Self-hosted · runs in your cluster · your own cloud accounts
Ask for a database. Get one, or get the gate that stopped it.
Developers pick a template from the catalog. DevEx Lattice checks the request against your organization’s policy and the gates in the repository’s repo-profile.yaml, waits for an approver when the rules ask for one, then applies it to your cluster as a Crossplane composite.
gate ring
loading demo tenant…
Repository
Environment
catalog to cluster
illustrative · not a live cluster
One path for every request
Catalog, policy, approval, apply. A request from the console and one from the API take the same route and write the same audit row, so there is no quiet way around the gate.
Your org sets a floor, not a ceiling
Each repository declares its own
repo-profile.yaml. It may be stricter than the organization minimum — one service handles card data, another is a static site. It may never be looser, or the standard is advisory.
A refusal you can act on
A hold names the gate, the pillar and the condition that fired — k8s_security_baseline_declared, required because uses_helm == true. Nobody opens a ticket to find out why the deploy stopped.