N100FN100F
Published on

Software you can audit six months later

Six months after deploying, somebody asks which version is running, who approved it and why it was built that way. If the answer depends on somebody's memory, the platform is not governed.

Service line Platform Engineering

The six-month test

There is a simple way to tell whether an organisation builds governed software. You pick an application that has been in production for six months and ask five questions:

  1. Which exact version is running right now?
  2. Who approved it going to production, and when?
  3. What requirements did it have to meet, and where are they written?
  4. Why were the important decisions taken?
  5. If the person who built it leaves tomorrow, can somebody else maintain it?

The six-month testFive audit questions answered with no governed lifecycle and with one.PLATFORM · AUDITThe six-month testNO LIFECYCLEWITH A LIFECYCLEWhich exactversion is running?'the latest one, I think'Artefact digestsha256 recordedWho approved the moveto production?'we discussed it in a meeting'Gate signed offwith name and dateWhere arethe requirements?'in an email somewhere'Specificationin the repositoryWhy was itdecided that way?'you would have to ask them'Decision recordnext to the codeCan somebody elsemaintain it?'tricky'Template, statusand logbookNot one answer on the left is a technical failure: the lifecycle is missing.N100F · n100f.com

In most cases the answers are 'the latest one, I think', 'we discussed it in a meeting', 'they were in an email' and 'you would have to ask them'. None of that is a technical failure. The software works. What is missing is the lifecycle: the way of taking an application from idea to production leaving a trace of every step.

Governing is not slowing down

The word 'governance' tends to suggest committees, forms and weeks of waiting. It does not have to be that way. A well-designed lifecycle is almost invisible to whoever works inside it, because most of the steps are automatic and the ones that are not are clear.

What it does demand is discipline in a few things:

  • Every application goes through recognisable phases, and to change phase there is an approval gate with an owner.
  • What is going to be built is written down first.
  • There is a single source for what everybody needs to know: which applications exist, where they live, who owns them.
  • What gets deployed is exactly what was tested.
  • Every step leaves a record.

What this series is about

This series walks through that whole cycle, the way we build it and apply it: why an internal platform is a product, how an application is born, where it gets its truth from, how it is built and deployed without surprises, how it is operated and how failures are learned from, and what role artificial intelligence plays when the rules are set by people.

We start with the underlying question: who is a platform for?

How we apply it: Platform Engineering.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk