Blueprints
5 on record. Where a Field Note argues a position in about a thousand words, a Blueprint specifies one: a complete, versioned implementation specification for a single cross-cutting concern, with numbered requirements you can cite, test vectors you can run, and a conformance checklist you can grade yourself against.
They're written to be handed to whoever is building the thing — as a URL, with the instruction “implement this.” Increasingly that's a language model, and the format is shaped accordingly: self-contained, unambiguous, and testable. New here? Start withZBP-0 for how they work.
Bundles
Several blueprints behind one URL, in dependency order — a bundle already includes everything its parts require. Start here if you're building a whole subsystem rather than one piece.
Multi-tenant SaaS: identity and isolation
Everything needed to stand up authentication and tenant isolation for a B2B SaaS product: the isolation boundary, the identity and membership model on top of it, and sender-constrained credentials for its machine callers.
/zbp/bundle/multi-tenant-saas.mdZBP-1 → ZBP-3 → ZBP-4Workload identity: an STS and the credentials it issues
Service-to-service authentication with no long-lived secrets: a token service bootstrapped from platform attestation, issuing short-lived tokens bound to a holder key.
/zbp/bundle/workload-identity.mdZBP-1 → ZBP-2