When the Contract Becomes Code: Inside Eeshan Agarwal's Quiet Revolution in Enterprise Platform Engineering
At Vanta, every commercial agreement must become a living, enforceable part of the product—and one engineer has spent years making sure the seams never show
Close a deal with an enterprise customer, and two clocks start ticking. Finance records a signed agreement with a dollar figure attached. The product has to interpret something far more granular: a web of permissions that determines which teams unlock which capabilities, how usage is metered, and what happens the moment a contract lapses. When those two versions of reality drift apart, the fallout ranges from confused customers to compliance exposure.
Eeshan Agarwal has built his career on preventing exactly that drift—first as one of Vanta's earliest engineers and now as a senior engineering leader at the platform that roughly 16,000 organisations rely on for security and compliance.
His remit is unusual. He oversees the architecture that links a commercial promise to the product behaviour it demands — spanning how the platform verifies identity and resolves access, how contracts are decomposed into pricing logic and feature gates, and how provisioning rules propagate across customer environments. Billing, identity, and access governance typically live in separate engineering silos. Under Agarwal, they converge because he has learned that getting one right without the other is how silent failures take root.
Two Records of the Same Promise
Every enterprise transaction creates tension. The contract is a single artefact — a PDF, a signature, a row in the CRM. But the product cannot act on a contract as a whole. It must break it down into hundreds of discrete decisions: this role receives read access; that business unit lands on the growth tier; a partner's sandbox shuts off in ninety days. One record is prose. The other must be executable logic. Agarwal's insight is that the two systems required to bridge this gap — identity resolution and commercial entitlement — are not separate concerns. At scale, they are the same question viewed from opposite sides.
'If the product doesn't reflect what the business committed to, every new SKU, every custom deal, and every mid-cycle upgrade opens a crack,' Agarwal says. 'And cracks compound'.
The Architecture Underneath
Agarwal's trajectory at Vanta mirrors the company's evolution. He moved from product infrastructure into the shared platform layer, then took ownership of the identity and commercial systems — rising to the top of the individual-contributor track before being asked to lead the teams responsible for those systems. By the time the company's annual recurring revenue crossed $300 million (£223 million), the billing, entitlement, and identity architecture beneath it was largely his design.
He was the driving force behind the billing and entitlements stack, covering pricing computation, package resolution, and transaction processing across currencies. He also designed its core abstractions to accommodate commercial models the company had not yet imagined.
When Vanta later moved to consumption-based pricing and restructured its packaging entirely, the abstractions Agarwal had put in place made the transition possible — each new commercial model slotted into the framework he had designed rather than requiring a new one built from scratch. On the identity side, he replaced the platform's original magic-link login with a federated stack — SSO, SAML, and SCIM-driven provisioning — so that changes in a customer's employee directory automatically propagated into their Vanta environment.
'Most people treat billing and identity as separate disciplines,' Agarwal says. 'One answers who is making the request. The other answers what the commercial relationship entitles them to. A product cannot behave correctly without resolving both questions.'
Where Revenue Logic Meets the Control Environment
One of the sharpest design decisions Agarwal has made is to define what the billing system should deliberately not do. Coupling billing directly to feature access means every pricing adjustment risks triggering an unintended permissions change.
In a platform whose entire purpose is security and compliance, the boundary between what a customer paid for and what the product permits is itself an auditable control. Grant a capability the contract never included, and the gap is not a billing nuisance — it is a control deficiency that cascades into the customer's own audit findings.
The recognition that revenue infrastructure and the control environment are not merely adjacent but overlapping earned Agarwal a place on the judging panel for the SC Awards Europe 2026, the cybersecurity industry's longest-running independent awards program. There, he evaluates vendor submissions in identity and access management, access governance, and AI security — the same categories he engineers from the inside. It is an uncommon vantage point: a practitioner who builds these systems sitting in judgment of the vendors who sell them. He has also spoken about platform architecture at PlatformCon 2026 and DeveloperWeek, drawing on the same body of work.
The Discipline of Boring Correctness
'The ambition is boring correctness,' Agarwal says. 'A customer should never need to investigate whether their contract, invoice, and the product's behavior align.'
That standard becomes harder to maintain as commercial complexity increases. Vanta now sells through self-service purchases, negotiated enterprise agreements, bundled product suites, and consumption-metered add-ons. Each mechanism is another vector for the product's understanding of a customer to diverge from the commercial truth. The infrastructure Agarwal designed prevents that divergence from compounding — it determines whether a novel deal structure requires custom engineering or simply fits a shape the platform already knows.
Beyond Vanta, Agarwal advises enterprise software founders in India through the TiE network and collaborates with teams from IIM Ahmedabad and with Bangalore-based SaaS ventures scaling into global markets. The conviction he brings to that work is the same one that runs through his platform engineering: a contract is not a document that gets signed and filed. It is a running system, and the engineering obligation is to keep it honest.
Connect with Eeshan Agarwal on LinkedIn for more on enterprise platform architecture and compliance infrastructure.
© Copyright IBTimes 2025. All rights reserved.
- Recommended For You
