Platform Engineering
Platform Teams Win Developer Trust by Making Compliance an Enabler, Not a Burden
Davide de Paolis shares how one organization shifted from enforcing compliance through friction to embedding it as a shared responsibility that teams actually want to adopt.
InfoQ
When a newly formed platform team rolled out governance initiatives through rigid workflows and heavy-handed enforcement, the result was predictable: developer frustration and declining adoption. The turning point came when the team reframed compliance as something that helps teams move faster and safer—and communicated that shift with real empathy.
In a recent talk at Dev Summit Munich, Davide de Paolis walked through how his organization moved from a confrontational approach to one rooted in shared purpose. The lesson: compliance succeeds when it's woven into everyday workflows rather than imposed from above.
The Friction That Made Developers Resist#
The platform team started with good intentions—assembling experienced engineers with strong DevOps and cloud expertise to build out a service catalog and internal developer platform. But the rollout created immediate friction. Developers suddenly faced multiple AWS accounts, unfamiliar contexts, and new skills to learn—all while documentation lagged behind the changes.
The underlying tension wasn't technical. Developers resented being told what to do without context. "Nobody likes to be patronised," de Paolis noted, observing that security and platform teams often fall into this trap. Forced adoption rarely sticks; alignment around shared purpose does.
A Better Model: Prevention, Detection, and Communication#
A concrete example was resource tagging. An earlier initiative had failed spectacularly, leaving ownership, cost tracking, and governance inconsistent and largely manual. The team tried a different playbook:
- Simplify first: Reduce the number of mandatory tags and standardize them.
- Prevent at the source: Use AWS Tag Policies and Service Control Policies to block untagged resources.
- Detect existing gaps: Deploy AWS Security Hub Resource Tagging Standard to surface non-compliant resources.
- Communicate early and often: Inform teams about the initiative, then gradually enforce guardrails rather than implementing hard blocks overnight.
As de Paolis explained, the trio of prevention, detection, and notification proved powerful: "Inform first, softly enforce next, and only then move to stricter enforcement."
