BOLT — Delivery Tiers¶
Complexity determines the tier — not the technology, the team, or the tool.
TL;DR
Complexity determines the tier — not the technology, the team, or the tool. Tier 1: personal productivity (no-code, self-service). Tier 2: business-led solutions (low-code, dedicated workspace). Tier 3: fusion team delivery (complex, co-developed with IT). Tier 4: enterprise strategic (IT-led full SDLC). Escalate when scope exceeds the tier boundary.
Applies To
Audience: All — the tier model applies to every stakeholder BOLT Tiers: Tier 1 · Tier 2 · Tier 3 · Tier 4 Frameworks: BOLT · DIALOGE (solution complexity determines tier)
The four delivery tiers are the operational heart of BOLT. Every solution built on the low-code platform belongs to exactly one tier. The tier determines who owns the solution, what IT's role is, what oversight applies, and what governance requirements must be met before go-live.
Why Tiers Matter¶
Without a tiered delivery model, organisations face one of two failure modes:
The bottleneck failure — all solutions regardless of complexity require the same IT approval process. Simple automations wait in the same queue as enterprise system integrations. Business teams disengage and build outside the governed platform.
The governance failure — all solutions regardless of complexity are treated as low-risk citizen development. Complex integrations with regulated data go live without architecture review. Compliance findings follow.
The tier model solves both failures simultaneously — simple solutions move fast through a lightweight process, complex solutions receive the scrutiny they require, and the criteria for moving between tiers are objective and documented.
The Tier Model at a Glance¶
| Tier | Name | Complexity | Primary Owner | IT Involvement | Security Oversight |
|---|---|---|---|---|---|
| 01 | Personal Productivity | Very Low | Citizen Developer | Support on request | Platform-level pre-approval |
| 02 | Business Solutions | Low–Medium | Business Team | Onboarding and guidance | Informed + periodic review |
| 03 | Fusion Team Solutions | Medium–High | Business Team + Line of Business IT | Co-development and architecture | Mandatory sign-off |
| 04 | Enterprise & Strategic | High | Line of Business IT | Full SDLC ownership | Mandatory sign-off throughout |
Increasing complexity → Increasing IT involvement → Increasing oversight
TIER 01 — Personal Productivity¶
BOLT Principles Active: B · O
What Tier 1 Is¶
Tier 1 covers no-code solutions for individual or team productivity — the solutions that business users build for themselves and their immediate colleagues, using the default productivity workspace and a limited set of approved connectors.
Tier 1 is the most accessible entry point into BOLT. It is designed for business users with no prior development experience — people who use Microsoft 365 every day and want to automate repetitive tasks or create simple tools without waiting for IT.
Scope¶
- Workspace: Default productivity workspace — shared, personal productivity space
- Connectors: Standard productivity connectors only — Microsoft 365, SharePoint, Teams, Outlook, OneDrive
- Data classification: Public and Internal use only — no Confidential or Regulated data
- Users: Individual or small team — no enterprise-wide deployment
- Complexity: No-code configuration — no custom logic, no custom connectors, no external system integration
What Tier 1 Looks Like¶
- Automated notifications when a SharePoint list item changes
- Approval requests sent via Teams when a form is submitted
- Simple data capture forms that write to SharePoint
- Personal workflow automation within Microsoft 365
- Teams integrations that surface information from SharePoint or Planner
- AI-assisted summarisation or drafting within Microsoft 365 workloads using Copilot
IT Role¶
The Platform Team provides standards, guardrails, and the platform itself. The Tech Solution Team (IT Support) is the first point of contact for citizen developers with questions or day-to-day issues within their area of expertise.
Individual Tier 1 solutions do not require Platform Team review or approval before they are built — the platform-level pre-approvals and workspace guardrails cover the risk profile. The Platform Team monitors aggregate usage via CoE telemetry and reviews flagged solutions, but does not approve each solution individually.
Governance¶
| Control | How Applied |
|---|---|
| Connector restriction | Enforced by DLP policy — only approved productivity connectors available |
| Data classification | Enforced by workspace configuration — Confidential data cannot be accessed from the default workspace |
| Quality | Citizen developer training and guidelines — no automated Solution Checker gate at this tier |
| Security oversight | Platform-level pre-approval covers the tier — no per-solution security review |
| Monitoring | CoE Starter Kit telemetry — Platform Team monitors for anomalies and policy violations |
Escalation to Tier 2¶
A Tier 1 solution must escalate to Tier 2 when any of the following apply: - The solution needs to be shared beyond the immediate team - The solution requires a connector not in the productivity connector set - The solution involves data classified above Internal use - The solution requires a dedicated workspace - The business user wants IT Platform Team involvement in design or delivery
TIER 02 — Business Solutions¶
BOLT Principles Active: B · O · L
What Tier 2 Is¶
Tier 2 covers business-led, low-to-medium complexity solutions built by business teams — typically power users or business analysts — in a dedicated workspace with access to the full approved connector library.
Tier 2 is where the majority of BOLT's business value is delivered. These are the department applications, approval workflows, operational dashboards, and data capture tools that business teams genuinely own and maintain.
Scope¶
- Workspace: Dedicated business workspace — provisioned by the Platform Team for the business team
- Connectors: Full approved connector library — all pre-approved enterprise connectors available
- Data classification: Up to Confidential (limited use cases) — within the pre-approved boundary
- Users: Department or business unit — broader deployment than Tier 1 but not enterprise-wide
- Complexity: Low-code development — apps, flows, and automations without custom connectors or complex enterprise integration
What Tier 2 Looks Like¶
- Department applications for case management, resource tracking, or operational reporting
- Approval workflows that integrate with department systems and notify via Teams
- Data capture tools that write to Dataverse with defined security roles
- Operational dashboards built on Dataverse or SharePoint data
- AI-assisted workflows using AI Builder models within the approved connector boundary
- Copilot Studio agents for department-level knowledge and process guidance
IT Role¶
The Platform Team: - Provisions the dedicated workspace upon business team onboarding - Understands the high-level business need and confirms the solution fits within the Tier 2 boundary - Provides guidance on connector usage, data classification, and solution design - Involves Line of Business IT or the security / compliance function where the solution approaches the boundary of what Tier 2 covers
The security / compliance function is informed of Tier 2 activity and conducts periodic reviews of the business workspace via platform telemetry — but does not review or approve individual Tier 2 solutions. The platform-level pre-approvals cover the Tier 2 risk profile.
Governance¶
| Control | How Applied |
|---|---|
| Connector restriction | Enforced by DLP policy in dedicated workspace — approved connector library only |
| Data classification | Workspace configured for the approved classification boundary — Confidential ceiling enforced |
| Quality | Solution Checker recommended — Platform Team provides guidance on best practices |
| Security oversight | Security / compliance function informed and monitoring — no per-solution sign-off |
| Ownership | Business team documents solution ownership, purpose, and data classification as part of onboarding |
| Monitoring | CoE Starter Kit telemetry — Platform Team monitors workspace usage and flags anomalies |
Escalation to Tier 3¶
A Tier 2 solution must escalate to Tier 3 when any of the following apply: - The solution requires integration with enterprise core systems (ERP, CRM, HR systems) - The solution involves data above the Confidential pre-approval boundary - The solution requires custom connectors or non-standard integrations - The solution is business-critical — its failure has material operational impact - The solution requires compliance or regulatory sign-off beyond the pre-approved boundary - The architecture complexity requires Line of Business IT involvement to design correctly
TIER 03 — Fusion Team Solutions¶
BOLT Principles Active: B · L · T
What Tier 3 Is¶
Tier 3 covers complex solutions built collaboratively by a business team and the Line of Business IT team — a fusion team model where business expertise and technical expertise combine to deliver solutions that neither could build well alone.
Tier 3 is the tier where enterprise integration, regulated data, and business-critical processes live. The business team owns the requirements and leads user acceptance. Line of Business IT co-develops, owns the architecture, and signs off on go-live.
Scope¶
- Workspace: Dedicated solution workspace with full environment promotion (Development → Test → Production)
- Connectors: All approved connectors plus case-by-case assessment for additional connectors
- Data classification: Full range — including regulated and sensitive data with appropriate controls
- Users: Potentially enterprise-wide — deployment at scale across multiple teams or the organisation
- Complexity: Complex — multi-system integration, regulated data, business-critical processes, potential custom connectors
What Tier 3 Looks Like¶
- Multi-system integration solutions connecting Power Platform to ERP, CRM, HR systems, and external APIs
- Business-critical process automation for regulated workflows — procurement, compliance, finance
- Solutions handling sensitive personal data with Dataverse row-level and column-level security
- Enterprise-grade applications with formal ALM — version control, pipeline-based deployment, UAT
- AI-enabled solutions with Azure OpenAI integration or custom AI Builder models on business data
- Copilot Studio agents integrated with enterprise knowledge sources and business system actions
IT Role¶
Line of Business IT: - Co-develops the solution alongside the business team - Owns the solution architecture — data model, integration design, security model - Reviews and approves the solution against enterprise integration standards - Signs off on go-live alongside the business team
The security / compliance function provides mandatory sign-off on: - Solution architecture and data flows - Integration points with enterprise systems - Data handling for regulated or sensitive data - The solution cannot proceed to production without security / compliance function approval
Governance¶
| Control | How Applied |
|---|---|
| Architecture review | Line of Business IT reviews and approves solution architecture |
| Solution Checker | Mandatory — Critical and High findings must be resolved before go-live |
| Security review | Security / compliance function mandatory sign-off before production deployment |
| ALM | Full pipeline-based deployment — Dev → Test → Production with approvals |
| Data classification | Explicitly reviewed as part of architecture assessment |
| Ownership | Documented joint ownership — business team owns requirements and UAT; Line of Business IT owns architecture and technical delivery |
| Monitoring | Application Insights, Dataverse auditing, and CoE monitoring all active |
Escalation to Tier 4¶
A Tier 3 solution must escalate to Tier 4 when any of the following apply: - The solution replaces or significantly modifies a core enterprise system - The solution requires enterprise-scale deployment with full SDLC governance - The solution is a strategic platform or shared service used by multiple business units - The complexity, risk, or strategic importance warrants full IT-led ownership
TIER 04 — Enterprise & Strategic¶
BOLT Principles Active: L · T
What Tier 4 Is¶
Tier 4 covers enterprise-scale solutions where Line of Business IT leads the full software development lifecycle. These are the most complex, highest-impact solutions — core system replacements, enterprise APIs, cross-business-unit platforms, and strategic digital transformation initiatives.
The business team remains deeply involved — particularly in requirements definition and user acceptance — but IT owns the delivery.
Scope¶
- Workspace: Dedicated enterprise solution workspace — isolated environments, full SDLC governance
- Connectors: All connectors — with full architecture assessment for each integration
- Data classification: All classifications — with the highest security and compliance standards
- Users: Enterprise-wide — potentially the entire organisation or external users
- Complexity: Highest — full SDLC, enterprise integration, strategic impact
What Tier 4 Looks Like¶
- Core system replacements or major upgrades built on Power Platform
- Enterprise APIs and integration hubs serving multiple business units
- Strategic digital transformation programmes using Power Platform as the delivery platform
- Enterprise Copilot Studio deployments serving external customers or the whole organisation
- Cross-LOB platforms shared as internal services across multiple business units
IT Role¶
Line of Business IT owns the full SDLC: - Requirements, architecture, development, testing, deployment, and operations - The Platform Team acts as enabler — providing standards, connector governance, and platform guidance - Business teams are the customer — involved in requirements and UAT, not in delivery
The security / compliance function is involved throughout — not just at go-live: - Architecture review at design phase - Security assessment during development - Go-live sign-off before production deployment - Ongoing compliance monitoring post-deployment
Governance¶
Full enterprise governance applies — this tier follows the same standards as any enterprise IT-delivered solution, with the Platform Team providing the low-code platform expertise alongside the standard enterprise SDLC process.
Which Tier Does My Solution Belong To?¶
Use this decision guide when a new solution is being scoped. Answer each question in sequence — the first "Yes" answer determines the minimum tier.
Does the solution integrate with enterprise core systems (ERP, CRM, HR, financial systems)? Yes → Minimum Tier 3
Does the solution handle Regulated or sensitive personal data beyond the pre-approved boundary? Yes → Minimum Tier 3
Is the solution business-critical — would its failure cause material operational impact? Yes → Minimum Tier 3
Does the solution require deployment to the entire organisation or external users? Yes → Minimum Tier 3 (likely Tier 4)
Does the solution replace or significantly change a core enterprise system or process? Yes → Tier 4
Does the solution require custom connectors or integrations not in the approved library? Yes → Minimum Tier 2, likely Tier 3
Does the solution handle Confidential data? Yes → Minimum Tier 2
Is the solution for a department or business unit (not just the individual)? Yes → Minimum Tier 2
None of the above apply: → Tier 1
When in doubt, escalate rather than underscope. The cost of discovering a solution was in the wrong tier after go-live is significantly higher than the cost of an upfront tier assessment.
Moving Between Tiers¶
Solutions can move between tiers as their scope evolves. A Tier 1 personal workflow that becomes a department tool becomes Tier 2. A Tier 2 business solution that grows to integrate with enterprise systems becomes Tier 3.
The escalation trigger: Any change that takes a solution outside the criteria for its current tier must trigger a tier reassessment before the change is implemented — not after.
The Platform Team's role in tier transitions: The Platform Team monitors solution growth via CoE telemetry and proactively identifies solutions that may be outgrowing their tier. Business teams are responsible for engaging the Platform Team when they believe a tier transition may be needed.
Part of the BOLT Framework — powerplatform.wiki Last updated: March 2026 Last reviewed: March 2026