The constraint moved
For a decade the constraint on internal tools was engineering capacity. That constraint has largely gone for a specific class of application, and organisations are discovering the next one: nobody agreed who may publish software that touches production data.
The response is not prohibition, which produces the same risk with less evidence. It is a gate that is fast enough to be used.
The five controls
These are the controls we install around a rapid build practice, in order of how often they are missing.
- Identity: the application authenticates against your identity provider and inherits group membership.
- Data boundary: it is written down, per application class, before the first build.
- Code review standard: written at a level a reviewer can apply to generated code in under an hour.
- Publish permission: who may push to production, and what gate precedes it.
- Maintainability: documentation and a handover test, because the builder will eventually leave.
What we refuse
We do not ship a generated application into production without review, we do not deploy where the data boundary is undefined, and we do not run a rollout without a named owner per department. Those three refusals are what makes the speed safe to keep.
Next step
See how we deliver and govern rapid builds, end to end.