Company as Code

Any non-digital system you describe "as Code" is not a source of truth, but a Source of Hope. The code describes the intended state, something has to reconcile it with reality.

This is the same as having it in unstructured documents. Which means the auditing is still required funny enough.

So yes, this could be done. I'd love to see what run in the CI/CD for a change. When someone works on the wrong thing, or breaks compliance IRL, how do you backport it into this? "Alice is a software engineer, and created this SaaS account with her email when the company was founded. The admin email can not be changed and she has admin even though another role should control that"

It constrains power and makes decisions auditable and holds those with power accountable to guidelines. Management doesn't like this paradigm for the very same reasons big tech platforms make conduct and moderation guidelines vague and nonspecific. It frees them up to remove, penalize, fire, and otherwise exert power for reasons they can't explicitly justify.

It's exactly the same paradigm the EU and countries around the world are avoiding - denying due process in things like freedom of press and expression, because they feel it allows them flexibility in suppressing and "managing" speech, people, and groups they deem problematic.

Having an explicit rule of law constrains the exercise of power. Those looking to wield power will never like that.

> I also do not see it happening at scale while competition is considered the default operating mode of society at large.

You don’t even need competition between people and orgs, just between solutions that work more-or-less equally but come with different second-order tradeoffs. Consider two approaches that solve a company’s problem equally but create different amounts of work for different people in the organization. Which solution to choose? Who gets to decide, based on what criteria? As soon as even a little scale creeps in this is inescapable.

This is perhaps a bit different, but Fossil supports storing more types of written company artifacts in the repo:

>One notable feature of Fossil is that it bundles bug tracking, wiki, forum, chat, and technotes with distributed version control to give you an all-in-one software project management system.

https://fossil-scm.org/home/doc/trunk/www/whyallinone.md

The softer approach to this I've implemented in the past is to ingest and link up org data (user accounts, groups, projects, etc) into one central DB and then provide an audit notifications or dashboards to authorized users. Examples:

    - Slack user detected with full access that isn't associated with a staff-grouped LDAP account
    - Group A in System X doesn't match the members of Group A in System Y)
    - Service Z provisioned, but their associated customer account is deactivated

These kinds of violations _can_ be automatically synchronized in a variety of ways, but I've seen that result in politically embarrassing outcomes (e.g. Sensitive user X is fired, their Slack account is automatically deactivated, people notice before some kind of staff meeting can be held to talk about what's going on).