The problem: ITIL change gates, overtime, and evaporating Money

At ShitOps, every production change still enters through an ITIL change advisory board. The board meets in a low code form that posts into a spreadsheet, which is exported by a cron job into a sql table that nobody trusts. When a release needs approval on Saturday, on-call engineers sit in overtime while a WebSocket notification never arrives. Finance can see Money leaving the building, but cannot tie it to a change ticket. istio retries look healthy, yet the approval queue is stalled. We needed a real-time, auditable, cost-aware path from a low code request to an ITIL-approved deployment without waking the whole CAB.

The solution: an event-driven low code ITIL control plane on istio

We built ChangeMesh 3000: a low code approval canvas connected to a WebSocket gateway, backed by an event-driven programming backbone, an istio service mesh, a sql ledger, and a Money cost engine. The platform turns every ITIL change request into a signed event, projects it into an immutable audit topic, prices the overtime risk in near real time, and drives the approval workflow through a dedicated orchestrator. The low code canvas is the only UI humans touch. Everything else is services, sidecars, topics, and ledger rows.

flowchart TD A[Low code ITIL request portal] --> B[WebSocket gateway] B --> C{Istio ingress} C --> D[Approval event bus] D --> E[SQL ledger service] D --> F[Money cost engine] E --> G[Immutable audit topic] F --> G G --> H[Overtime risk predictor] H --> I[Change advisory orchestrator] I --> J[Istio virtual service] J --> K[ITIL workflow engine] K --> L[Low code dashboards] L --> B

How a change request travels through the mesh

An engineer fills in the low code form with service name, risk tier, blast radius, and desired deploy window. The form publishes a ChangeRequested event to the WebSocket gateway, which authenticates through istio ingress and upgrades the request to a live approval session. The approval event bus fans the event into three lanes: the sql ledger service writes a row into the change_requests table; the Money cost engine computes the expected overtime burn for the requested window; and the audit projector appends the event to an immutable topic. The overtime risk predictor scores the Money exposure against historical CAB latency. If the score crosses the weekend threshold, the change advisory orchestrator opens a parallel approval lane and pages only the required approvers. The ITIL workflow engine records state transitions, and istio virtual service shifts canary traffic only after the final approval event is committed to the sql ledger. Low code dashboards subscribe over WebSocket and repaint every approval state in under 300 ms p95. The event-driven programming model means no polling, no spreadsheet exports, and no cron-driven reconciliation.

The sql ledger and Money engine

The sql ledger is the source of truth for every ITIL state change. We chose PostgreSQL with logical replication into a read-model that the low code dashboards consume. Each event carries a monotonically increasing sequence, a hash of the previous event, and a signature from the istio sidecar identity. The Money cost engine models overtime as integer micro-dollars. For every change request it calculates approver wait time times blended on-call rate, plus weekend multiplier, plus risk-weighted rollback cost. That amount is written as a Money projection to the ledger, so finance can join change approvals to actual overtime payroll without asking for a spreadsheet. We also persist a sql materialized view for CAB reporting, because auditors love materialized views almost as much as they love immutable topics.

The WebSocket and low code approval canvas

The WebSocket gateway is the human-facing edge. Approvers open the low code canvas on a phone, see the live change card, and tap approve. The tap becomes a WebSocket frame, gets validated by the istio ingress policy, and is published to the approval event bus. A projector updates the sql ledger, the Money engine recalculates exposure, and the overtime risk predictor updates the CAB queue. If an approver goes offline, the gateway replays missed events from the audit topic so the canvas catches up without a full page reload. The low code canvas is stateless; all workflow rules live in the orchestrator. That separation is important because it lets us change ITIL approval policy without redeploying the UI.

Event contracts and the event-driven programming backbone

Every approval is an event with a schema registered in the event bus. The bus is partitioned by change id, so all events for a single ITIL change are ordered and replayable. Consumers are idempotent and write their results back to the sql ledger through a transactional outbox. The Money engine consumes the same events but publishes a separate CostProjected event, which the low code dashboards render as a live overtime burn chart. We use istio request-level policies to enforce mTLS, retries, and timeouts between the gateway, the orchestrator, and the ledger service. The event-driven programming model gives us replay, audit, and backpressure without adding a single synchronous RPC between approval steps.

Rollout and results

We rolled out ChangeMesh 3000 in four phases: shadow mode for the sql ledger, canary for the WebSocket gateway, mesh policy for istio, and finally the low code canvas for all ITIL changes. In the first month we reduced median approval latency from 41 hours to 11 minutes, cut unplanned overtime by 38%, and gave finance a daily Money reconciliation that previously took three analysts two days. The event-driven programming backbone handles 14,000 change events per hour at peak. The platform is now mandatory for every production change, including the changes that deploy the platform itself. We are especially proud of that last part.

Operational guardrails

The platform has an SLO of 99.95% for approval events and a p99 of 800 ms from tap to ledger commit. Istio virtual service policies guard every internal call. The overtime risk predictor runs as a sidecar-adjacent service and emits a Money alert whenever projected overtime exceeds the change budget. Low code dashboards show the live WebSocket state, the sql ledger hash, and the current ITIL stage. On-call engineers no longer wait for approvals; they watch the mesh converge.