# Set the baseline before adding workloads

> Establish access, connectivity and operating rules before applications depend on an environment.

- Category: Infrastructure
- Reading time: 1 min
- Published: 2026-08-07
- Updated: 2026-09-13

Establish the basic access and operating rules before applications depend on the environment. Early clarity makes later delivery simpler.

## Set a small baseline

Define environment boundaries, identities, external access and the expected logging. Assign an owner to each control.

Start with the rules needed for the first workload. Avoid building an elaborate shared platform around hypothetical requirements.

## Prove connectivity

Check the paths an application needs: inbound requests, internal services and approved external dependencies. Test the paths that should remain blocked.

Document how an operator gains access and how that access is removed. Operational convenience should not create an unreviewed permanent exception.

## Make changes reviewable

Keep configuration changes small and versioned. Review the planned effect before applying it, then verify the actual result.

Separate environment-specific values from reusable configuration. A successful test deployment should provide evidence for the next release decision.

## Prepare for normal operations

Give teams a clear way to request access, investigate a failure and recover from a bad change. Record the decisions that affect future work.

The baseline is useful when teams can follow it consistently and understand where responsibility sits.

## Index

- [Journal](https://brittek.net/journal)

Canonical URL: https://brittek.net/journal/landing-zone-policy-before-workloads