In the complex ecosystem of enterprise software, the gap between "shipment" and "compliance" is often where trust is either forged or fractured. For years, the industry standard for vetting new features or third-party tools has been a disjointed, waterfall-style relay race: security reviews, legal vetting, compliance audits, IT architecture checks, and procurement approvals occurring in isolated silos.
New Relic, the observability platform provider, recently shattered this legacy model. By introducing "STAR"—an acronym for System, Tooling, and Architecture Review—the company has moved away from the departmental "ticket queue" paradigm toward a unified, customer-centric governance engine. This transition represents a shift from viewing compliance as a hurdle to viewing it as a core component of the product lifecycle.
The Problem: The "Waterfall" Governance Trap
In a typical enterprise software company, a product team’s excitement over a new feature is frequently dampened by the administrative friction of internal reviews. When a team ships a new capability, it often triggers a series of disconnected requests. Security wants to review the threat model; Legal needs to assess contractual liability; Compliance must check for regulatory alignment; IT checks for architectural compatibility; and Procurement evaluates vendor risk.
Each department operates within its own ticketing system, following its own timeline and its own definition of a "complete" submission. The result is a fragmented experience where the customer receives an answer that is a "composite of five separate opinions," often riddled with seams and delays.
"We retired the waterfall method from engineering twenty years ago for good reason—sequential stages, late error discovery, and expensive course corrections," notes the New Relic team. "Yet, most companies retained it in their review processes."
This departmental separation creates redundancy. Product teams are forced to answer the same questions—what data is touched, who has access, what are the third-party dependencies?—multiple times across different platforms. This friction ensures that reviews often happen late in the development cycle, when the cost of changing architecture to satisfy a security or compliance concern is at its peak.
The Genesis of STAR: A Chronology of Change
The impetus for the STAR system was not merely internal efficiency; it was an external mandate driven by the demanding reality of New Relic’s customer base. The company serves engineers and security officers who operate under stringent frameworks, including HIPAA, FedRAMP, SOC 2, ISO 27001, GDPR, and CCPA.
Phase 1: Defining the "SLC" Model
New Relic recognized that their customers do not evaluate security, legal, and compliance as separate entities. To the customer, a failure in any one of these areas is a singular failure of trust. Consequently, New Relic established the SLC (Security, Legal, and Compliance) review function. This was not a committee or a chain of sign-offs, but a single, accountable team tasked with ensuring that all material changes to the ecosystem are vetted in concert.
Phase 2: Centralizing the Intake
The design mandate was simple: "One door." The team built the STAR portal on Jira Service Management (JSM). Every material change—whether a new product feature, a modification to an existing service, a vendor renewal, or a request for a software exception—must enter through this single portal.
Phase 3: Integrating into the Engineering Workflow
Rather than adopting a separate GRC (Governance, Risk, and Compliance) platform—which would force engineers to leave their primary working environment—New Relic chose to build STAR entirely within Jira. By keeping the governance process inside the same tool where the product roadmap, design documentation, and code repositories reside, the company collapsed the distance between developers and reviewers.
The Architecture of Trust: Why "In Jira" Matters
The decision to avoid a standalone GRC tool was a strategic cultural choice. In organizations where governance lives in a disconnected portal, review teams are perceived as "gates" at the end of the process—an adversarial hurdle encountered only when a launch is imminent.
By embedding STAR into Jira, New Relic fundamentally changed the relationship between governance and engineering:
- Contextual Continuity: Reviewers can see the design document, the threat model, the data flow diagram, and the linked code repositories within the same record. There is no need for back-and-forth email threads or document hunting.
- Real-Time Collaboration: Because the governance process lives in the developer’s native environment, a security concern or a legal question can be addressed in the same thread where the design is being discussed. This allows reviewers to shape a project in its infancy rather than acting as a roadblock at the finish line.
- The Weekly Alignment: The SLC review team holds a formal, collective meeting every Tuesday to walk through escalations. This is not a status update, but a working session designed to align on the best strategic path forward for engineering teams.
Supporting Data: The Impact of Unified Governance
While specific internal performance metrics are proprietary, the qualitative shift in New Relic’s operational velocity is evident. By eliminating the "five-form" requirement, the company has drastically reduced the administrative overhead for product teams.
Furthermore, the "Customer Trust" team now leverages the collective data generated within the STAR system to provide customers with cohesive, comprehensive answers during their own procurement and audit processes. Instead of sending the customer three different reports from three different departments, the trust team provides a unified perspective that reflects the company’s internal alignment.
Implications for the Future of Enterprise Software
The regulatory landscape is not becoming simpler. With the introduction of the EU AI Act and the rapid evolution of state-level privacy laws, the burden of compliance is increasing.
The AI Challenge
Artificial Intelligence has become the ultimate stress test for governance models. Questions regarding AI—such as how customer data is used to train models, how prompt injection risks are managed, and how AI agents operate within customer environments—do not respect departmental boundaries.
A traditional, siloed organization would struggle to answer these questions because they require simultaneous expertise in security, legal, and engineering architecture. New Relic argues that their unified STAR approach is uniquely positioned to handle AI because the framework was already built to integrate disparate disciplines.
A New Standard for Trust
The implications for the broader SaaS industry are significant. If software vendors continue to treat governance as a series of disconnected chores, they will continue to frustrate their customers and expose themselves to unnecessary risk.
New Relic’s approach suggests that the future of enterprise software lies in Governance as Code—a model where compliance is integrated into the product development lifecycle from day one. By prioritizing the customer’s experience of trust over the company’s organizational chart, New Relic is not just streamlining their own internal operations; they are setting a benchmark for how modern software companies should handle the intersection of speed and security.
Conclusion: One Intake, Five Disciplines
The creation of STAR was never about internal bureaucracy; it was about acknowledging that the customer deserves a vendor that operates with a singular, unified vision.
By unifying Security, Legal, and Compliance into a single, Jira-native workflow, New Relic has replaced a fragmented, adversarial process with a collaborative, transparent, and agile system. As the regulatory climate continues to intensify, the ability to pivot quickly while maintaining rigorous standards will become the primary competitive advantage for enterprise software providers.
For New Relic, the journey begins with a single, simple premise: if you want to deliver trust, you must first design it into your operations. One intake, five disciplines—this is the new architecture of accountability.
Joseph Jang, Legal Counsel at New Relic, emphasizes that this approach is rooted in the belief that meeting engineering teams where they are is the only way to provide practical, scalable solutions in a high-velocity environment.
