How does a paved road achieve governance outcomes without a mandate, and what makes it fail?
Show the full answer Hide the answer
What is being tested
Whether you understand governance by convenience, and its failure modes.
The mechanism
A paved road is the fully supported, easiest way to build, deploy and run a service: a template, a pipeline, infrastructure modules, standard libraries, observability wired in.
Teams choose it because it saves them work. Compliance, security and operational best practice arrive as side effects of the convenient option — which is the only form of governance that survives deadline pressure.
A mandate, by contrast, creates an adversarial relationship, produces waivers and shadow infrastructure, and destroys the only reliable signal about whether the standard is any good.
What belongs on it
A service template producing a deployable, observable service in minutes; a pipeline with build, test, security scanning, deployment and rollback; infrastructure modules correctly sized, tagged, encrypted and networked by default; observability wired in with no per-team work; standard libraries for authentication, resilience and configuration; and documentation with a support path.
The rule that makes it work
Leaving the road must be allowed and must cost something. Teams that go off-road own the consequences: their own pipeline, monitoring, on-call tooling and compliance evidence.
That is not a punishment; it is the honest cost. Stating it converts an argument about standards into a straightforward trade the team can make for themselves — and it keeps the platform honest, because if teams are leaving, that is a product finding about the road.
Track the exceptions. A pattern of teams leaving for the same reason is the road's roadmap.
What makes it fail
- A road that constrains more than it enables, which teams correctly abandon.
- No support behind it, so users get stuck and give up. Time to first successful use is the metric that predicts adoption.
- Never updated, encoding decisions from three years ago.
- Mandated, which destroys the adoption signal and the incentive to improve it.
- Too narrow, covering only the simplest case, so anything real requires leaving it.
The measure
Voluntary adoption, plus the delivery outcomes of teams on the road versus off it — lead time, incident rate, time to first deploy. If those are not better on the road, the road is not doing its job, and no amount of enforcement will change that.
What a strong answer adds
The distinction from a mandate that matters most: a paved road embeds mandatory controls inside enabling capability. Encryption, audit logging and identity are not optional — but delivered as part of the convenient path, compliance becomes a consequence of choosing convenience rather than an obstacle to route around.