Saturday, 17 October 2026

 

Bring Me the Problem, Not the Prototype

One of the most common anti-patterns in software delivery is not a technical failure. It is a communication failure.

A stakeholder identifies a challenge, finds a tool, builds a spreadsheet, purchases a SaaS product, creates a low-code workflow, or commissions a proof of concept. They then present it to the software delivery team with a request:

"Can you productionise this?"

Or worse:

"Can you support this going forward?"

While the intention is usually positive, the outcome is often expensive, frustrating, and slow.

The most effective software teams are not order-takers. They are problem-solvers. The best outcomes emerge when stakeholders bring a problem to the team rather than arriving with a pre-selected solution and asking the team to operationalise it.

The Difference Between a Problem and a Solution

A problem describes an outcome that needs to be achieved:

  • Customer onboarding takes too long.
  • Engineers cannot find the information they need.
  • Regulatory compliance activities are highly manual.
  • Staff enter the same data multiple times.

A solution describes one potential way of addressing that problem:

  • Build a Power App.
  • Purchase a workflow tool.
  • Create a custom portal.
  • Develop a new integration.

The challenge is that when a solution is proposed first, the organisation immediately narrows its thinking. The discussion shifts from understanding the problem to defending the chosen approach.

The software delivery team is then deprived of its ability to explore alternatives and apply its expertise. Instead of solving the problem, it is asked to implement an assumption.

This runs counter to many of the principles behind agile delivery, which emphasise collaboration, learning, and adapting as understanding evolves. The Agile Manifesto specifically values customer collaboration and responding to change over rigid adherence to a predefined plan. Manifesto for Agile Software Development [Manifesto...evelopment], [framework....dagile.com]

Why Software Teams Need the Problem

Software engineers, architects, product managers, security specialists, and user experience professionals each bring different perspectives.

When presented with a problem, they can explore:

  • Root causes
  • User needs
  • Technical feasibility
  • Existing capabilities
  • Operational implications
  • Security concerns
  • Long-term support requirements
  • Cost of ownership

Very often, the solution that emerges from this discovery process is entirely different from what was originally imagined.

And sometimes, the most valuable finding is that the solution is not technical at all.

Sometimes the Best Solution Is No Software

Many organisations assume that every business problem requires a technology solution.

In reality, some of the highest-value improvements come from changes to processes, governance, training, or organisational structure.

Consider a team that repeatedly enters the same information into multiple systems.

A stakeholder might conclude:

"We need a new integration platform."

After further investigation, the delivery team may discover that the duplication exists because different departments maintain their own spreadsheets and have no agreed source of truth.

The solution may be:

  • Better data governance
  • Clear ownership of information
  • Process simplification
  • Additional training

No new application is required.

No integration is required.

No code is required.

The problem still gets solved.

This is an important mindset shift. The purpose of software delivery is not to create software. The purpose of software delivery is to solve business problems.

Success should be measured by outcomes, not by the amount of technology produced.

The Hidden Cost of "Productionising"

Creating a prototype is relatively easy.

Running a production service is not.

A prototype can be created in days or weeks. A production service may need to operate reliably for years.

When stakeholders ask a software delivery team to productionise an existing solution, they often underestimate the work required.

Production systems require:

  • Authentication and authorisation
  • Security reviews
  • Monitoring and alerting
  • Backup and recovery procedures
  • Disaster recovery planning
  • Performance and scalability testing
  • Documentation
  • Support processes
  • Compliance controls
  • Ongoing maintenance

What appears to be a finished solution is frequently little more than a proof of concept.

The delivery team then discovers that much of the original work must be redesigned or rebuilt before it can meet enterprise standards.

Code Is a Liability, Not an Asset

One of the most useful ways to think about software is to recognise that code itself is rarely an asset.

The business capability enabled by software may be valuable.

The code that delivers that capability is often a liability.

This idea can feel uncomfortable because organisations frequently celebrate the creation of new systems. Yet every line of code introduces a long-term obligation.

Someone must:

  • Maintain it
  • Secure it
  • Monitor it
  • Document it
  • Upgrade it
  • Support it
  • Eventually replace it

Unlike a physical asset, software does not appreciate in value simply because it exists. In many cases, the opposite is true.

As technology evolves, code becomes harder to maintain unless continuous investment is made.

This is why experienced delivery teams ask a different question from stakeholders.

Rather than asking:

"Can we build this?"

They ask:

"Should we own this for the next ten years?"

Every new application, workflow, integration, database, or service creates operational overhead. If the same business outcome can be achieved through configuration, process improvement, or better use of existing platforms, then that option may represent the lower-risk and higher-value choice.

A useful rule of thumb is:

Every line of code should have to justify its existence.

Writing software should be a last resort after simpler alternatives have been explored.

An Example: The Employee Onboarding Application

Imagine a Human Resources department struggling with employee onboarding.

New starters need accounts creating, equipment ordering, mandatory training assigning, and access to various systems. The process feels slow and inconsistent, and managers frequently complain about delays.

Wanting to move quickly, the HR team commissions a supplier to build a custom onboarding application.

Six months later, they approach the software delivery team and say:

"The application is working well. Can you productionise it and support it?"

The delivery team's review uncovers several concerns:

  • No integration with the corporate identity platform
  • No audit trail for compliance purposes
  • Sensitive employee information stored outside approved systems
  • Duplicate functionality already available within existing HR and IT service management platforms
  • No automated testing or deployment process
  • No support or maintenance model

What initially appeared to be a finished solution now requires significant investment before it can be safely operated and supported.

What Could Have Happened Instead?

Now imagine HR approached the delivery team with the problem rather than the solution.

The conversation starts with:

"New employees take too long to become productive, and managers report inconsistent onboarding experiences."

After discovery, the team uncovers several root causes:

  • Hiring managers frequently submit requests late.
  • Equipment ordering follows different processes across departments.
  • Existing workflow capabilities in the HR platform are underutilised.
  • Ownership of onboarding tasks is unclear.
  • Training requirements are not consistently documented.

The eventual solution includes:

  • Standardising the onboarding process
  • Clarifying responsibilities
  • Automating notifications using existing platforms
  • Improving reporting for hiring managers
  • Providing targeted training for HR staff

A small amount of configuration is required.

No new application needs to be built.

No additional database needs to be maintained.

No long-term software support burden is created.

Most importantly, the business problem is solved.

This example highlights an important lesson: the custom onboarding application was never the goal. Faster and more consistent onboarding was the goal. By focusing on the problem rather than a preconceived solution, the organisation achieved the desired outcome with less cost, less risk, and far less technical complexity.

The Importance of Root Cause Thinking

Humans naturally jump to solutions.

When faced with a challenge, our instinct is to ask:

"How do we fix it?"

instead of:

"Why does it happen?"

This tendency is one reason why root-cause analysis techniques remain so valuable.

Toyota's famous Five Whys approach encourages teams to repeatedly ask "why" until the underlying cause is revealed rather than treating symptoms. The technique became a cornerstone of the Toyota Production System and remains widely used in continuous improvement practices. How Toyota Utilizes the 5 Whys Method for Problem Solving and 5 Whys [orcalean.com], [mindtools.com], [get-alfred.ai]

The same principle applies in software delivery.

A proposed solution is often an answer to a symptom.

The real opportunity lies in understanding the underlying business problem.

Moving From Supplier to Partner

When stakeholders bring finished solutions to delivery teams, they unintentionally position those teams as implementation factories.

When stakeholders bring problems instead, they create the conditions for genuine partnership.

The conversation changes from:

"Can you build this?"

to:

"What is the best way to solve this?"

That subtle change unlocks broader thinking, encourages innovation, reduces unnecessary complexity, and frequently uncovers solutions that no one initially considered.

It also changes how success is measured. Rather than rewarding teams for producing software, organisations begin rewarding them for solving problems. Sometimes the answer is a new system. Sometimes it is a process change. Sometimes it is simply removing unnecessary work.

Conclusion

Organisations often assume that software teams create the most value when they build software.

In reality, their greatest value often comes much earlier by helping to understand, challenge, and frame the problem itself.

When stakeholders arrive with a predetermined solution, they restrict options, increase the risk of technical debt, and may commit the organisation to years of unnecessary support and maintenance.

When they bring the problem instead, they allow the team to explore the full range of possibilities, including solutions that require little or no new technology.

This matters because software is not free once it has been built. Every application, workflow, and integration introduces a long-term maintenance burden. Code must be secured, monitored, maintained, upgraded, and eventually replaced. In that sense, code is often better viewed as a liability that enables business value rather than an asset in its own right.

The best software delivery teams understand a simple truth:

Their job is not to maximise the amount of software created. Their job is to maximise the amount of value delivered.

Sometimes that means building a system.

Sometimes it means improving a process.

Sometimes it means configuring an existing platform.

And sometimes the best software solution is realising that no new software is required at all.

References

  1. Manifesto for Agile Software Development. Agile Manifesto. Values customer collaboration and responding to change. [Manifesto...evelopment], [framework....dagile.com]

  2. What are the 4 Agile Values?. Productboard. Discussion of collaboration, feedback, and adaptability within modern software development. [productboard.com]

  3. How Toyota Utilizes the 5 Whys Method for Problem Solving. Root-cause analysis and continuous improvement within the Toyota Production System. [orcalean.com]

  4. 5 Whys. Mind Tools. Explanation of countermeasures versus symptom-based fixes. [mindtools.com]

  5. The Five Whys: Root Cause Analysis from Toyota. Historical background and application of the Five Whys technique. [get-alfred.ai]

From Projects to Products: Why the Shift Must Involve the Entire Organisation

Over the past decade, many organisations have embarked on what they describe as a "move to product". New job titles appear, product managers are hired, agile practices are adopted, and technology teams are reorganised into product teams.

Yet despite significant investment, many organisations discover that very little has actually changed.

Projects are still approved annually. Success is still measured by delivery against scope. Leaders still specify solutions. Teams are still rewarded for output rather than outcomes.

The result is an organisation that looks like a product organisation on paper but continues to operate using a project mindset.

This is one of the key messages within Marty Cagan's Product Model: moving to product is not a technology transformation. It is an organisational transformation.


The Common Misunderstanding

Many organisations approach product transformation as a technology initiative.

The thinking often looks like this:

  • Create Product Manager roles
  • Rename delivery teams as product teams
  • Adopt Scrum or Kanban
  • Change roadmaps
  • Introduce product ownership

These changes can be helpful, but they do not, by themselves, create a product organisation.

A genuine move to product requires changes across:

  • Leadership
  • Governance
  • Funding
  • Finance
  • Risk and compliance
  • Performance management
  • Planning and prioritisation
  • Technology
  • Product management
  • Design

In other words, the entire organisation.

If only the technology department changes, the organisation remains constrained by project-based thinking.


Project Model versus Product Model

At its core, the difference comes down to accountability.

Project Model

Teams are accountable for:

  • Delivering agreed scope
  • Meeting deadlines
  • Staying within budget

Success is measured by delivery.

The key question becomes:

Did we build what we said we would build?

Product Model

Teams are accountable for:

  • Customer outcomes
  • Business outcomes
  • Measurable impact

Success is measured by value creation.

The key question becomes:

Did we solve the problem?

This sounds simple, but it fundamentally changes how decisions are made throughout the organisation.


Why Technology Teams Alone Cannot Make the Change

Consider a technology team that has been restructured into a product team.

They are encouraged to run experiments, conduct discovery, and focus on customer outcomes.

However:

  • Finance still allocates annual project budgets.
  • Governance boards still approve detailed solution designs.
  • Senior leaders still demand feature commitments twelve months in advance.
  • Performance measures still focus on delivery dates.

In this scenario, the team is expected to behave like a product team while being managed like a project team.

The inevitable result is frustration.

The team may possess product titles and product ceremonies, but it lacks product autonomy.

True product organisations align the entire operating model around outcomes.


An Example: Moving from Project to Product

Imagine a large insurance company that wants to improve its digital claims experience.

Phase 1: Project Thinking

A senior steering committee reviews customer feedback and decides:

We need a mobile claims app.

A project is approved.

Project Objective

Build a mobile claims application by September.

Measures of Success

  • Delivered on time
  • Delivered within budget
  • All requirements completed

A project manager is assigned.

Requirements are gathered.

Designs are produced.

Developers build the application.

The application is launched successfully.

The project closes.

Six months later:

  • Adoption is low
  • Customer satisfaction has barely improved
  • Call centre volumes remain unchanged

The project was successful.

The customer problem was not solved.


Phase 2: Product Thinking

The organisation restructures around customer outcomes rather than projects.

Instead of approving a solution, leadership defines a problem.

Product Outcome

Reduce friction in the claims journey and increase customer satisfaction.

A permanent cross-functional team is formed.

The team includes:

  • Product Manager
  • Product Designer
  • Engineers
  • Data specialists
  • Customer service representatives

Notice that the team is not purely technical.

The customer service team becomes a critical source of insight because they hear customer frustrations every day.

The team begins discovery.


What They Learn

Customer interviews reveal several unexpected findings.

Customers are generally happy using the website.

Most customers submit claims infrequently and have little interest in downloading a dedicated app.

The biggest frustration is uncertainty.

Customers repeatedly ask:

  • Has my claim been received?
  • Who is handling it?
  • What happens next?
  • How long will it take?

The problem turns out not to be claim submission.

The problem is claim visibility.


Experiments

The team runs several experiments.

Experiment 1

Real-time claim status updates.

Result:

  • Significant reduction in customer enquiries.

Experiment 2

Automated SMS and email updates.

Result:

  • Improved customer confidence.

Experiment 3

Mobile app prototype.

Result:

  • Very low customer interest.

The team decides not to build the mobile app.

Instead, they improve claim tracking and customer communication.


Outcomes

After six months:

  • Customer satisfaction increases
  • Call centre demand falls
  • Processing transparency improves
  • Development effort is significantly lower than originally estimated

Most importantly:

The original solution was rejected because the evidence showed it would not solve the problem.

This is a hallmark of an empowered product team.

Success came not from building the planned solution but from discovering a better one.


What Changes Across the Organisation?

The transition to product requires more than changing team structures.

AreaProject OrganisationProduct Organisation
StrategyAnnual initiativesContinuous outcomes
FundingFund projectsFund long-lived teams
LeadershipDirect solutionsProvide context and goals
GovernanceApprove plansReview outcomes
FinanceCapital tied to projectsInvestment tied to value
HRReward deliveryReward impact
TechnologyBuild requirementsDiscover solutions
Success MeasuresTime, scope, budgetCustomer and business outcomes

Notice that technology is only one row in the table.

The Product Model requires every function to evolve.


The Hardest Change Is Not Process

Many organisations invest heavily in agile frameworks, tooling, and delivery practices.

These changes are relatively easy.

The difficult part is changing how leaders think.

Leaders must move from:

"I know the solution. Build it."

to:

"I know the outcome we need. Discover the best solution."

That requires trust.

It also requires accepting that teams may discover that a stakeholder's proposed solution is not the right one.

For organisations with strong project traditions, this can feel uncomfortable.

However, it is where the greatest value is found.


Final Thought

The move from project to product is often described as a transformation of technology teams.

In reality, it is a transformation of the entire organisation.

A business does not become product-led because it hires Product Managers or adopts agile methods.

It becomes product-led when strategy, funding, governance, leadership, and delivery are all aligned around a single principle:

The purpose of the organisation is not to deliver features. The purpose of the organisation is to create outcomes for customers and value for the business.

When that shift happens, teams stop asking, "What should we build?"

and start asking,

"What problem are we trying to solve?"

That is the real journey from projects to products.

DORA Metrics and Squash Commits

How Do You Measure Lead Time for Changes?

One of the most common questions teams encounter when implementing DORA metrics is surprisingly simple:

How do we measure Lead Time for Changes if our team uses squash commits?

The concern is understandable. Traditional descriptions of DORA often refer to measuring the time from a code commit until that change reaches production. But modern development teams frequently use Pull Requests and squash merging strategies that remove individual commit history from the main branch.

Fortunately, squash commits do not prevent accurate DORA measurement. In many cases, they actually encourage a more meaningful approach.

A Quick Refresher: What Is Lead Time for Changes?

Lead Time for Changes measures how long it takes a code change to move from development into production.

The metric helps answer:

  • How quickly can we deliver value?
  • Where are bottlenecks occurring?
  • Are reviews, testing, or deployments slowing us down?

The DORA framework identifies Lead Time for Changes as one of four key indicators of software delivery performance:

  1. Deployment Frequency
  2. Lead Time for Changes
  3. Change Failure Rate
  4. Mean Time to Restore (MTTR)

Of these, Lead Time is often the most difficult to calculate accurately.

The Challenge with Squash Commits

Consider a typical workflow:

Feature Branch
 ├─ Commit A
 ├─ Commit B
 ├─ Commit C
 └─ Pull Request
Main Branch
 └─ Squash Commit

After the PR is merged, the main branch contains a single commit representing the entire feature.

If your DORA implementation relies solely on Git commit history, you lose visibility of:

  • When the work started
  • How long the PR was under review
  • How long the changes waited before deployment

Measuring from the squash commit to production can produce misleadingly optimistic results.

Example:

Development:   4 days
Code Review:   2 days
Testing:       1 day
Deployment:    1 day
Actual Delivery Time: 8 days
Squash Commit → Production: 1 day

The metric suggests exceptional performance while ignoring seven days of actual delivery effort.

What Should Count as a "Change"?

The answer lies in redefining what constitutes a change.

In modern development workflows, the Pull Request is often a more meaningful unit of change than an individual commit.

A Pull Request represents:

  • The complete scope of work
  • Review activity
  • Quality checks
  • Approval workflows
  • A deployable feature or fix

For many organizations, the Pull Request becomes the ideal object for DORA measurement.

Option 1: PR Creation to Production (Recommended)

This is the approach most organizations should adopt.

PR Created
    ↓
Review
    ↓
Approval
    ↓
Squash Merge
    ↓
Production Deployment

Lead Time is calculated as:

Lead Time =
Production Deployment Time
−
PR Creation Time

Why This Works

This approach captures the entire delivery process:

  • Development activity
  • Review delays
  • Build and testing time
  • Release management overhead
  • Deployment execution

It answers the business question DORA is designed to measure:

How long does it take to turn a completed piece of work into customer value?

Example

PR Created:    Monday 09:00
Production:    Thursday 14:00
Lead Time: 77 hours

Option 2: First Commit in the PR to Production

Some teams prefer to include active development time.

First Commit
      ↓
PR Created
      ↓
Review
      ↓
Squash Merge
      ↓
Production

Calculation:

Lead Time =
Production Deployment Time
−
First Commit Time

This aligns more closely with the original DORA concept of measuring from code creation to deployment.

Advantages

  • Captures coding effort
  • Includes review and release latency
  • Maintains compatibility with DORA research

Considerations

Developers may create early "work in progress" commits long before meaningful development begins.

This can inflate lead times and create volatility in the metric.

Option 3: Merge to Production

Some tools default to measuring from the merge commit.

Squash Merge
      ↓
Production

Calculation:

Lead Time =
Production Deployment Time
−
Merge Time

This metric is easy to obtain but should not be considered your primary DORA lead time measurement.

It only measures release pipeline efficiency and ignores:

  • Development work
  • Review cycles
  • Approval delays

At best, it is a supporting metric.

The Most Useful Approach: Measure Two Lead Times

Mature engineering organizations often track two separate metrics:

Delivery Lead Time

PR Created → Production

This reflects overall software delivery speed.

Release Lead Time

Merge → Production

This reflects deployment and release process efficiency.

Having both metrics helps identify where delays occur.

For example:

MetricResult
PR → Production8 days
Merge → Production4 hours

This suggests the deployment process is healthy while development and review workflows deserve attention.

Conversely:

MetricResult
PR → Production2 days
Merge → Production5 days

This suggests engineering throughput is strong, but releases are waiting too long to reach customers.

Data You Need

Regardless of merge strategy, the following data is usually sufficient:

Pull Request Data

pr_id
created_at
completed_at
repository

Deployment Data

deployment_id
environment
deployment_time
deployment_status
release_version

Optional Commit Information

first_commit_time
last_commit_time

Most of this information is already available in:

  • GitHub
  • Azure DevOps
  • GitLab
  • Bitbucket
  • Jenkins
  • Azure Pipelines
  • GitHub Actions

Azure DevOps Example

A common Azure DevOps workflow looks like this:

Work Item
    ↓
Pull Request Created
    ↓
Pull Request Completed (Squash)
    ↓
Release Pipeline
    ↓
Production Deployment

In this model, Lead Time can be calculated as:

DATEDIFF(
    hour,
    PullRequestCreatedDate,
    ProductionDeploymentDate
)

No dependency exists on preserving individual commit history.

Final Thoughts

Teams often worry that squash commits make DORA metrics difficult to implement. In reality, they encourage a healthier measurement approach.

Rather than treating individual Git commits as the unit of delivery, focus on the Pull Request as the change artifact.

If your team uses squash merges, the most practical and meaningful definition of Lead Time for Changes is:

Time from Pull Request creation to successful deployment into production.

This captures the complete delivery process, remains robust regardless of merge strategy, and provides actionable insights into how quickly your organization turns code into customer value.

Ultimately, DORA metrics are not about measuring Git history. They are about measuring delivery outcomes. The closer your implementation reflects the real flow of work, the more valuable the metric becomes.

Blockchain Meets DRM: Building a Simple FastAPI

Demonstrator for Protected API Content

What happens when you combine a blockchain ledger with API-based content protection? While blockchain won't stop users from copying data once they've received it, it can provide a transparent, tamper-resistant way to manage digital rights, licences, and access history. In this article, we'll build the conceptual foundations for a simple FastAPI demonstrator that shows exactly how this works.


The Problem with Traditional DRM

Most Digital Rights Management (DRM) systems rely on a central database to determine whether a user is authorised to access content.

A typical flow looks like this:

User
  │
  ▼
API
  │
  ▼
Licence Database
  │
  ▼
Protected Content

This approach works, but it has several shortcomings:

  • Administrators can modify licence records
  • Audit trails can be incomplete
  • Ownership history may be difficult to verify
  • Multiple content providers require complex integration

For a demonstrator or educational project, a blockchain-inspired ledger offers an interesting alternative.


What Blockchain Adds

Instead of storing licence information in mutable database tables, every licence-related activity is recorded as an immutable event.

Examples include:

LICENCE_CREATED
LICENCE_REVOKED
CONTENT_ACCESSED
DOWNLOAD_LIMIT_REACHED

Each event becomes a block in a chain:

Genesis Block
      │
      ▼
Licence Created
      │
      ▼
Content Accessed
      │
      ▼
Licence Revoked

Every block contains the hash of the previous block.

{
  "index": 2,
  "timestamp": "2026-10-06T12:00:00Z",
  "previous_hash": "abc123",
  "event": {
    "type": "CONTENT_ACCESSED"
  },
  "hash": "def456"
}

If somebody alters a historical record, all subsequent hashes become invalid.

The API can therefore detect tampering by validating the chain.


The Demonstration Scenario

Imagine we're protecting a set of premium reports exposed through an API.

Available content:

report-001
report-002
report-003

Users must possess a valid licence before retrieving a report.

The blockchain stores:

  • Who owns a licence
  • Which content it applies to
  • When it expires
  • Whether it has been revoked
  • How many times it has been used

The content itself remains outside the blockchain.


Solution Architecture

Our FastAPI application contains four main components.

+------------------+
| FastAPI API      |
+--------+---------+
         |
         v
+------------------+
| DRM Service      |
+--------+---------+
         |
         v
+------------------+
| Blockchain       |
| Ledger           |
+--------+---------+
         |
         v
+------------------+
| Content Store    |
+------------------+

FastAPI

Provides REST endpoints.

Examples:

POST /licenses
GET  /content/{id}
POST /licenses/{id}/revoke
GET  /blockchain

DRM Service

Contains the business rules:

  • Validate ownership
  • Check expiry
  • Verify revocation status
  • Enforce download limits

Blockchain Ledger

Records every event.

The ledger acts as the system of record.

Content Store

Contains the protected content being delivered through the API.


How a Protected Request Works

When a client requests content:

GET /content/report-001?licenseId=LIC-100

The API performs several checks:

Step 1: Validate Blockchain

if not blockchain.is_valid():
    raise ChainIntegrityException()

The chain must be intact.


Step 2: Verify Licence

license = drm_service.find_license(
    "LIC-100"
)

The licence must exist.


Step 3: Check Status

if license.status == "REVOKED":
    raise AccessDenied()

Revoked licences cannot be used.


Step 4: Check Expiry

if license.is_expired():
    raise AccessDenied()

Expired licences are rejected.


Step 5: Record Access

blockchain.add_event({
    "type": "CONTENT_ACCESSED",
    "licenseId": "LIC-100"
})

Access is permanently recorded.


Step 6: Return Content

return report

The content is finally returned to the user.


Why This Is Useful

This approach introduces several concepts that are valuable for developers learning modern API architecture.

Immutable Audit Trail

Every important event is preserved.

Licence Created
Licence Accessed
Licence Accessed
Licence Revoked

Nobody can silently alter the history without breaking chain validation.


Transparent Usage Tracking

The blockchain forms a complete record of activity.

For example:

{
  "type": "CONTENT_ACCESSED",
  "user": "alice",
  "content": "report-001"
}

This makes reporting straightforward.


Download Limits

A licence can specify a maximum number of downloads.

{
  "licenseId": "LIC-100",
  "maxDownloads": 5
}

The service counts access events and denies further requests after the limit is reached.

Downloads: 5/5
Access Denied


Revocation History

Unlike traditional systems where a row is simply updated, blockchain records the revocation event itself.

Block 14
LICENCE_REVOKED

This preserves a complete history of changes.


What Blockchain Does Not Solve

This is the most important thing to understand.

A blockchain-based DRM system cannot stop copying after delivery.

Once the API returns content:

API
 │
 ▼
User

The user can still:

  • Save the response
  • Export the file
  • Screenshot the content
  • Record the screen
  • Redistribute information

Blockchain helps answer:

"Was this user authorised to access the content?"

It does not answer:

"Can we prevent this content from ever being copied?"

That is a fundamentally different problem.


Why FastAPI Is a Great Fit

FastAPI is particularly suitable for this demonstrator because it provides:

  • Automatic OpenAPI documentation
  • Strong typing
  • Pydantic validation
  • Lightweight architecture
  • Rapid prototyping

A basic endpoint can be implemented in only a few lines:

@app.get("/content/{content_id}")
def get_content(
    content_id: str,
    license_id: str
):
    return drm_service.retrieve(
        content_id,
        license_id
    )

This allows the focus to remain on DRM concepts rather than framework complexity.


Educational Value

Although simple, this project demonstrates several useful software engineering concepts:

AreaConcepts Demonstrated
APIsREST, validation, error handling
SecurityAuthorization, licence checking
BlockchainHashing, immutability, chain validation
ArchitectureSeparation of concerns
AuditingEvent sourcing concepts
TestingBehavioural and integration testing

For students, architects, and developers, it provides a practical way to explore blockchain ideas without the complexity of cryptocurrency networks or smart contracts.


Final Thoughts

Blockchain is often viewed through the lens of cryptocurrencies, but its most accessible value may be as an immutable audit ledger. A simple FastAPI-based DRM demonstrator is an excellent way to explore this idea.

By recording licence creation, revocation, and content access events on a lightweight blockchain, we gain transparency, traceability, and tamper detection while keeping all content delivery within a familiar REST API architecture.

It won't prevent piracy, but it does provide a clear, auditable answer to a crucial question:

Who was authorised to access what content, and when?

An example implementation can be found on my github.