[dead]
Company as Code
61–70 of 135 posts
Re: Company as Code
#62I think the closest that this has come is in the form of GitLab, which pretty famously did a ton of the corporate work in the format of a very open Handbook ( https://handbook.gitlab.com/ ) In the early years, it was extremely, extremely open and comprehensive. I've definitely looked through it when I wasn't sure how to handle something at work.
That's pretty cool. Wonder if it is deployed and updated religiously still. If they wanted to deploy an 'Agent' worker that source is goldmine for context.
Re: Company as Code
#63I think the closest that this has come is in the form of GitLab, which pretty famously did a ton of the corporate work in the format of a very open Handbook ( https://handbook.gitlab.com/ ) In the early years, it was extremely, extremely open and comprehensive. I've definitely looked through it when I wasn't sure how to handle something at work.
And that site is available as a git repository - on Gitlab of course:
Re: Company as Code
#64>Reimagining organisational structure *for the digital age.*
If you're just now thinking about it in this context, then you're about two decades too late.
Re: Company as Code
#65I think the closest that this has come is in the form of GitLab, which pretty famously did a ton of the corporate work in the format of a very open Handbook ( https://handbook.gitlab.com/ ) In the early years, it was extremely, extremely open and comprehensive. I've definitely looked through it when I wasn't sure how to handle something at work.
That's pretty cool. Wonder if it is deployed and updated religiously still. If they wanted to deploy an 'Agent' worker that source is goldmine for context.
I don't know about "religiously" but as of right now it was last updated 16 minutes ago:
Re: Company as Code
#66I love this idea despite the real world operational challenges - most people with governance responsibilities in organizations don't want to code, and code is often too precise to model messy social/organizational context without constant tweaking, tending, and exception management. I'm an advocate for bringing software culture to GRC, or as it's sometimes called “GRC Engineering”. While there are plenty of products…
> I'm working on an open source project for security policies/processes/standards that map back to underlying frameworks (e.g. SOC 2, GDPR, ISO 27001, etc.) Docs are Markdown with YAML frontmatter metadata, interlinks generated automatically, site is published via GitHub actions. > Would love to know if others find it useful or have built similar systems. Yes, to both for over a decade now, and by now there are many…
In my research I haven’t come across the prior art you suggest exists. The trust centers you linked aren’t fungible with what I’m building with GraphGRC. The idea is to make all your security docs just a GitHub repo with structured markdown that permits useful automation (e.g. generating linked internal site, validating all docs have been “reviewed” annually by checking metadata, change control via PR, etc.)
There are plenty of GRC products out there and are popular for good reasons, but I don’t think any of them are Git/Markdown/developer-first.
Re: Company as Code
#67I would probably adapt a slightly different strategy/structure... probably using a git repository with markdown files and a mix of front-matter and TS with a DSL library for rules processing.
The cold storage is a combination of directory structures and markdown files with appropriate front-matter. This could then be queryable directly, or via normalization into a database that represents the same data. By being markdown, you can write rules/policies in a longer/legalize format that Management/HR and Employees can read and understand... port to web layouts for looking at and searching while having a structure that is reasonably developer friendly... the relationships would be similar, but each entity would be represented with a markdown file with its' own front matter and references to other documents.
Just my own thoughts on this.
Re: Company as Code
#68Two major factors I see a impediment to this: 1. Most management doesn't understand it and therefore won't champion it. 2. Those few that do understand it will resist it because it reduces the need for management and process. This is similar to the Bible being in a dead language only understood by priests. But how amazing would it be if everything from company policy to product specifications was in a format that cou…
The New Testament is actually in Greek, if you go to any church in Greece they are reading from it in the original language and people understand it fine.
Re: Company as Code
#69isn't this what HRIS/ERP systems do under the hood? or am I missing something here?
Re: Company as Code
#70This is not a new or novel idea. I proposed such a thing at the start of my career in tech, and repeatedly propose it when I feel I have ears willing to listen. The problem - and I do mean the problem, the only problem - is the threat this poses to power dynamics in the organization. Compliance people do not benefit from their outputs being readily searchable and indexed like this, because it means there’s less need…
> The problem - and I do mean the problem, the only problem - is the threat this poses to power dynamics in the organization.
And expertise, to be fair. Documentation as code is what we in the software industry call testing/type systems. The vast majority of developers cannot even write a good test for their code (if they are willing to even try at all), let alone their eyes completely glazing over if you ask them to write, like, an Rocq proof. And that's people who live and die by code, not business people who are layers removed from the activity.