Mendix: Avoiding The Sprinkle Or Scramble In Low-Code Governance

Software needs control. Enterprise technology requires control systems that are set to run at an internal level so that maintenance, updates and extensions are deployed in a carefully managed and secure manner. Software also needs a set of control mechanisms to ensure users are only permitted to perform certain actions, to corral defined sets of users inside or outside of sensitive data areas – and to set and enforce policy controls to ensure users’ use of software is within the defined realms of business rules and logic that an organization chooses to operate to. Software development and creation also needs control… and we call all of these processes governance.

Where Does Software Governance Start?

Given that software governance can apply to all the above areas of control – especially the ares concerned with what users can do with enterprise applications and where they can channel and share data with them – it is perhaps prudent to start with software governance applied at the development level itself i.e. who can build what software when, where and how? Professional software developers will typically work within relatively clearly defined boundaries when building software. They have a set of so-called “requirements” that specifes what an application (or networking connection point, or smaller component, or wider operating system function and so on) should be able to do, what data it can ingest, what types or output it should be able to produce and what its defined scope is within the total IT stack that an enterprise runs. In the new world of no-code low-code software development, not every control aspect is necessarily carried through into the user-friendly abstraction layers that users will get their hands on. The clue is in the name: it’s an abstraction i.e. this is software with a certain degree of automated simplification and convenience. Okay yes, more so in no-code than low-code, but the point is made… Linux users know more about their computer system than Windows and Mac users, because they’re closer to the raw ingredients. According to Statista, the global low-code platform market revenue is valued at almost $22.5 billion in 2022 and is forecast to reach approximately 32 billion in 2024. The market is projected to grow with a CAGR of 26.1% over this period. Analyst house Gartner also eyes magic in this space, it suggests that by 2026, developers outside of formal IT departments will account for at least 80% of the user base for low-code development tools, up from 60% in 2021.

Software Governance, Evolved

What all this means is that this breed of increasingly prevalent software needs a more evolved approach to governance. Nick Ford, chief growth officer at Siemens-owned low-code software platform company Mendix thinks that lower code user-centric (sometimes called bottom-up) development has the potential to add a lot of value, but we have to manage and govern it consistently, or it could become more of a risk than an asset. “If potentially anyone across a large organization can build new software applications (or at least some new software features) – free of any guardrails of oversight – you’ll get an explosion of applications. People may well be thrilled that their immediate problems are solved or some of the tedious, repeatable work in their department is now automated. But without the core oversight of a central enterprise software governance function, the business will often fail to spot duplicated core functions, repeated elements and common workflow patterns as they end up being built from scratch again and again,” advised Ford. Add this concern to another core reality here. If nobody checks for governance or policy alignment in enterprise software, there won’t be any way to know or understand the potential security risks of new applications or how compliant they are with the requisite guidance and stipulations laid down by local and global regulations. “If organizations want software development to thrive in a multi-platform strategy, we need four things: oversight, curation, governance and policy management. Within a well-defined framework, a business can avoid duplicate efforts, increase speed and enable the reuse of pre-built components across departments,” stated Ford, speaking to press and analysts in a closed briefing. “Low-code platforms are powerful tools that can massively accelerate the digital ambitions of any enterprise. But let’s remember, CIOs must take a step back and look holistically at how they develop a portfolio of applications/solutions that support their digitization agenda.” Key factors to examine here include the question of whether a low-code application has the potential to make money, whether it could enable a business to consolidate an existing set of more fragmented “point solutions” (software that really only handles one task) and provide a technology proposition capable of addressing broader cross-departmental problems… and whether any new application could be reusable at a wider level in the business. From his perspective inside Mendix, Ford says he understands the appeal of an “all teams go!” approach with a powerful low-code platform, but he advises that investing in the long game is always the smarter play. It will take some time at the outset to establish workflows, governance and oversight – but the business will end up running a faster, more sustainable program that is inherently adaptable and composable.

Avoid Sprinkle-On Governance

“Once all the checks and balances are in place on the right platform, then (and only then) it’s off to the races to build that future state – where everyone is turning their ideas into impactful outcomes over and over again,” enthused Ford. “Governance needs to stop being something you sprinkle in once apps are built to ensure they are compliant and secure. All governance issues include eliminating duplicate work, ensuring the right teams are creating the right applications for the right reasons and managing a full-spectrum software portfolio across an entire enterprise. Governance starts at ideation and should be woven through the entire application lifecycle.” The Mendix team advocate a top-down managed approach to software development to enable bottom-up (including user-driven) development to enable technology delivery across an entire organisation, in a business-led fashion. With so-called fusion teams working in unison comprised of cross-functional domain specialists, inter-departmental alliances and, crucially, software engineering teams working in line with citizen development initiatives, the suggestion here is that more can be achieved. But advises Ford, this requires an adaptive governance model because risk profiles and governance requirements will differ based on the business function, whether the solution is internally or externally facing, the sensitivity of the data it uses and its regulatory compliance requirements etc.

Avoid A Governance Scramble

“Low-code governance is often short-hand for ‘a scramble to control citizen development’, as a reaction to the effects of bottom-up development without guidelines or rules,” said Ford. “But this is a narrow view. True governance in the context of a low-code platform ought to be significantly more impactful than that, not just enforcing policies or ensuring compliance but creating meaningful, planned portfolios of easily-maintained software Successful organisations embed governance and risk functions within each solution delivery team – this acts as the first line of defense, ensuring compliance and addressing any concerns as they arise. Platforms for use by fusion teams across the organization are purchased centrally, therefore they must be able to support the range of risk profiles and governance concerns present across the variety of use cases, operating environments, and target audiences to be addressed across the entire organisation.” The Mednix growth lead concludes by saying that proper, effective and enduring software governance takes low-code as a capability and bolsters it with credibility to deliver value in the enterprise. Over time, it ensures that large portfolios of software built on low-code are compliant, easily maintained and properly managed in order to maximize business value. As wider use of no-code & low-code technologies expands, we will logically need to know more about the provenance of the digital ingredients we put into this mix, what kind of additives and flavor enhancements we feel are admissible and whether or not the end product works well and in a way that doesn’t duplicate a product that has already been created. If we can do all that within external governance guidelines as well, then we may just have a cake worthy of having a few extra sprinkles on top.