Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Company as Code

blog.42futures.com

Post reply on HN
Print view View original

11–20 of 135 posts

Re: Company as Code

#11

Post by vlfig »

Eminently doable, yes.

Two notes:

- I'm not convinced the graph is necessarily cyclic. Often two codependents are actually dependent on some common bits and otherwise independent.

- this is essentially deterministic propagation of configuration (think dhall, jsonnet, etc) plus reconciliation loops for external state, terraform style — not dissimilar to how the rest of CI/CD should operate, in fact my view is this is an extension of CI/CD practices up the value stream.

I'm definitely strive for something like this when possible.

Re: Company as Code

#12

Post by amelius »

> but a living, breathing digital representation of our company

It is breathing already, in the form of humans doing it.

No need to transform it into a static inflexible code thing.

Re: Company as Code

#13

Post by captn3m0 »

mhitza wrote: post #2

The images really detract from the subject. I've used to do something like this, on a smaller scale and dubbed it "organization as code". As long as you have good enough providers for Terraform/Pulumi you can declaratively specify a lot of the interconnected stuff in a company. I built this around GitHub as the indentity provider as my interest was declaratively defining repository access control, while also being ab…

I've done the same thing and I would not call it anywhere near org-as-code either. An organization is much more than a list of responsibilities, people, and compliance requirements.

For the latter, we already have policy-as-code tooling that actually works.

Re: Company as Code

#14

Post by danielrothmann »

Thanks for sharing!

I wrote this post some time ago, and more recently built a thing to do roughly this for my small business: https://github.com/42futures/firm

Had it in practice for about 4 months now and happy so far. It works for me, at my small scale. Hoping to share a follow-up with lessons learned soon.

Re: Company as Code

#15

Post by CountVonGuetzli »

hkhanna wrote: post #7

I do this, more or less, for my small law firm. Employee and client information are stored in Recfiles and accessed with GNU Recutils. Adding or changing is a pull request, and all sorts of GitHub actions run. Works pretty well!

Wat, how have I never heard of this! Very cool. Do you have any insights you could share on your own setup, what worked well and what didn't? Are you just storing information in plaintext, or do you use some visualization libraries to make consuming the information a bit easier as well? Very curious about your setup.

Re: Company as Code

#16

Post by mhitza »

captn3m0 wrote: post #13
mhitza wrote: post #2

The images really detract from the subject. I've used to do something like this, on a smaller scale and dubbed it "organization as code". As long as you have good enough providers for Terraform/Pulumi you can declaratively specify a lot of the interconnected stuff in a company. I built this around GitHub as the indentity provider as my interest was declaratively defining repository access control, while also being ab…

I've done the same thing and I would not call it anywhere near org-as-code either. An organization is much more than a list of responsibilities, people, and compliance requirements. For the latter, we already have policy-as-code tooling that actually works.

Might be a second language thing. Organization for me is stronger related to the root word organize; label, classify, cluster, etc. than something pertaining to processes and procedures.

Re: Company as Code

#17

Post by 1dom »

I always felt the idea of trying to align your code, policy, software and infrastructure so it's easy to do compliance is the bread and butter of devops and devsecops in a regulated environment,

Is this an article by someone who's just done ISO 27001 for the first time and realised that?

Re: Company as Code

#18

Post by sshine »

amelius wrote: post #12

> but a living, breathing digital representation of our company It is breathing already, in the form of humans doing it. No need to transform it into a static inflexible code thing.

You're citing the article mid-sentence. The full sentence is:

> Imagine if we could represent our entire organisational structure programmatically instead—not a static picture, but a living, breathing digital representation of our company that can be versioned, queried, tested, and automatically verified.

So yeah, the organisation is living and breathing by virtue of the humans inside of it.

But the representation of its organisational structure refers to a picture of an org chart.

Non-tech people also aspire to have the entire org structure represented digitally.

But in static, proprietary binary formats in file repositories that can only be manually queried.

Our code is already checked into version control and can be programmatically accessed via CI, agents, etc. Our software production environments can already be queried programmatically via APIs. Our issue trackers have hooks that react to support tickets, pull requests, CI. Then there's an airgap where the rest of the org sits with Word documents and pushes digital paper around. Artifacts delivered to customers that must be manually copied, attached, downloaded by hand.

The dream is that modern software development practices would propagate throughout companies.

Automate all the things!

Re: Company as Code

#19

Post by Shank »

> However, when describing and managing our company, we resort to digital paper and tidbits of info distributed across people in the building.

The perception that ISO/IEC 27001:2022 is simply an exercise in document creation and curation is frustrating. It is not, but an auditor cannot be in your company for a year or three, so the result is the next best thing: your auditor looks at written evidence, with things like timestamps, resumes, meeting minutes, agendas, and calendars, and concludes that based on the evidence that you are doing the things you said you're doing in your evidence reviews and interviews.

The consequence if you are not doing these things happens if you get sued, if you get yelled at by the French data protection regulator, or if you go bankrupt due to a security incident you didn't learn from, and your customers are breathing down your neck.

All of the documentation in the world doesn't mean you actually do the things you write down, but we have to be practical: until you consider these things, you aren't aware of them. You can read the standard and just do the best practices, and you'll be fine. The catch is that if you want the piece of paper, you go to an auditor, and people buy things because that paper means that there is now an accountability trail and people theoretically get in trouble if that turns out to be false.

It's like the whole problem with smart contracts is that you can't actually tether them to real world outcomes where the smart aspect falls apart (like relying on some external oracle to tell the contract what to do). Your customers care about ISO because your auditor was accredited by a body like ANAB to audit you correctly, and that reduces the risk of you botching some information security practice. This means that their data is in theory, more safe. And if it isn't, there is a lawsuit on the other end if things go awry.

Re: Company as Code

#20

Post by jesucresta »

I feel like this is kind of missing the point that companies are mainly a group of humans and their roles and responsibilities matter to them emotionally. Managing those expectations and feelings can only be done by other humans that feel empathy (good managers) and abstracting such relationships onto something that can be "versioned, queried, tested, and automatically verified" might create a shitty soulless place to work.
Post reply on HN