Implementation Of Frameworks

🪂 How To Make Your Design System AI-Ready (https://lnkd.in/dtnpy7CM), a practical guide on how to reduce drifts, minimize mistakes, maintain context and improve the quality of AI-generated prototypes — with structured spec files, automated auditing and token layers. Put together by Hardik Pandya from Atlassian. --- 🔹 1. Design Decisions Are Infrastructure AI-generated prototypes often don't deliver consistently decent results because of tiny inconsistencies scattered all across a design system. Often it's decisions made but not documented, hard-coded values never cleaned up, or relying too much on AI making sense of mock-ups or design flows on its own. Unsurprisingly, better AI prototypes come from better data — but also from better human guidance. We shouldn’t assume that AI knows how to choose the right component, and how to design with accessibility in mind. It needs priorities, a clear path on how we make decisions, design principles, examples, do's and don'ts. In fact, we should treat design decisions as infrastructure. That means that every time we make a decision — not just a design decision, but even decision on how actually prioritize our work and how we make decisions around here — it must find a path into the spec file that is then consumed by AI. --- 🔶 2. Three Layers: Spec Files + Token Layer + Audit To ensure quality, we establish design principles, guidelines, rules in a form of “spec files”). It's structured Markdown files that include spacing rules, color choices, component usage guidelines, priorities etc. AI is going to read and reuse that spec file every time it's going to generate a prototype. Because the spec files are text files, it's much more cost-effective, but also much more accurate just because we don't rely on AI recognizing or decoding patterns from mock-ups, but gets specific guidelines instead. In fact, extending code is often a more effective way than generating code from mock-ups. Token layer lists and keeps updated all tokens used throughout the design system. AI always chooses from a closed set of named variables instead of inventing plausible values ad-hoc. An audit script catches what AI gets wrong. It scans the prototype and flags every hard-coded value and flags it if necessary. It can be a regular software doing that, with AI waiting for its feedback to come back. Finally, when a design system ships updates, a sync routine flags which spec files need updating. The goal is to make sure that AI always reads up-to-date, current specs, not the ones written against an outdated version. --- 🔺 3. Examples of AI-Ready Design Systems ⌾ Atlassian: https://lnkd.in/dVsGc3Cp ⌾ Carbon: https://lnkd.in/d4zq4WWb ⌾ CMS Design System: https://lnkd.in/dHHzV3en ⌾ Nordhealth: https://lnkd.in/d8C4j2ZA Yet again, AI can’t magically resolve technical debt or design debt — it needs guidance, decisions, priorities and principles.

Zomato processes 2M+ orders per day. 450 million Kafka messages per minute. 20 billion events ingested per week. Petabytes of data queried daily. Ever wonder what happens to your order data AFTER you click "Place Order"? Here's what Zomato's data pipeline actually looks like: 𝟭. 𝗬𝗼𝘂 𝗰𝗹𝗶𝗰𝗸 "𝗣𝗹𝗮𝗰𝗲 𝗢𝗿𝗱𝗲𝗿" ⤷ Order, payment, and location hit Aurora MySQL + DynamoDB. 𝟮. 𝗘𝘃𝗲𝗻𝘁𝘀 𝗵𝗶𝘁 𝗞𝗮𝗳𝗸𝗮 ⤷ 450M+ messages per minute. ⤷ Every pipeline downstream starts here. 𝟯. 𝟰 𝗣𝗶𝗽𝗲𝗹𝗶𝗻𝗲𝘀 𝗞𝗶𝗰𝗸 𝗜𝗻 (𝗡𝗼𝘁 𝟭 — 𝗙𝗢𝗨𝗥) 🔹 MySQL → Sqoop → S3 (batch ETL) 🔹 MySQL → Debezium CDC → Kafka → Flink → Iceberg (real-time) 🔹 DynamoDB Streams → Spark → S3 (serverless data) 🔹 App Events → Kafka → Flink → Druid (real-time dashboards) 𝟰. 𝗘𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴 𝗟𝗮𝗻𝗱𝘀 𝗶𝗻 𝗦𝟯 ⤷ ORC format. Iceberg tables. ⤷ All roads lead to the data lake. 𝟱. 𝗧𝗿𝗶𝗻𝗼 𝗤𝘂𝗲𝗿𝗶𝗲𝘀 𝗧𝗵𝗲 𝗟𝗮𝗸𝗲 ⤷ 250K+ queries per week. 2 PETABYTES scanned. ⤷ 3 cluster types: Ad-hoc, ETL (via Airflow), Reporting. ⤷ Joins across MySQL, Druid, Pinot, and MongoDB. 𝟲. 𝗗𝗿𝘂𝗶𝗱 𝗦𝗲𝗿𝘃𝗲𝘀 𝗥𝗲𝗮𝗹-𝗧𝗶𝗺𝗲 ⤷ 20 billion events/week. 8 million queries/week. ⤷ Response time: milliseconds. 𝟳. 𝗧𝗲𝗮𝗺𝘀 𝗦𝗲𝗲 𝗗𝗮𝘀𝗵𝗯𝗼𝗮𝗿𝗱𝘀 ⤷ Superset + Redash + Jupyter 𝗧𝗵𝗲 𝗙𝘂𝗹𝗹 𝗦𝘁𝗮𝗰𝗸: 📡 Kafka (450M msgs/min) ⚙️ Flink, Spark, Sqoop on EMR 🔍 Trino (batch) + Druid (real-time) 📦 S3 + Iceberg + ORC 🔄 Debezium CDC ⏰ Airflow 📊 Superset, Redash, Jupyter Next time you order biryani at 9 PM on a Friday... > Your order flows through Kafka → Flink → S3 → Trino → Dashboard. > Someone at Zomato HQ sees biryani orders in Mumbai spiked 40%. > All in near real-time. That's Data Engineering at scale. --- THINKING through real systems taught me more than any course ever did. What company should I break down next? 🤔 --- ♻️ Repost if this helped you see Data Engineering differently! Follow 👉 Darshil Parmar for more Data Engineering deep dives

Govern transformation like a project. You’ll get project outputs. A CEO said this to me recently. “Rob, we’re spending millions each month, but margin hasn’t moved in two years.” The room full of senior leaders went still. The CFO looked up at the on-screen dashboard. Every status box was green. She turned to the project sponsor and said: "...and so how has this changed our numbers?" Projects were completing on schedule. Teams were celebrating milestones. The business had little to show for it. That comment stayed with me. Because it’s a common pattern in medium and large organisations. There’s plenty of activity. There’s no shortage of delivery. But enterprise transformation remains thin. The issue usually isn’t effort. It isn't a lack of commitment. It’s the governance model. Boards often govern transformation like an infrastructure build. Stage gates. Milestones. Fixed scope. That works when the asset is known. It fails when the capability must be discovered and built. Projects and programmes matter. They’re the scaffolding of transformation. But scaffolding isn’t the building. Transformation works differently. Priorities shift as evidence emerges. Value takes time to build. Capabilities often take longer. What matters most isn’t deliverables. It’s whether your organisation can perform in a new way. One client completed 94% of milestones. The dashboard looked outstanding. Green everywhere. But operating margin stayed flat. You have the project and programme frameworks. What transformation framework are you using? This is why the most impressive transformations I’ve seen at scale create a TMO. A Transformation Management Office. The TMO isn't an executive committee. It's the governance executives operate within. It governs outcomes, not tasks. It rests on a defined set of structural capabilities, not a steering rhythm or a stage-gate calendar. Learning isn't treated as deviation. It changes what gets funded next quarter. The first practical shift is clear. Appoint one chair accountable for capability and value creation. The goal was never to finish projects. It’s to change what your organisation can do. What’s stopping your organisation from governing transformation as a system rather than a project? Get The Boardroom Brief Insights for leaders shaping transformation https://cxo.fm/news

“We are ISO 27001 certified, are we DORA compliant?” Not so fast. ISO 27001 and DORA both focus on cybersecurity and risk management, but they serve very different purposes. If you're a financial institution or an ICT provider working with financial institutions in the EU, DORA compliance is mandatory, and ISO 27001 alone won’t get you there. Let’s break it down: 1. Regulatory vs. Voluntary Framework ↳ ISO 27001 – A voluntary international standard for information security management. ↳ DORA – A mandatory EU regulation for financial entities and their ICT providers, with strict oversight and penalties for non-compliance. 2. Scope and Focus ↳ ISO 27001 – Offers a customizable scope tailored to organizational needs, focusing on information security (confidentiality, integrity, availability) based on specific risk assessments and chosen controls. ↳ DORA – Enforces a standardized scope across financial entities, extending beyond security to operational resilience. It ensures institutions can withstand, respond to, and recover from ICT disruptions while maintaining service continuity. 3. Key Compliance Gaps 🔸 Incident Reporting ↳ ISO 27001 – Requires incident management but doesn’t impose strict deadlines or mandate reporting to regulators, as it is a flexible standard. ↳ DORA – 4 hours to report a major incident, 72 hours for an update, 1 month for a root cause analysis. 🔸 Security Testing ↳ ISO 27001 – Requires vulnerability management but leaves testing methods and frequency to organizational risk. ↳ DORA – Annual resilience testing, threat-led penetration testing every 3 years, continuous vulnerability scanning. 🔸 Third-Party Risk Management: ↳ ISO 27001 – Covers supplier risk but with general security controls. ↳ DORA – Enforces contractual obligations, exit strategies, and regulatory audits for ICT providers working with financial institutions. 4. How financial institutions and ICT providers can address the delta? ✅ Perform a DORA Gap Analysis – Identify missing controls beyond ISO 27001. (Hopefully, you're not still at this stage now that DORA has been mandatory since January 17, 2025.) ✅ Upgrade Incident Response – Implement real-time monitoring and reporting mechanisms to meet DORA’s deadlines. ✅ Enhance Security Testing – Introduce formalized resilience testing and threat-led penetration testing. ✅ Strengthen Third-Party Risk Management – Update contracts, prepare for regulatory audits, and ensure exit strategies comply with DORA. ✅ Improve Business Continuity Planning – Move from cybersecurity alone to full digital operational resilience. 💡 ISO 27001 is just the tip of the iceberg - beneath the surface lie significant gaps that only DORA addresses. 👇 What’s the biggest challenge in aligning with DORA? Let’s discuss. ♻️ Repost to help someone. 🔔 Follow Amine El Gzouli for more.

After years building event-driven systems. Here are the top 4 mistakes I have seen: 1. Duplication Events often get re-delivered due to retries or system failures. Without proper handling, duplicate events can: • Charge a customer twice for the same transaction. • Cause duplicate inventory updates, messing up stock levels. • Create inconsistent or broken system states. Solution: • Assign unique IDs to every event so consumers can track and ignore duplicates. • Design event processing to be idempotent, ensuring repeated actions don’t cause harm. 2. Not Guaranteeing Order Events can arrive out of order when distributed across partitions or queues. This can lead to: • Processing a refund before the payment. • Breaking logic that relies on correct sequence. Solution: • Use brokers that support ordering guarantees (e.g., Kafka). • Add sequence numbers or timestamps to events so consumers can detect and reorder them if needed. 3. The Dual Write Problem When writing to a database and publishing an event, one might succeed while the other fails. This can: • Lose events, leaving downstream systems uninformed. • Cause mismatched states between the database and event consumers. Solution: • Use the Transactional Outbox Pattern: Store events in the database as part of the same transaction, then publish them separately. • Adopt Change Data Capture (CDC) tools to track and publish database changes as events automatically. 4. Non-Backward-Compatible Changes Changing event schemas without considering existing consumers can break systems. For example: • Removing a field might cause missing data for consumers. • Renaming or changing field types can trigger runtime errors. Solution: • Maintain versioned schemas to allow smooth migration for consumers. • Use formats like Avro or Protobuf that support schema evolution. • Add adapters to translate new schema versions into older ones for compatibility. "Every schema change is a test of your system’s resilience—don’t fail it." What other mistakes have you seen out there?

From Blueprint to Battlefield: Reinventing Enterprise Architecture for Smart Manufacturing Agility
   Core Principle: Transition from a static, process-centric EA to a cognitive, data-driven, and ecosystem-integrated architecture that enables autonomous decision-making, hyper-agility, and self-optimizing production systems.   To support a future-ready manufacturing model, the EA must evolve across 10 foundational shifts — from static control to dynamic orchestration.   Step 1: Embed “AI-First” Design in Architecture Action: - Replace siloed automation with AI agents that orchestrate workflows across IT, OT, and supply chains. - Example: A semiconductor fab replaced PLC-based logic with AI agents that dynamically adjust wafer production parameters (temperature, pressure) in real time, reducing defects by 22%.   Shift: From rule-based automation → self-learning systems.   Step 2: Build a Federated Data Mesh Action: - Dismantle centralized data lakes: Deploy domain-specific data products (e.g., machine health, energy consumption) owned by cross-functional teams. - Example: An aerospace manufacturer created a “Quality Data Product” combining IoT sensor data (CNC machines) and supplier QC reports, cutting rework by 35%.   Shift: From centralized data ownership → decentralized, domain-driven data ecosystems.   Step 3: Adopt Composable Architecture Action: - Modularize legacy MES/ERP: Break monolithic systems into microservices (e.g., “inventory optimization” as a standalone service). - Example: A tire manufacturer decoupled its scheduling system into API-driven modules, enabling real-time rescheduling during rubber supply shortages.   Shift: From rigid, monolithic systems → plug-and-play “Lego blocks”.   Step 4: Enable Edge-to-Cloud Continuum Action: - Process latency-critical tasks (e.g., robotic vision) at the edge to optimize response times and reduce data gravity. - Example: A heavy machinery company used edge AI to inspect welds in 50ms (vs. 2s with cloud), avoiding $8M/year in recall costs.   Shift: From cloud-centric → edge intelligence with hybrid governance.   Step 5: Create a “Living” Digital Twin Ecosystem Action: - Integrate physics-based models with live IoT/ERP data to simulate, predict, and prescribe actions. - Example: A chemical plant’s digital twin autonomously adjusted reactor conditions using weather + demand forecasts, boosting yield by 18%.   Shift: From descriptive dashboards → prescriptive, closed-loop twins.   Step 6: Implement Autonomous Governance Action: - Embed compliance into architecture using blockchain and smart contracts for trustless, audit-ready execution. - Example: A EV battery supplier enforced ethical mining by embedding IoT/blockchain traceability into its EA, resolving 95% of audit queries instantly.   Shift: From manual audits → machine-executable policies.   Continue in 1st and 2nd comments.   Transform Partner – Your Strategic Champion for Digital Transformation   Image Source: Gartner

I put together a new article on setting up local coding agents with open-weight models. Everything runs 100% locally. I thought it might be useful to put this together because many people asked me about my setup in the past, and I thought it would also motivate people to get started tinkering with local models for serious work (yes, things got incredibly capable this year with better LLMs and better harnesses). So, here's a walkthrough of how to connect a local LLM to a local coding harness (could be Claude Code or Codex, which you may already be familiar with). I also included some assessment notes that are useful as a checklist to select between and consider certain LLMs over others: - Checking RAM usage at long contexts to see if the model is suitable for real work - Measuring prefill and decoding tok/sec to see whether it's fast enough to not be annoying - Making sure the model has sufficient tool-calling capabilities in theory - Assessing whether the model can solve some more challenging tasks when used in a coding harness. Of course, there are always more specialized tools that can squeeze a bit more performance out of things, but I hope this is a good starter kit that stays flexible; that is, you can easily switch to newer models as they are released or even tap into cloud models in your familiar harness if the current ones are not sufficient for a given task. Link: https://lnkd.in/g6gWMiyj

You can't skip the messy middle of product transformation. In my newsletter last week, I talked about the struggle I keep seeing when organizations try to shift from project to product operating models: We rally around the vision. Get buy-in. Then expect to reach that end state... immediately. We're trying to run before we can walk. Here's a pattern I see often: Leaders implement OKRs as a first step. Everyone writes their own across the organization. But no one can define what an outcome actually means in their context. Product managers have no idea how to measure their impact. Some aren't even sure they're product managers yet. The framework exists. The capabilities don't. Before you can write effective OKRs, you need: - A shared definition of what an "outcome" means for your organization - Clarity on what level of strategy each role owns - Data infrastructure to actually measure those outcomes - Training on outcome-based thinking - Strategic guidance from leadership on how it all connects - A culture that wants to measure outcomes Without these foundational capabilities, OKRs become just another exercise in theater. Product transformations aren't about implementing frameworks. They're about building the capabilities to use them effectively. It's just as important to know where you are as it is to know where you're going. And then be realistic about what it takes to get there. The framework is the easy part. Building the capabilities to use it effectively? That's the transformation. Which means you need to know where you are today just as clearly as where you're headed—and be realistic about what it takes to get there. I know I'm not alone in seeing this pattern. What frameworks have you seen implemented too early at your company? What groundwork should have been laid first?

Compliance isn’t choosing one framework, it’s understanding how they work together. Many organizations view SOC 2, ISO 27001, and GDPR as competing obligations, but the reality is far more integrated. SOC 2 validates data security controls for US-based service providers voluntary but expected by enterprise clients. ISO 27001 provides a globally recognized ISMS foundation with comprehensive risk management and continuous improvement. GDPR legally enforces personal data protection for EU citizens with significant financial penalties for non-compliance. The strategic advantage lies in their overlap: access controls, incident response, vendor risk management, encryption, and breach notification requirements align across all three. Organizations that map controls once and satisfy multiple frameworks simultaneously reduce audit fatigue while strengthening their overall security posture. Rather than treating compliance as separate silos, mature GRC programs build unified control environments that address shared requirements, turning regulatory burden into operational excellence. What’s your approach to managing overlapping compliance frameworks? #GRC #SOC2 #ISO27001 #GDPR #Compliance #InformationSecurity #DataProtection