There is an old Finnish folktale about a village of fools who built a massive house but forgot to add windows. When they realized it was pitch black inside, they didn't cut a hole in the wall. Instead, they grabbed burlap sacks, ran outside into the sunshine, "scooped" up the light, and carried the closed sacks back inside to empty them into the dark room.
For years, I thought this was just a funny bedtime story. Then I attended my first Enterprise Change Advisory Board (CAB) meeting.
The Modern Data Sack
In modern IT, we have built incredibly advanced, automated cloud environments. Yet, when it comes to governance, security, and compliance, we revert right back to the village of fools.
Think about the standard enterprise risk assessment. The systems already hold the exact data. The CI/CD pipeline knows the state of the code. The infrastructure knows the configurations. But instead of letting the system make a deterministic decision, a group of highly paid professionals scoops that data up into an Excel spreadsheet—our modern burlap sack. They color-code it green or red, carry it into a two-hour virtual meeting, and empty it onto a PowerPoint slide so a committee can "subjectively evaluate" what the machines already objectively know.
Building the Window
Eventually, any sane engineer gets tired of carrying the sack. You realize the solution isn't a bigger sack, or a more agile sack-carrying framework. The solution is to just build a window.
In our world, that window is Governance as Code. It is the radical idea that compliance shouldn't be a post-deployment feelings-check, but a deterministic state machine. You define the exact parameters, build the master data architecture, and let the code do the work. If the deployment meets the requirements, it advances. If it fails, it halts. No meetings. No subjective approvals. Just pure, mathematically sound logic letting the light in automatically.
The Committee's Panic
But here is the punchline of enterprise culture: when you finally build that window, the village doesn't thank you. They panic.
When you replace manual process theater with deterministic logic, the immediate reaction is absolute confusion. "But how will we know it's light inside if we don't carry the sack?" they ask. "Who approved this window?" "We need to run this window through the CAB so we can evaluate its impact on our sack-carrying KPIs."
People are so attached to the manual process of managing the light that they've entirely forgotten the original goal was simply to see in the dark. I have literally seen process managers try to feed deterministic code architectures into AI tools, desperately asking for a three-point executive summary to explain why the automated window isn't as "secure" as their manual spreadsheet.
Keep Building Windows
If you are an architect or an engineer stuck in a cycle of process theater, do not let it break your spirit. Do not conform to the sack.
Spend your time designing state machines. Write your governance as code. Automate the friction out of existence. They might not understand it today, and they might keep scheduling meetings to discuss the color of the burlap, but the math doesn't lie.
Let them carry their spreadsheets. We have windows to build.
just google it: big framework erkki laine
Top comments (0)