SOA Governance@work

SOA Governance is hot these days. It’s widely believed that governance is required if you want to succeed with SOA, which is a correct assumption. It’s ironic though that agility and simplicity comes at the cost of complexity. That almost seems contradictory- the efficiency that SOA offers breeds complexity – so what are you to do? Governance is the answer. Manage the complexity in a controlled manner and the benefits SOA offers are much more obtainable.

However, customers, analysts, vendors, bloggers…everyone seems to be talking about governance, so how do you get through the FUD to make an accurate buying decision on supporting your governance needs? Here are 5 tips for buying governance.

Tip #1: You can’t buy governance!

That’s right, you can’t buy governance. Governance is a process, not something you buy. The technology that vendors are offering out there should be used to automate the governance process, but technology can’t solve the problem on its own. In order for governance technology to be effective, you need to first establish what it is you want to govern and how you are going to govern it. The technology should then be applied to automate that process. That being said, the rest of the tips will focus on identifying the right technology.

Tip #2: Look for a vendor that can explain how their technology is applied

This one is key. You need to look for a vendor that not only has governance technology to offer but can also walk you through how their technology is applied to the governance process. Don’t go for a vendor that only explains what their technology does. For example, many vendors will tell you that you need a registry/repository for visibility. While this is true, you also need to understand where in the lifecycle it’s important to have that visibility and how it’s achieved. Is it a manual process, which reduces the possibility of adoption? Or is there some way to automate the collection of artifacts at different triggering points in the lifecycle? Remember, you’re trying to automate the process as seamlessly as possible, not create more work.

Tip #3: Beware of the kitchen sink!

Trying to establish control over your SOA is hard enough without making it more complex by adding a truckload of more software. Don’t look at solutions that make you feel like you need to buy the whole store to get the one comfy chair you really need. Doing so only has you buying technology for technology sake without the understanding of how to apply it and when. This ultimately leads to failure for the governance program because it’s too complicated. It’s rare you’ll need a whole giant stack of products to address governance, at least in the beginning. The KISS principle definitely applies here. Don’t try to over govern early on.

Tip #4: Start small and expand

When looking at governance, focus on what is causing you immediate pain or frustration and then expand from there. Make sure you invest in the right technology that can not only solve your tactical pain, but can also help you strategically down the road when looking at the bigger picture. For example, excel spreadsheets might work fine in the near term for cataloging assets, but what about long term? How well will it evolve as you evolve? Start in the area that you see the most value to your governance program and then expand as your needs expand or as you start to realize the value of adding additional components.

Tip #5: Look for an integrated solution

Having an integrated solution just makes the governance process that much easier. You want to eliminate as many manual points as possible, as governance should be something under the covers that gets applied to the environment. This will enable higher rates of adoption for your governance program as it appears less disruptive to those that are being governed. Look for vendors that provide a solution whose technology components are integrated to support the lifecycle from end to end, regardless of the number of products they throw at you.

Keep these 5 tips in mind when evaluating purchasing decisions surrounding governance. Remember that governance is more people and process then it is technology, so make sure the technology you choose provides the best support for  your culture and process.

Welcome to my blog on SOA Governance!  I, and whoever I can con into contributing, plan to fill the pages of this blog with material, best practices, tips, and insights into different areas related to SOA Governance.  I've been working on various focus areas of governance since 2000 with the last 3 focused on SOA Governance and hope to pass on some of those experiences here.  At BEA I had enlisted the help of Bob Rhubart to publish a series of blogs called SOA Governance@work with the same purpose, and I hope to carry on that series here. 

If you'd like to take a look at some of the prevoius topics tackled when this series was part of BEA, here is where you can find them:

• Security: SOA's Velvet Rope
• SOA Governance is a matter of balance
• Survey Says... SOA Governance is Happening
• The SOA Governance Prescription
• Wielding the Carrot and the Stick
• Peeling the Policy Onion
• Policies: The Nuts and Bolts of SOA Governance
• SOA Visibility: Keeping the Wheels On

A couple of colleagues of mine and I had a conversation not too long ago  about  whether you could do SOA Governance without technology.  I took the stance that governance was more about the process and supporting culture then the technology.  My colleagues had a somewhat differing opinion that you could not accomplish governance without supporting technology. 

My argument was based on the fact that governance is about affecting behavior in order to establish a sense of control over the environment.  At the macro level, governance is a process that enforces standards, guidelines, and controls with the purpose of ensuring your SOA stays aligned with the business goals and objectives.  It's much like building a house.  There is a specific process that must be followed: obtain permits, lay pipe, create foundation, build frame, add roof, etc.  If you don't follow this process, you end up with a building like the one in the image.   

However, in order to ensure success of your governance efforts, and hence your SOA, a supportive organizational culture must be present.  Everyone involved in the process must be aware of the business goals and objectives.  Building SOA without an understanding of the business is like jumping out of a plane and then trying to learn how to open the parachute.  Both end up with disastrous results.  Fostering the right culture in support of the governance process greatly increases your chance for success. 

As my colleagues pointed out, however, SOA governance requires a bit more, which is where the technology comes in.  One of the goals of SOA is to provide business agility for responding to change faster.  While implementing organizational change and enforcing process can certainly keep SOA aligned with the business, it can sometimes defeat the goal of agility.  This is one spot where technology like a repository and registry can help.  Providing visibility into assets and their dependencies while automating their progression through the different stages of the lifecycle is critical for obtaining the goal of business agility.  Without visibility, there is no reuse, and automation of the lifecycle can greatly reduce the need for time intensive, manual compliance reviews, as these can be auto validated in order to progress SOA projects faster. 

There's also the notion of runtime.  Application of the governance process is very intensive in the lifecycle stages leading up to deployment, but what about after the assets are deployed?  This is where governance tends to breakdown, so a heavier emphasis on technology is needed.  Governance doesn't stop after version 1 of an application or service is deployed.  Your SOA needs to ensure everything operates within the policies defined by the business requirements, so technology that automates this enforcement at runtime is essential.  Additionally, your SOA is going to evolve, so you need the ability monitor the behavior of the elements of your SOA to not only ensure everything operates as intended, but also identify areas of improvement.  This can help the business understand where additional investment needs to be made. 

So after my discussion with my colleagues, who did we think was right?  It turns out that we're both right.  Process and organizational culture are key to successful SOA governance, but so is technology in making it more efficient, automated, and ensuring SOA evolves in the right direction.