Ensuring the successful adoption of any new technology requires governance standards. The fast-growing field of low-code/no-code software, involving tools for regular folks to create business applications, is no exception.

“One of the challenges for IT today is upgrading their governance structure to recognize the decentralized model” that low-code/no-code demands, said Arnal Dayaratna, research director for software development at International Data Corp.

Some companies are figuring it out, though, creating categories of developers and assigning different privileges and responsibilities to each, said Sean Chou, chief executive of Catalytic Inc., a developer of workflow automation software.

Catalytic’s Chou: “Ask what you can push out to the edges of the corporation responsibly.” Photo: Catalytic

“The intent of a citizen development program should be to amplify development capabilities so developers aren’t responsible from beginning to end,” he said. “You need to ask what you can push out to the edges of the corporation responsibly.”

Chou sees citizen development governance as “a continuum, with your professionally trained developers who follow a development lifecycle at one end and business users of something like Excel at the other,” he said.

In the middle are people who administer cloud applications like Salesforce.com Inc.’s customer relationship management. “They’re not afraid to dig around in [application program interfaces], read technical documentation and configure things but they’re not comfortable with scripts or code,” Chou said.

Another middle tier is users of low-code tools who have some experience with a scripting language or Visual Basic. And at the low end are technology-oriented business users.

Information technology organizations can afford to exercise minimal control over the construction of certain types of low-end applications such as basic data collection forms and productivity aids at the workgroup level “assuming they use tools you bless,” Chou said.

Applications like workflow automation that don’t touch operational data or mission-critical applications. can typically be handled with what he called “a lightweight stage gating process,” to ensure minimal disruption to the business should the application fail. Once developers start interacting with core data or touching the enterprise resource planning system, a more formal multi-step gating process is appropriate involving security and data access reviews.

The criteria for what qualifies for review will vary by company. “It could be accessing production databases,” he said. “It could be the number of people or departments that are affected. Or it could be anything that touches regulated data.”

A sophisticated governance model follows the app store metaphor. Instead of allowing developers to post code without oversight, “Apple said, ‘Let’s invite more people to the party and we will take care of distribution and hosting,’” Chou said. “IT organizations need to adopt that same level of control.”

Regardless of the governance model a company adopts, creating a strategy to support citizen development is a source of competitive advantage for anyone, Chou believes, especially at a time when demand on IT is at unprecedented levels. “Does anyone have a bunch of idle developers sitting in their organization?” he said. “You can’t really ask that with a straight face.”

The review process may be heavy-handed at the outset, but over time a federated model usually emerges with citizen developers “who are essentially dotted-line reports to IT,” he said. “As trust builds, things get more streamlined.”

The ultimate goal should be to give people on the front lines as much authority as possible to respond to the needs of their departments and customers. “You have all these people on the business edge who are closest to where the action is,” he said. “The closer you can get to letting them create their own solutions, the greater an edge you will have.“

Photo: Flickr CC