
## Why Build an IDP?

When you manage 11 products across real estate, communications, AI, eCommerce, and DevOps, every team reinventing the wheel becomes a bottleneck. Authentication, logging, validation, storage — each product had its own implementation. Duplication meant inconsistency, security gaps, and slower delivery.

## The Approach

Instead of building another tool, I designed AgStack as an **Internal Developer Platform (IDP)** — a set of reusable, standardized modules that every product could consume as npm packages.

### Core Modules

- **@agstack/auth** — JWT-based authentication with RBAC, session management, and OAuth support
- **@agstack/logger** — Structured logging with correlation IDs, log levels, and transport abstraction
- **@agstack/validation** — Schema-based input validation using Zod with standardized error responses
- **@agstack/storage** — Abstracted file storage supporting local, S3, and CloudFront
- **@agstack/security** — Rate limiting, CSP headers, SQL injection prevention, CORS management
- **@agstack/plugin-sdk** — Plugin system for extensibility

## Results

- **Reduced onboarding time** for new products from weeks to days
- **Standardized security** — every product gets auth, CSP, and rate limiting by default
- **Single upgrade path** — update one package, all products benefit
- **Published to npm** — teams consume via familiar package management

## Key Lessons

1. Start with the pain points — don't build abstractions nobody needs
2. Make it opt-in, not forced — teams adopt what helps them
3. Version carefully — breaking changes impact all products
4. Document everything — an IDP is only as good as its DX
    

How I Built an Internal Developer Platform in 6 Months


## The Core Question

Every enterprise team building AI features hits this fork: RAG or fine-tuning? The answer depends on your data, your latency requirements, your budget, and your privacy constraints.

## When to Use RAG

Retrieval-Augmented Generation works best when:

- Your knowledge base changes frequently (docs, policies, product data)
- You need to cite sources explicitly
- You want to use a general-purpose model without customization
- Your data is too sensitive to send for fine-tuning

**Our AI Platform uses RAG** for property recommendations, SEO content generation, and customer support automation across NoBrokerage and NotifyIndia.

## When to Fine-Tune

Fine-tuning wins when:

- You need consistent output format (e.g., structured JSON)
- Your domain has specific terminology and patterns
- Latency is critical — RAG adds retrieval latency
- You're deploying on your own hardware with Gemma or Llama

**We fine-tuned Gemma 2B** for internal code review assistance and commit message generation.

## Hybrid Approach

The best enterprise systems use both. Our architecture:

1. Fine-tune a base model for domain understanding
2. Use RAG for factual retrieval
3. Layer on MCP (Model Context Protocol) for tool integration

## Decision Framework

| Factor | Choose RAG | Choose Fine-Tune |
|--------|-----------|------------------|
| Data changes often | ✅ | ❌ |
| Need source citations | ✅ | ❌ |
| Low latency required | ❌ | ✅ |
| Consistent output format | ❌ | ✅ |
| Small deployment footprint | ✅ | ❌ |
| Proprietary data | ✅ | ⚠️ |
    

RAG vs Fine-Tuning: A Practical Guide for Enterprise Teams


## The Unconventional Start

Most engineering managers come from computer science degrees and internships at tech companies. I started in a different place: supporting cybercrime investigations for the Maharashtra Police.

Working digital forensics taught me something that most engineering programs don't: **how systems break under pressure**. Ransomware attacks, data breaches, evidence chain-of-custody — these demand a methodical, security-first mindset.

## The Transition

Moving from forensics to software engineering in 2021 was humbling. I had to learn:

- Modern JavaScript and TypeScript
- REST API design principles
- Database modeling and query optimization
- Version control and CI/CD

I started with PHP and MySQL (UrbanPillar — 240+ microsites), then moved to Node.js, Express, and React. Each project taught me something about scale.

## How Security Informs Leadership

Three principles from forensics that I apply daily:

1. **Assume compromise** — Every system will fail. Design for resilience.
2. **Chain of custody** — Every decision should be traceable. Log everything.
3. **Least privilege** — Give teams and systems only what they need.

## Advice for Career Changers

1. Your non-traditional background is an advantage, not a liability
2. Build real products — theory only gets you so far
3. Find a mentor who challenges your assumptions
4. Certifications help (CompTIA Security+ opened doors for me)
5. Think in systems, not just features
    

Blog

How I Built an Internal Developer Platform in 6 Months

RAG vs Fine-Tuning: A Practical Guide for Enterprise Teams

From Cyber Forensics to Engineering Manager — My Unconventional Path