field schemas and validation rules merge without conditional branching, the divergence was artificial. Proceed with centralization.
- If merging requires domain-specific override flags for core validation and authority limits, the divergence is structural. Reject centralization. Keep capabilities local.
The Gated Centralization Assessment
A capability that fails any required gate cannot advance to a shared service.
Required gates (any failure blocks centralization):
| Gate | Question |
|---|---|
| Ownership clarity | Is there a named Domain Capability Steward with explicit authority over schema changes, evaluation standards, and incident response? |
| Authority compatibility | Do consuming workflows operate under compatible decision thresholds and regulatory classifications? A low-risk tagging task cannot share a contract with an unmonitored $500k financial authorization workflow. |
| Data permission scope | Have legal and governance confirmed that corrections, overrides, and traces from each tenant can be aggregated without violating contractual, jurisdictional, or privacy constraints? |
| Rollback and versioning | Does a defined rollback and versioning path exist for capability contract changes so that consuming squads are not broken by schema updates? |
Scored dimensions (three or more must demonstrate meaningful overlap):
| Dimension | Question |
|---|---|
| Semantic overlap | Are the underlying inputs, transformation targets, and failure modes structurally identical—not merely superficially similar? |
| Evidence overlap | Do consuming workflows require the same proof, citations, and provenance mechanics? |
| Evaluation overlap | Can one gold-standard evaluation harness meaningfully assess quality for all consuming squads? |
| Economic overlap | Does aggregate transaction volume justify the fixed build cost, coordination tax, and ongoing maintenance of a shared contract? |
What Comes Next
Clearing the architecture decision does not close the investment case. Once you know what to build, buy, and federate, you still need to prove that the economics justify the spend—against the right baseline, with phased cash flows, and with a kill rule that accounts for the patient capital AI platforms require.
That is the subject of Part 3.
→ Underwriting the Return on an AI Platform
One-Line Synthesis
The platform team owns the control plane. Domain pods own the contracts. Product squads own the workflow. Crossing those ownership lines is where platforms become bottlenecks.
Related Reading
- Before You Fund an AI Platform: Prove the Workflow First — Part 1: The capability sensitivity test and sequencing thresholds.
- Underwriting the Return on an AI Platform — Part 3: Phased cash flows, real-options logic, and the six failure modes.
- Policy-as-Code for Autonomous Agents — Implementing deterministic verification perimeters around probabilistic reasoning engines.
- EROI Is Not Enough: The Capital Return Trap of Generative AI — Why traditional return on investment metrics miss the systemic depreciation of generative software assets.
The ideas in this post are my own — they emerged from questions I asked while learning applied AI concepts and putting them to work in my job and my projects. The prose was developed with AI assistance.
Frequently Asked Questions
What is the correct boundary between buying and building in an AI platform?
Buy the infrastructure runtime layer—model gateways, telemetry, PII masking—where operational maturity is high and differentiation is zero. Build the capability contracts, domain evaluation harnesses, and learning pipelines where internal ownership creates durable domain, risk, or economic leverage that market providers cannot replicate at comparable quality.
What is the Reuse Trap in enterprise AI platform engineering?
The Reuse Trap occurs when a product organization mistakes superficial semantic similarity across squads—such as several teams extracting fields from PDFs—for a genuine shared capability. Forcing workflows with divergent evidence requirements, authority boundaries, and error tolerances into a common contract produces configuration sprawl and platform bottlenecks rather than architectural leverage.
How do you resolve the Domain Engineer's Objection to the Reuse Trap test?
Fund a time-boxed two-week convergence spike between two adjacent squads. Task them with drafting a unified semantic schema and joint assertion suite. If 80% or more of field schemas and validation rules merge without conditional branching, the divergence was artificial—proceed with centralization. If merging requires domain-specific override flags for core validation, the divergence is structural—reject centralization.
Download the Architecture of Proof Checklist
Ready to implement? Get the definitive checklist for building verifiable AI systems.