Where should an organisation impose technology standards and where should teams choose freely? What principle draws the line?

The principle

Standardise where inconsistency imposes cost on people other than the team making the choice. Devolve where the team bears the consequence alone.

Where inconsistency is genuinely costly

• Identity and authorisation model. Divergence means a security review per service and no ability to reason about access across the estate.
• Data classification and handling, since a regulation applies to categories of data across all systems.
• Observability, because incident response crosses services and an engineer cannot learn a new tool at 3am.
• Deployment and infrastructure, where each variant is an on-call knowledge burden and a separate set of failure modes.
• The audit record's shape, since it must be queryable across the estate to be useful.
• Primary datastores and languages, which carry real network effects in expertise, tooling and hiring.
• Public API conventions, because inconsistency is visible to customers.

Where teams should choose

Libraries within an established language, frameworks, testing tools, internal code structure, most build tooling — anything where the team lives with its own decision and nobody else pays for it.

The mechanism that works better than a policy

A paved road. A template producing a compliant, observable, deployable service using the standard stack is adopted because it is the fastest path, not because it is mandated. The standard is in the template rather than in a document, which is enforcement without governance.

Where the paved road does not exist, a standard is an aspiration and teams will diverge — reasonably, since they need to ship.

The escape hatch that must exist

A documented exception process with a named approver and a record. Standards will occasionally be wrong for a legitimate case, and a standard with no exception route is violated silently rather than deliberately.

An exception register also tells you whether the standard is right: thirty exceptions means the standard is describing the wrong rule, and that signal is only available if exceptions are recorded rather than improvised.