Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Company as Code

blog.42futures.com

Post reply on HN
Print view View original

51–60 of 135 posts

Re: Company as Code

#51

Post by alexsmolen »

I love this idea despite the real world operational challenges - most people with governance responsibilities in organizations don't want to code, and code is often too precise to model messy social/organizational context without constant tweaking, tending, and exception management.

I'm an advocate for bringing software culture to GRC, or as it's sometimes called “GRC Engineering”. While there are plenty of products to automate evidence generation for auditors, the underlying policies and documents that they prescribe are usually still old-school Word/PDF-style boilerplate junk.

I'm working on an open source project for security policies/processes/standards that map back to underlying frameworks (e.g. SOC 2, GDPR, ISO 27001, etc.) Docs are Markdown with YAML frontmatter metadata, interlinks generated automatically, site is published via GitHub actions.

The code is at https://github.com/engseclabs/graphgrc, and you can see an example published site here https://graphgrc.engseclabs.com.

Would love to know if others find it useful or have built similar systems.

Re: Company as Code

#52

Post by stego-tech »

This is not a new or novel idea. I proposed such a thing at the start of my career in tech, and repeatedly propose it when I feel I have ears willing to listen.

The problem - and I do mean the problem, the only problem - is the threat this poses to power dynamics in the organization.

Compliance people do not benefit from their outputs being readily searchable and indexed like this, because it means there’s less need for them. Executives and leaders do not benefit from this, because they’re increasingly hired specifically because of their knowledge of various compliance frameworks. The people whose power derives from this knowledge and expertise are overwhelmingly the people in charge of the company and its operations, and they benefit more from blocking it outright than implementing it.

Don’t get me wrong, I love this idea. I love transparency in organizations, because it makes it infinitely easier to identify and remediate problems beyond silo walls. It’s peak cooperation, and I am all for it.

I also do not see it happening at scale while competition is considered the default operating mode of society at large. That said, I would love to work for an organization placing importance on this degree of internal cooperation. I suspect I’d thrive there.

Re: Company as Code

#53

Post by Terretta »

alexsmolen wrote: post #51

I love this idea despite the real world operational challenges - most people with governance responsibilities in organizations don't want to code, and code is often too precise to model messy social/organizational context without constant tweaking, tending, and exception management. I'm an advocate for bringing software culture to GRC, or as it's sometimes called “GRC Engineering”. While there are plenty of products…

> I'm working on an open source project for security policies/processes/standards that map back to underlying frameworks (e.g. SOC 2, GDPR, ISO 27001, etc.) Docs are Markdown with YAML frontmatter metadata, interlinks generated automatically, site is published via GitHub actions.

> Would love to know if others find it useful or have built similar systems.

Yes, to both for over a decade now, and by now there are many so one doesn't need to rewalk the whole path, some are developed in open on GitHub.

Commercial firms have built on that for live monitoring of the mappings, although don't scratch at that too hard, it's generally mostly (a) self-selected subsets of controls, and (b) manually self-reported at the end of the day.

Product examples: https://delve.co or https://safebase.io/products/trust-center

Applied example: https://trust.openai.com

Have you Googled this or talked to large firms (e.g. banks) that care about avoiding footfalls with regularly scheduled regulator exams? Writing your own shows you grok the concept, many need (well paid!) help applying something off the shelf or from OSS.

Re: Company as Code

#54

Post by ineedasername »

There’s plenty of software that does this sort of thing, often industry specific but plenty that aren’t. You don’t see it “as code” in the raw like this article wants mainly because a company doesn’t deal with this information in such a non-integrated way, they do so as part of a more integrated whole. Monolithic ERP suites are probably the best example, and when done well it really does make a whole host of things easier and more seamless, like compliance modules that run defined routines that track with policy as implemented in operational modules.

Re: Company as Code

#55

Post by bonsai_spool »

dmd wrote: post #38
zjaffee wrote: post #34

Isn't this essentially just trying to reinvent ERP (i.e. what SAP has built a 207 billion dollar company at time of writing on and 90% of fortune 500 companies along with endless other large organizations use). One can argue that ERP as code is higher value than whatever it is right now, but to act like this is a totally new idea is insane.

I worked in a place where basically everything that happened in the company was implemented as actions within Lotus Notes. While the choice of implementation and performance were abysmal (Notes was a great/the only choice when the decision was made but 25 years later not so much), the actual idea was amazing and it worked extremely well.

> the actual idea was amazing and it worked extremely well.

What do you think are the reasons it worked so well? Any anecdotes of why it was so effective?

Re: Company as Code

#56

Post by d4mi3n »

chrisjj wrote: post #31
arnvald wrote: post #10

It's all cool as long as you keep all of this up to date, and that requires a lot of scrutiny and discipline. Once I had to go through a security audit at a job I had. Part of it was to show managing secret keys and who had access to them. And then I realized that the list of people who had access to one key was different than the list of the code owners of the service I was looking at, which was yet different than t…

> 3 different sources of truth about ownership I see only 1. Admin, access ownership.

I always thought of this as authority, accountability, and responsibility of a thing. Ideally one group or person has all three. In practice you’ll have many entities with some combination of the three.

Re: Company as Code

#57

Post by djeastm »

Massively complex cells of living organisms have their entire functionality encoded in DNA, so why can't a business encode their functionality, too?

Re: Company as Code

#58

Post by graybeardhacker »

Two major factors I see a impediment to this: 1. Most management doesn't understand it and therefore won't champion it. 2. Those few that do understand it will resist it because it reduces the need for management and process.

This is similar to the Bible being in a dead language only understood by priests.

But how amazing would it be if everything from company policy to product specifications was in a format that could be programmatically accessed and tracked? When/if you needed a document you would access it from an artifactory where it had been generated and versioned automatically?

It may very well be that LLMs will push this idea to the forefront. PDFs and Word Docs suck for AI interaction. As we incorporate LLMs into our businesses it might be a natural progression to move toward databases, LaTex, code and source control for documentation and policy.

Re: Company as Code

#59

Post by jbs789 »

squeefers wrote: post #8

I suspect hes designed a system for HIS company, which is in a data heavy industry. this doesnt apply to most other types of company, and I suspect when he tries to actually do it, it falls apart when he tries to define any requirement or obligation that stems from legislation. If the law was a coherent and unambiguous specification, thered be no problem, but the reality of it is messy and not so easily defined.

Made me laugh bc you’re right - there are a whole host of decisions that are better left undocumented and ambiguous.
Post reply on HN