We came at it from the perspective of DAOs, which was helpful at first but ultimately limiting. I think a non-blockchain version of this will take off. Tailscale is in a good position to do it.
Our earned insight is that you need to build the right primitive for delegation that works up and down the org. Our latest thinking on that is what we call a “Trust Zone” - more details here: https://blog.hatsprotocol.xyz/making-daos-work
You can ignore the “DAO” parts. Happy to answer any questions, I’m still very inspired by this line of inquiry.
I wrote this post some time ago, and more recently built a thing to do roughly this for my small business: https://github.com/42futures/firm
Had it in practice for about 4 months now and happy so far. It works for me, at my small scale. Hoping to share a follow-up with lessons learned soon.
Licensing it as AGPL-v3 throws up an interesting question - given the thing this produces is your company as code, if you use this does your entire company count as a larger work that would need to be open sourced? Or is there an explicit distinction between the "firmware" (excuse me) and the work product?
Otherwise all software written with a GPLv3 editor would also be GPLv3…or all software built with a GPLv3 compiler would be GPLv3. (Neither are true)
This is the same as having it in unstructured documents. Which means the auditing is still required funny enough.
So yes, this could be done. I'd love to see what run in the CI/CD for a change. When someone works on the wrong thing, or breaks compliance IRL, how do you backport it into this? "Alice is a software engineer, and created this SaaS account with her email when the company was founded. The admin email can not be changed and she has admin even though another role should control that"
Fortunately AWS doesn't let you delete S3 buckets with files in them without emptying them first...
This article does a good job explaining https://metadataweekly.substack.com/p/ontologies-context-gra...
Imagine a very large company that has a heterogeneous setup: say it has plain LDAP for *nix machines and AD for Windows. The IAM stuff has connectors for both, and encoding the org chart into that product enables it to synchronize that structure into both systems.
But things that don’t run have much less overhead than code: you don’t need to test then, update them, maintain them, they can’t really “not work”, people will adapt if they don’t make sense.
I /love/ this idea, but I don’t think it’s practical. Documents and business practices are about arranging people into semi-predictable organizations. The computing units of those organizations are people, and people run on text, not code.
I think the main problem with attempting to document this is that the system would not be running off of it. Your infrastructure document is automatically read and drives the deploy (or whatever). But if you want to make a change to a human’s responsibilities, you don’t get the simplicity of updating your organization documentation and clicking “execute.” So this new documentation you propose would always be lagging documentation rather than the actual driver of organizational behavior.
But! What if it was? What if all the managers in an organization were AI systems? They would read diff in the org chart and it initiated the communication to the respective human employees.
I could imagine testing this in a coffee-shop level business right now in which the LLM is probably capable of all the strategy and management decisions needed to effectively run it, operating within the constraints of policies and procedures all cleanly laid out in documentation.
I think it's not too far-fetched to think about standards, cultures, guardrails, compliance, etc. being documented, versioned, but more importantly, verifiable and applicable. In natural language, no code needed.
USM tools is based on Unified Service Management (USM) method, which provides the necessary concepts to take the the vision one step further. The core idea is similar however: everything a company does is a service, and services can be defined as data. The surprising finding from USM is that in practice it is possible to meaningfully define any service only through five types of processes.
As services are data, you can have multiple views on that data. And as all data is in standardized format, it becomes possible to make generic cross-references between USM and for example ISO27K as rules that refer to your data, and those rules can be evaluated. As a result, you can see your ISO27K compliance on a dashboard in real-time.
I have written a simple introduction about it that you can download for free from simpleusm.com, no sign-up required.
Simple homegrown system for processes is not that difficult to do. You basically model the USM process model, templates as instances which you then copy as a basis for editing and make a UI around the editing.
You could even just use JSON files and git, but while the data model is not complex, it is still not simple enough for editing by hand in an editor.
Then the question is what is the benefit. I would say that just using USM to define your services is helpful.
By this approach you can build various stakeholders views to your services that are always up to date and do not require manual labor.