Larkinized LLC

Governance

Governance turns integration from heroic point-to-point work into a managed capability. Score honestly: aspirational wiki pages that teams ignore are a 2, not a 4.

Rate each statement: 1 = not true · 3 = partially true · 5 = consistently true with evidence

Integration standards and patterns are documented and accessible.

Look for a single source of truth — not slides from a 2019 project. Teams should know where to find sync vs async guidance, error handling, and approved platforms.

What makes a 1 vs a 5?

Score 1: 1 — No standards, or they exist only in individual architects' heads or outdated decks.
Score 5: 5 — Living standards in a portal/wiki, versioned, with examples and search used weekly by delivery teams.

1 2 3 4 5

Material interfaces pass a formal design review before production.

Material means external exposure, PII/financial data, high volume, or hard-to-reverse coupling. Informal Slack approval does not count.

What makes a 1 vs a 5?

Score 1: 1 — Interfaces go live without architecture or security review unless something breaks.
Score 5: 5 — Review is mandatory, scored, tracked, and blocks release until critical gaps close.

1 2 3 4 5

An integration CoE or equivalent forum meets regularly with clear ownership.

A forum needs a charter, executive sponsor, backlog, and decisions — not a monthly complaining session.

What makes a 1 vs a 5?

Score 1: 1 — No forum, or meetings happen without decisions, owners, or follow-through.
Score 5: 5 — CoE/forum with charter, RACI, published minutes, and metrics reviewed by leadership quarterly.

1 2 3 4 5

Exceptions to standards are tracked with expiry and compensating controls.

Every waiver should answer: why, who approved, what risk remains, and when it sunsets.

What makes a 1 vs a 5?

Score 1: 1 — Exceptions are invisible or permanent by default.
Score 5: 5 — Exception register with risk rating, compensating controls, expiry, and remediation plan.

1 2 3 4 5

Security

Integration is where data leaves system boundaries. Score based on production reality, not policy PDFs.

Rate each statement: 1 = not true · 3 = partially true · 5 = consistently true with evidence

Service-to-service authentication uses managed identities or OAuth — not long-lived shared secrets.

Shared API keys in config files and permanent service accounts are a 1–2. Managed identity with rotation is a 4–5.

What makes a 1 vs a 5?

Score 1: 1 — Shared secrets embedded in code, configs, or spreadsheets.
Score 5: 5 — Managed identities/OAuth everywhere; secrets vault with automated rotation and audit.

1 2 3 4 5

Data classification drives encryption, retention, and access controls on interfaces.

If teams cannot tell you whether an interface carries confidential data, score low.

What makes a 1 vs a 5?

Score 1: 1 — Classification is unknown or ignored at design time.
Score 5: 5 — Classification tagged on every interface; controls enforced in gateway/registry and verified in review.

1 2 3 4 5

Third-party and partner integrations have documented security review.

Partners are part of your attack surface — especially OAuth redirects and webhook endpoints.

What makes a 1 vs a 5?

Score 1: 1 — Partner integrations go live without security assessment.
Score 5: 5 — Standard partner review pack, contractual security clauses, and periodic re-certification.

1 2 3 4 5

Secrets rotation and certificate lifecycle are automated or scheduled.

Manual calendar reminders for cert expiry are a 2 at best.

What makes a 1 vs a 5?

Score 1: 1 — Expired certificates and stale secrets discovered during incidents.
Score 5: 5 — Automated rotation, expiry alerting, and runbooks tested without production outage.

1 2 3 4 5

APIs

API maturity is more than REST — it is discoverability, lifecycle discipline, and operational accountability.

Rate each statement: 1 = not true · 3 = partially true · 5 = consistently true with evidence

REST/GraphQL design standards exist (URI, errors, pagination, versioning).

Standards should cover errors (RFC 7807), pagination, idempotency, and versioning — with examples.

What makes a 1 vs a 5?

Score 1: 1 — Every team invents its own API style.
Score 5: 5 — Published standards adopted in code generators, linters, and review checklists.

1 2 3 4 5

A developer portal or catalog publishes contracts before GA.

Consumers should discover, test, and subscribe without emailing the building team.

What makes a 1 vs a 5?

Score 1: 1 — No catalog; contracts shared ad hoc via email or Confluence.
Score 5: 5 — Portal with OpenAPI, try-it, auth docs, SLA, and ownership contacts before production.

1 2 3 4 5

Breaking changes follow deprecation policy with consumer notification.

Policy needs minimum notice period, dual-run window, and consumer acknowledgment.

What makes a 1 vs a 5?

Score 1: 1 — Breaking changes ship without notice; consumers break in production.
Score 5: 5 — Enforced deprecation windows, comms templates, and metrics on consumer migration.

1 2 3 4 5

API performance and error budgets are monitored with SLOs.

Uptime alone is insufficient — latency, error rate, and saturation matter for consumers.

What makes a 1 vs a 5?

Score 1: 1 — No SLOs; teams learn about problems from customer tickets.
Score 5: 5 — SLOs per tier-1 API with error budgets, dashboards, and release gates.

1 2 3 4 5

Events

Event-driven maturity means cataloged, governed async flows — not every team installing Kafka because it is fashionable.

Rate each statement: 1 = not true · 3 = partially true · 5 = consistently true with evidence

An event catalog lists producers, consumers, schemas, and SLAs.

If you cannot answer "who consumes customer.updated?" in five minutes, score low.

What makes a 1 vs a 5?

Score 1: 1 — No catalog; event knowledge is tribal.
Score 5: 5 — Searchable catalog integrated with schema registry and ownership metadata.

1 2 3 4 5

Schema registry enforces compatibility in CI/CD pipelines.

Breaking schema changes should fail the build unless explicitly versioned.

What makes a 1 vs a 5?

Score 1: 1 — Schemas change in production without compatibility checks.
Score 5: 5 — Registry gates merges; compatibility rules enforced for backward/forward modes.

1 2 3 4 5

Async patterns are used where decoupling reduces risk or load — not everywhere by default.

Maturity includes knowing when NOT to use events. Score 5 if sync/async decisions follow a decision matrix.

What makes a 1 vs a 5?

Score 1: 1 — Async/sync chosen randomly or by team preference.
Score 5: 5 — Documented decision matrix applied in design review with recorded rationale.

1 2 3 4 5

Replay, dead-letter, and poison-message procedures are tested.

Runbooks on paper that failed the last incident are a 2.

What makes a 1 vs a 5?

Score 1: 1 — No DLQ/replay strategy, or never tested.
Score 5: 5 — Quarterly game days for replay/DLQ; metrics on poison message rate and recovery time.

1 2 3 4 5

Monitoring

You cannot operate what you cannot trace. Integration monitoring spans APIs, events, and batch — with shared correlation.

Rate each statement: 1 = not true · 3 = partially true · 5 = consistently true with evidence

End-to-end correlation IDs span API and event flows.

Pick a customer transaction and trace it across at least three systems — if you cannot, score low.

What makes a 1 vs a 5?

Score 1: 1 — No correlation standard; each log format differs.
Score 5: 5 — Mandatory trace/correlation ID propagated through gateways, services, and consumers.

1 2 3 4 5

Integration dashboards show latency, errors, and backlog/lag.

Dashboards should answer "is integration healthy right now?" for operators and product owners.

What makes a 1 vs a 5?

Score 1: 1 — No integration-specific dashboards; rely on generic infra metrics.
Score 5: 5 — Role-based dashboards with SLOs, lag, error taxonomy, and consumer impact.

1 2 3 4 5

On-call runbooks exist for major integration platforms.

Runbooks need symptoms, diagnostics, escalation, and rollback — not vendor documentation links alone.

What makes a 1 vs a 5?

Score 1: 1 — On-call learns integrations by trial and error during outages.
Score 5: 5 — Tested runbooks with ownership, last-reviewed date, and linked dashboards.

1 2 3 4 5

Post-incident reviews feed back into standards and training.

Blameless reviews that produce standard updates and measurable follow-ups indicate maturity.

What makes a 1 vs a 5?

Score 1: 1 — Incidents close without root cause or standard changes.
Score 5: 5 — PI reviews linked to backlog items; standards updated; training refreshed within 30 days.

1 2 3 4 5

Your scorecard & analysis

Email my scorecard (optional)

Leave your details only if you want a copy emailed and optional follow-up from our team.

Name

Work email

Company

Learn

Explore

Company

Integration Maturity Assessment

Governance

Security

APIs

Events

Monitoring

Your scorecard & analysis

Email my scorecard (optional)