Orbit Design System
How I built the design infrastructure that 6 global teams now depend on
Role
Design System Lead
Company
ENGIE Impact
Timeline
18 months
Team
6 product teams, 8 countries

The Origin
Orbit started as a practical response to Jupiter. While designing a complex internal enterprise product, I kept running into the same issue: teams were rebuilding foundational patterns differently, and every new product surface created more inconsistency. What looked like a UI issue was really a missing infrastructure problem, so I named the system after the project that surfaced it.
My Role
I initiated and led Orbit from audit to adoption. I owned the Figma system, component model, documentation standards, contribution criteria, rollout rituals, and governance process. Engineering owned implementation, but I partnered with the engineering lead on ownership boundaries, deprecation decisions, and what made a component production-ready. Product teams contributed use cases, migration feedback, and candidate components through a governed contribution pathway.
Who was involved
Me - Designer
Design system lead covering audit, Figma library, documentation standards, contribution model, governance, and rollout
Engineering lead
Implementation ownership, technical feasibility, deprecation input
Product teams
Adoption, use cases, migration feedback
Designers across six teams
Consumers and contributors; four of six contributed back
Leadership
Approved the workstream, reviewed adoption
New designers
Onboarding beneficiaries
The hidden cost of every team designing alone
When I joined ENGIE Impact, there was no design system. Not an outdated one. Not a neglected one. Nothing. Every designer, on every team, was solving the same problems in isolation: building buttons, modals, data tables, and form patterns from scratch, sprint after sprint, with no shared reference point and no reason to coordinate.
What zero looked like
- No shared tokens
- No component owner
- No production inventory
- No contribution pathway
- No design-engineering agreement
- No governance model
- No migration policy
- No adoption metric
- No documentation standard
- No shared language across teams
The complexity
- Six teams across eight countries
- Different product surfaces
- Different engineering implementations
- OutSystems constraints
- Accessibility requirements
- Production components already in use
- Designers with different habits
- Engineering's fear of maintenance burden
- Leadership wanting standardization
- Teams wanting local flexibility
- Migration risk
The result was organizational drag, not just inconsistency. Engineering kept rebuilding the same components slightly differently for each team. Design reviews became debates about button radius instead of user problems, and new designers spent their first weeks reverse-engineering decisions already made six times elsewhere.
"Design reviews became debates about button radius instead of user problems."
The breaking point was a cross-team audit: I cataloged every component in active use and found it was worse than anyone guessed, four types of fragmentation (visual, behavioral, implementation, ownership). The visible symptom was 30+ button styles in production; the deeper issue was each one encoding different spacing, hierarchy, state, and accessibility decisions, with no shared tokens and no clear owner.
That audit became the document that changed everything, not because it surprised anyone in the room, but because it made the cost visible in a language leadership and engineering could act on.
30+ button variants in production. No shared tokens. No clear owner.
1 token-compliant, WCAG-AA button. Adopted across every product.
The decision to share ownership with engineering
The pitch to leadership was straightforward once I had the audit data. A design system is an infrastructure investment, and infrastructure arguments land well when you can show the compounding cost of not having it. I came to that conversation with three things: the audit findings, an estimate of duplicated design-and-engineering hours per quarter across teams, and a proposed phased build plan with clear milestones. Leadership approved a dedicated workstream.
The harder conversation was with the engineering lead.
"If we build this," the engineering lead asked me, "who owns it when it breaks?"
The concern wasn't philosophical. It was practical. Build time. Maintenance burden. The fear that a centralized component library would become another thing engineering was responsible for keeping alive while shipping products.
That question shaped the entire governance model I built for Orbit. My answer: the system had to be owned jointly, or it wouldn't survive past v1.
Design owns
- Component specification
- Token structure
- Contribution standards
Engineering owns
- Implementation
- A defined seat at the table on any deprecation or structural change
I also made a commitment I had to keep: that Orbit would reduce engineering work, not add to it. Every component we shipped had to be more complete, more accessible, and better documented than what it replaced. That commitment became the standard I held every Orbit contribution to for the next 18 months.
Audit findings
The evidence of fragmentation, quantified
Cost estimate
Duplicated design + engineering hours per quarter
Phased build plan
Clear milestones, joint ownership model
How I modeled the cost
I treated the cost model as directional, not finance-grade. I estimated repeated design, engineering, QA, review, and onboarding effort across teams, then used that model to show leadership that fragmentation had a recurring operational cost. The point was not to prove an exact dollar figure, it was to make the invisible drag visible enough to justify a dedicated workstream.
Reading the room
Leadership
Cared about cost, speed, consistency, and scale, so I led with the cost model and phased plan.
Engineering
Cared about maintenance burden, implementation, and ownership, so I led with the ownership agreement.
Designers
Cared about flexibility and usability, so I led with a complete, well-documented kit.
Product teams
Cared about shipping without disruption, so I led with the supported migration path and named owners.
The decision to deprecate components already in production
Orbit's first major governance crisis came before it was even fully adopted.
Six months into the build, two teams flagged that year-old production components were being deprecated. The replacements were better (more accessible, more consistent, token-compliant), but migration meant unplanned engineering work. Their request was predictable: can we just keep both?
"The moment you allow parallel tracks, the system stops being a system. It becomes a suggestion."
I chose not to support parallel tracks: keeping both would have taught teams that Orbit was optional. Instead, I set a 90-day migration path: documentation, engineering support hours, and a named owner per team. We made it as easy as possible. We didn't make it optional.
Not because the cost wasn't real, but I'd watched design systems fragment into "legacy" and "current" sections treated as equals, and teams under delivery pressure always choose the path of least resistance.
One team pushed to keep its existing form components since migration wasn't planned in the sprint. We used that case to pressure-test the model: what support did teams need, what timeline was realistic, what happened if we allowed exceptions?
Every team made it. And the pattern held: no deprecated component ever came back.
Two teams flag deprecation conflicts
90-day migration window opens. Migration guide published. Named owners assigned per team.
100% migration complete. Zero deprecated components reinstated.
- 1Border color inconsistency
- 2Missing focus state
The decision to mandate adoption across all six teams
Leadership required Orbit adoption across all six product teams. I want to be honest about what that means, and what it doesn't. A mandate gets you compliance. It does not get you trust, contribution, or a system that teams feel ownership over. Those things had to be earned separately, team by team.
Governance with a contribution pathway
Every component in Orbit had a readiness state: Exploratory, Candidate, Stable, Deprecated, with clear criteria for moving between them. Critically, I created a contribution pathway so teams could propose missing components rather than going rogue and building their own. Without a contribution pathway, a mandated system breeds resentment. With one, the system becomes a shared resource teams feel invested in rather than subjected to.
Embedded rollout support
For the first three months of each team's adoption, I ran standing weekly design reviews with their designer. Not to approve their work: to catch cases where Orbit wasn't serving their needs and either fix the component or create a new candidate. Adoption felt less like compliance and more like collaboration.
Visible metrics
I tracked component adoption rates by team and shared them in quarterly design reviews with leadership, not as a performance report, but as a signal of where the system needed to grow. Teams saw their contributions being prioritized in the next Orbit cycle.
Proposed, under evaluation
In review, seeking adoption
Production-ready, governed
90-day migration window
- 1Color tokens
- 2Button
- 3Input
- 4Dropdown
- 5Card
- 6Table
- 7Form controls
Designing Orbit as a design-engineering contract
The v1.0 spec sheet above reads as a single reference image, but every line on it was a decision that design and engineering had to agree on together. Here's what that agreement actually covered.
Token naming & semantics
A primary scale built from #007ACD (50–900), layered over the preserved OutSystems neutral scale (0–10). Semantic tokens map background, text, border, and interactive states on top of the primitive scale, alongside feedback tokens for success, warning, danger, and info. Radius runs from --radius-none (0px) to --radius-full (999px) on a 4px spacing scale.
Component families
Seven families shipped in v1.0: Button, Input, Dropdown, Card, Table, Toast, and Form Controls (checkbox, radio, toggle, tag).
Component states
Every component was specced across its full interaction range, Default, Hover, Focus, Active, Error, Disabled, and a Success/Valid state where applicable, at Small, Medium, and Large sizes. Nothing shipped as Stable without every state documented.
Accessibility rules (WCAG 2.1 AA)
Every Stable component had to meet WCAG 2.1 AA: visible focus states, sufficient color contrast, explicit label association, and clear error identification. Conformance was validated through manual audit.
Usage guidance
Each component carried a readiness state, Exploratory, Candidate, Stable, or Deprecated, so teams could tell at a glance whether it was safe to build on, still evolving, or on its way out.
OutSystems constraints
Orbit had to stay backward compatible with the OutSystems platform it was built on. The neutral scale was preserved rather than replaced, and every component shipped with sharp 0px edges as the default, with a single token swap, --radius-md at 4px, as the opt-in rounded override.
Figma documentation standards
I owned the Figma library end to end: component structure, naming, and the documentation standards a contribution had to meet to move from Candidate to Stable.
Engineering implementation expectations
Engineering owned implementation. I partnered with the engineering lead to define the ownership boundaries between design and engineering, and the criteria that made a component production-ready, not just visually correct.
Deprecation handling
A deprecated component got a 90-day migration window, a written migration guide, allocated engineering support hours, and a named owner per team. No parallel tracks, no permanent exceptions.
What I'd do differently
I'd pull engineering into authorship earlier: specifically around token semantics and the deprecation model.
The token architecture I designed was sound, but it was designed by a designer. When we hit the first major deprecation cycle, the gaps became visible: the naming conventions I'd chosen made sense to design, but created confusion for engineers mapping tokens to implementation. We resolved it, but the resolution took weeks of back-and-forth that a collaborative authorship process at the start would have eliminated.
The lesson wasn't that designers shouldn't lead design systems. They should. It's that "lead" doesn't mean "design in isolation and hand off." The token layer is where design systems live or die for engineering teams, and that layer needs engineering's fingerprints on it from week one.
If I were building Orbit again, the first three working sessions would be joint: designer and engineer, building the token semantics together before a single component was specced. Adoption would have been faster. Deprecation would have been smoother. And the engineering lead who was the hardest person to convince at the start might have been the first advocate.
What Orbit made possible
Orbit isn't the product. It's what made the products possible to build at scale.
It took 12 months to reach full adoption across all six teams. Once it did, three major product areas shipped significant feature updates with design teams that were half the size they'd been in previous cycles, because they weren't rebuilding foundations on every sprint.
Problem to outcome
Every outcome below traces back to a named problem from the audit that started this.
- Duplicated effortshared reuse
- Inconsistent UIone standard set
- Unclear ownershipgoverned contribution with named owners
- Slow onboardingproductive in week one
- Reviews stuck on UI basicsreviews moving up to product problems
- Engineering reimplementationa shared implementation contract
Measured
Tracked directly: adoption, migration, and consistency outcomes.
Estimated (directional model)
Not finance-grade. Built to make a recurring, invisible cost visible enough to act on.
"That's not a design system success story. That's an engineering efficiency story and a product quality story."
That's the measure I care about. Not the component count. The question I ask about any design system is: did it make the organization faster and more coherent? For Orbit, the answer is yes.