diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000..12f7c020
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Require @sothebys/identity team approval for prod changes
+/prod/ @sothebys/identity
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 00000000..95812fc4
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,26 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+This is a simple Terraform example repository designed for use with [Atlantis](https://www.runatlantis.io/) testdrive mode. It contains minimal Terraform configurations across three environments (dev, staging, prod) for demonstrating Atlantis Pull Request automation.
+
+## Repository Structure
+
+- `dev/`, `staging/`, `prod/` - Terraform configurations per environment
+- `bin/a-server` - Local Atlantis server startup script (requires `ATLANTIS_WEBHOOK_SECRET` and `ATLANTIS_TOKEN` environment variables)
+
+## Working with Terraform
+
+```bash
+# Initialize Terraform in an environment
+cd dev && terraform init
+
+# Plan changes
+terraform plan
+
+# Apply changes
+terraform apply
+```
+
diff --git a/bin/a-server b/bin/a-server
new file mode 100755
index 00000000..26ae7154
--- /dev/null
+++ b/bin/a-server
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+export ATLANTIS_GH_USER="bhoggard-sothebys"
+export ATLANTIS_GH_WEBHOOK_SECRET="$ATLANTIS_WEBHOOK_SECRET"
+export ATLANTIS_GH_TOKEN="$ATLANTIS_TOKEN"
+export ATLANTIST_GH_WEBHOOK_SECRET="$ATLANTIS_WEBHOOK_SECRET"
+# export ATLANTIST_GH_TEAM_ALLOWLIST=":plan,:policy_check,@sothebys/identity:apply" 
+export ATLANTIST_GH_TEAM_ALLOWLIST=":plan,:policy_check,@sothebys/nobody:apply" 
+
+atlantis server \
+  --atlantis-url="https://956c-100-38-10-160.ngrok-free.app" \
+  --repo-allowlist="github.com/bhoggard-sothebys/atlantis-example" \
+  --repo-config="$(dirname "$0")/../repos.yaml"
+
diff --git a/infrastructure/helm/.gitignore b/infrastructure/helm/.gitignore
new file mode 100644
index 00000000..ee3892e8
--- /dev/null
+++ b/infrastructure/helm/.gitignore
@@ -0,0 +1 @@
+charts/
diff --git a/infrastructure/helm/README.md b/infrastructure/helm/README.md
new file mode 100644
index 00000000..dc1a98cf
--- /dev/null
+++ b/infrastructure/helm/README.md
@@ -0,0 +1,19 @@
+# Atlantis Helm setup
+
+## Setup
+
+The following environment variables must be defined:
+
+- ATLANTIS_TOKEN - a fine-grained GitHub token - details TBD
+- ATLANTIS_WEBHOOK_SECRET - see https://github.com/bhoggard-sothebys/atlantis-example/settings/hooks
+
+Then run
+
+```bash
+helm upgrade --install atlantis runatlantis/atlantis \
+  --kubeconfig "$HOME/kube_config_cluster.yml" \
+  -f values.yaml \
+  --set github.user="bhoggard-sothebys" \
+  --set github.token="$ATLANTIS_TOKEN" \
+  --set github.secret="$ATLANTIS_WEBHOOK_SECRET"
+```
\ No newline at end of file
diff --git a/infrastructure/helm/ingress.yaml b/infrastructure/helm/ingress.yaml
new file mode 100644
index 00000000..63c5ecd7
--- /dev/null
+++ b/infrastructure/helm/ingress.yaml
@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: atlantis
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: atlantis.lvh.me
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: atlantis
+                port:
+                  number: 80
diff --git a/infrastructure/helm/values.yaml b/infrastructure/helm/values.yaml
new file mode 100644
index 00000000..a99b370a
--- /dev/null
+++ b/infrastructure/helm/values.yaml
@@ -0,0 +1,55 @@
+orgAllowlist: "github.com/bhoggard-sothebys/atlantis-example"
+
+environment:
+  ATLANTIS_WEB_BASIC_AUTH: "true"
+  ATLANTIS_GH_USER: bhoggard-sothebys
+  DEV_AUTH0_DOMAIN: sothelabs.auth0.com
+  STAGING_AUTH0_DOMAIN: sothebys-stg.auth0.com
+  PROD_AUTH0_DOMAIN: sothebys.auth0.com
+  DEV_AUTH0_CLIENT_ID: rhqbwencyHvtCTouEqLd76Iippucb8De
+  STAGING_AUTH0_CLIENT_ID: CDTuWIVBChmrTkHtO4q3cx1cxlTVLW1b
+  PROD_AUTH0_CLIENT_ID: xtFW63CtGXxydb6LGPWYp30FwLncl2oL
+
+ingress:
+  enabled: true
+  ingressClassName: traefik
+  host: atlantis.lvh.me
+  path: /
+  pathType: Prefix
+
+environmentSecrets:
+  - name: ATLANTIS_WEB_USERNAME
+    secretKeyRef:
+      name: atlantis
+      key: basic-auth-username
+  - name: ATLANTIS_WEB_PASSWORD
+    secretKeyRef:
+      name: atlantis
+      key: basic-auth-password
+  - name: ATLANTIS_GH_TOKEN
+    secretKeyRef:
+      name: atlantis
+      key: github-token
+  - name: ATLANTIS_GH_WEBHOOK_SECRET
+    secretKeyRef:
+      name: atlantis
+      key: github-secret
+  - name: DEV_AUTH0_CLIENT_SECRET
+    secretKeyRef:
+      name: atlantis
+      key: dev-auth0-client-secret
+  - name: STAGING_AUTH0_CLIENT_SECRET
+    secretKeyRef:
+      name: atlantis
+      key: staging-auth0-client-secret
+  - name: PROD_AUTH0_CLIENT_SECRET
+    secretKeyRef:
+      name: atlantis
+      key: prod-auth0-client-secret
+
+repoConfig: |
+  repos:
+    - id: /.*/
+      allowed_overrides: [workflow, apply_requirements]
+      allow_custom_workflows: true
+      repo_config_file: standalone/auth0/atlantis.yaml
diff --git a/scripts/setup-env.sh b/scripts/setup-env.sh
new file mode 100755
index 00000000..0049c80c
--- /dev/null
+++ b/scripts/setup-env.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# Outputs an environment-specific variable value based on the project directory.
+# Used as an Atlantis env step command — stdout becomes the variable value.
+# Usage: setup-env.sh <VARIABLE_SUFFIX>
+# Example: setup-env.sh AUTH0_CLIENT_ID → resolves DEV_AUTH0_CLIENT_ID for dev
+
+ENV="${REPO_REL_DIR##*/}"
+ENV_UPPER=$(echo "${ENV}" | tr '[:lower:]' '[:upper:]')
+eval echo "\$${ENV_UPPER}_${1}"
diff --git a/scripts/verify-env.sh b/scripts/verify-env.sh
new file mode 100755
index 00000000..ab4c1ff8
--- /dev/null
+++ b/scripts/verify-env.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+echo "AUTH0_CLIENT_ID: ${AUTH0_CLIENT_ID}"
+echo "AUTH0_DOMAIN: ${AUTH0_DOMAIN}"
diff --git a/standalone/auth0/atlantis.yaml b/standalone/auth0/atlantis.yaml
new file mode 100644
index 00000000..f0ad3e35
--- /dev/null
+++ b/standalone/auth0/atlantis.yaml
@@ -0,0 +1,19 @@
+version: 3
+projects:
+  - name: dev
+    dir: standalone/auth0/settings/dev
+    workflow: custom
+  - name: staging
+    dir: standalone/auth0/settings/staging
+    workflow: custom
+  - name: prod
+    dir: standalone/auth0/settings/prod
+    workflow: custom
+    apply_requirements: [approved]
+workflows:
+  custom:
+    plan:
+      steps:
+        - run: ../../scripts/setup-env.sh
+        - init
+        - plan
\ No newline at end of file
diff --git a/standalone/auth0/settings/dev/main.tf b/standalone/auth0/settings/dev/main.tf
new file mode 100644
index 00000000..a2178ad0
--- /dev/null
+++ b/standalone/auth0/settings/dev/main.tf
@@ -0,0 +1,3 @@
+resource "null_resource" "example1" {
+}
+
diff --git a/standalone/auth0/settings/prod/main.tf b/standalone/auth0/settings/prod/main.tf
new file mode 100644
index 00000000..a2178ad0
--- /dev/null
+++ b/standalone/auth0/settings/prod/main.tf
@@ -0,0 +1,3 @@
+resource "null_resource" "example1" {
+}
+
diff --git a/standalone/auth0/settings/staging/main.tf b/standalone/auth0/settings/staging/main.tf
new file mode 100644
index 00000000..a2178ad0
--- /dev/null
+++ b/standalone/auth0/settings/staging/main.tf
@@ -0,0 +1,3 @@
+resource "null_resource" "example1" {
+}
+