DataBalk internal tool / Azure infrastructure

Platform State Explorer

Make cloud state searchable without turning the browser into an admin console.

01 / Purpose

Purpose and scope.

A local-first, read-only prototype for exploring point-in-time Azure infrastructure metadata across tenants, subscriptions, Key Vaults, access assignments and reference comparisons. It grew from a recurring operational problem: cloud state exists everywhere, but understanding it should not require opening every resource separately.

Built as an internal tool for the DataBalk team, to make an existing Azure estate easier to understand. Development ended when I left DataBalk, and the prototype was handed over to the team.

Import a deliberately bounded, metadata-only infrastructure snapshot.

Search resources and access assignments quickly without retrieving secret values.

Separate observed state from approved expectations and incomplete evidence.

Keep the tool useful offline while preserving a narrow path for future live checks.

02 / Interactive demo

Platform State Explorer: make coverage visible.

Search the captured vault inventory, inspect direct and inherited assignments, then compare reference entries. Change the sample coverage to see when a missing match remains unknown.

About this demoAn interactive local preview using fictional data, embedded in this portfolio. An independently written explanation using fictional cloud resources. No original application runtime, Azure connection or infrastructure snapshot is embedded. Changes reset when you reload.

Platform State Explorer · functional sample inventory

Demo scenario: change captured coverage

These controls change fictional evidence for this demo. The real inventory remains immutable after import.

Studio ProductionStudio DevelopmentAtelier Lab

Incomplete source coverage2/3 subscriptions complete · sample export 12 Oct 2026, 09:00 UTCFixed fictional dataset · no cloud connection

OFFLINE INVENTORY

Overview

General text search excludes identifiers. Use Exact ID search for sample IDs.

Inspect the evidence behind the inventory

Find a vault, follow its direct and inherited access assignments, then check whether the captured data supports a reference match.

Atelier Lab is incomplete. An unobserved reference therefore starts as Unknown. Change the demo coverage to see how evidence affects the conclusion.

Independently authored portfolio reconstruction with fictional records. Search, filters, details and comparisons run locally; no original importer, database, authentication or restricted runtime is included.

03 / Decisions

Engineering decisions.

Offline first

Most exploration does not need a live cloud session. A fixed local snapshot reduces authentication, availability and privacy risk.

No secret-value path

The inventory schema, importer, API and interface omit secret values by design instead of relying on a UI promise.

Incomplete is not missing

Coverage remains part of the evidence so an inaccessible subscription or failed scan cannot silently become a false absence result.

Exact IDs live separately

Ordinary search stays readable and privacy-conscious; identifiers require a deliberate exact lookup.

04 / Architecture

How it works.

Collect

A guarded inventory process exports only approved Azure metadata and explicit coverage information.

Validate

Strict schemas, hashes and row-count reconciliation reject incomplete or secret-bearing input.

Index

A completed snapshot is published atomically into an immutable SQLite run with bounded FTS5 search.

Explore

A loopback-only React interface provides grouped search, exact-ID lookup, detail views and comparison evidence.

05 / Technology

The working parts.

TypeScriptReactNode.jsFastifySQLiteFTS5PowerShellAzure REST APIs

06 / Project status & roadmap

Current state and next steps.

Current

At handover, type checks, production builds, privacy checks and 192 automated tests passed.
Importing a real snapshot and exploring it in the browser were verified locally.
Handed over to the DataBalk team when I left.

Where it was heading

A supervised pilot of the read-only live-check path.
Metadata-only correlation between application identities and infrastructure access.
Search and comparison refinements based on real operator use.
A hosted version would need its own company-owned identity and security design.