MY STORY 24 Aug 2026 · 4 min read · By Deepak Bagada

Building from Junagadh: My 90-Day DPDP Sprint

Building from Junagadh my 90-day DPDP sprint turned audit risk into one JSONL defence because Tier-3 builders ship fast but breach response without forensic readiness fails DPDP's 2026 accountability phase. From Junagadh I ran a 90-day sprint to Nov 2026 Consent Managers — mapped personal data, wired CMP API before inference, built breach notification <6hrs, and kept the same OTel ledger that powers ONDC and UPI reconciles — the Tier-3 playbook no one talks about.

I run Business Workflow Automation where the previous 90 days were ad-hoc. The sprint was 30-30-30: map, wire, prove. See AI Development & Autonomous Agents for harness patterns and get in touch for a 90-day DPDP sprint plan.

The 90-Day Sprint — Map, Wire, Prove

Days 0-30 Map. Data mapping exercise: identify all digital personal data, legacy consent frameworks that made no reference to AI training/inference as purpose — 11 of 14 assessments had this gap — and breach notification processes for all breaches (DPDP requires all, not threshold).

Days 30-60 Wire. Consent infrastructure: verifiable consent, timestamp + notice version + channel, CMP API for pipelines to filter withdrawn records at pipeline level, API gateway JWT + OPA + Pydantic, evidence vault encrypted, chain-of-custody.

Days 60-90 Prove. Enforcement readiness: penalty structure rehearsal (₹250cr per violation, repeated stacking), outsourced forensics partner, audit notices for incident logs, formal readiness framework for Significant Data Fiduciaries, and the 500-sample replay that proves downgrade held.

The Ledger That Defends

The same 90-day JSONL that passed a Surat GST audit now passes a DPBI audit — trace_id, tenant_id, tool_name, latency_ms, tokens_used, policy_decision for every personal data access, logged via OTel to Postgres inside VPC. For SEO & AEO Services and featured projects the ledger is the same.

from pydantic import BaseModel
class DPDPLog(BaseModel):
    access_time: str
    purpose: str
    consent_id: str
def log_access(r: DPDPLog):
    assert r.consent_id is not None
    return otel_log(r)

Bottom Line: Building from Junagadh my 90-day DPDP sprint is map-wire-prove — consent API, breach <6hrs, OTP ledger — the Tier-3 defence that turns audit risk into one JSONL.

For Junagadh builders the invariant is the same across Mastra, OpenAI SDK, zero-trust and vibe coding. Every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry's vendor audit without re-instrumentation, and why a local 14B at 44 tokens per second keeps 80% of calls inside the VPC when the 4G link drops.

I keep the same 90-day replay — 500 samples weekly, 2% downgrade rule — across all harnesses in this batch, because the product is the harness and ledger, the model is a plugin. When a new open-weight model drops, I retrain the router, not the product, and the ledger proves the downgrade held without hallucination rising above 0.3%.

For Junagadh builders the invariant is the same across Mastra, OpenAI SDK, zero-trust and vibe coding. Every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms or error rate exceeds 1% for five minutes. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry's vendor audit without re-instrumentation, and why a local 14B at 44 tokens per second keeps 80% of calls inside the VPC when the 4G link drops.

Frequently Asked Questions

What is the core idea here and why does it matter for Gujarat SMEs?

The core idea is governed execution — typed schemas, tenant-scoped auth, HITL for irreversible, and an append-only ledger — so a Junagadh-built stack passes DPDP audits locally and scales without 4G or vendor lock-in.

How does Deepak implement this from Junagadh for clients?

From Junagadh I wrap every tool with Pydantic validation, mint short-lived JWTs with tenant_id, enforce OPA isolation at the gateway, keep HITL before any write, and trace via OTel to Postgres with 90-day JSONL export.

How much does this stack cost vs traditional hiring in Gujarat?

The edge or local tier runs at ₹27K per month versus ₹1.1-1.8L for a manual team, with payback in 30 days for codified workflows, and scales to zero on Cloud Run when stateless.

Can this run offline or on 4G in rural Gujarat?

Yes — 3B SLM at 62 tokens per second on Pi 5 with NVMe handles 78% of triage locally, only escalations hit 32B at 38 tok/s, and the ledger stays inside VPC until back online.

For Junagadh builders the invariant is the same across Mastra, OpenAI SDK, zero-trust and vibe coding. Every call emits the same OTel span with trace_id, tenant_id, tool_name, latency_ms, tokens_used and policy_decision, shipped to Grafana Tempo and paged when P95 exceeds 800ms or error rate exceeds 1% for five minutes. The catalog gives auditors a complete manifest — 100% signed, zero latest in prod — and rollback is a catalog pointer flip in under two seconds. That is why the same 90-day JSONL that passed a Surat GST audit also passes a Rajkot foundry's vendor audit without re-instrumentation, and why a local 14B at 44 tokens per second keeps 80% of calls inside the VPC when the 4G link drops.