In the high-stakes world of enterprise software, a "trust gap" often emerges between a vendor and its customers. It begins with a simple, common scenario: a product team launches an innovative feature, but a customer’s security officer flags a discrepancy during an audit. Suddenly, the vendor is scrambling. Legal teams draft hurried responses, security experts perform retrospective architecture reviews, and compliance officers scramble to map the new feature against evolving frameworks like SOC 2, HIPAA, or the EU AI Act.
For the customer, the experience is disjointed. They receive fragmented, often contradictory answers assembled under intense time pressure. The seams of the organization are exposed.
New Relic, a leader in observability, decided that the industry-standard approach to these workflows—siloed, sequential, and reactive—was no longer sustainable. Their solution is STAR (System, Tooling, and Architecture Review), a unified internal ecosystem designed to treat security, legal, compliance, privacy, and IT not as a series of hurdles, but as a single, cohesive discipline.
The Architecture of Trust: A Chronology of Change
The genesis of STAR was not a desire for internal optimization, but a response to the shifting expectations of the enterprise customer. Modern regulatory landscapes are complex; customers are no longer asking if a vendor is "compliant." They are asking if a vendor treats security, legal, and privacy as a unified philosophy.
From Silos to Systems
Historically, New Relic—like most enterprise companies—operated with departmental separation. Security owned the security queue, Legal owned the legal queue, and Compliance managed its own documentation. This "waterfall" approach to governance meant that if a compliance team flagged an issue late in the game, it could force a costly redesign of an architecture that security had already signed off on weeks prior.
New Relic recognized that this model was fundamentally broken. By moving to an integrated SLC (Security, Legal, and Compliance) review function, the company shifted from a "sign-off chain" to a collaborative team.
The transition followed a clear logic:
- Consolidation of Intake: Moving from five separate forms to one "front door" via Jira Service Management.
- Contextual Integration: Bringing reviewers into the same digital space where engineers work, rather than forcing engineers into disparate GRC (Governance, Risk, and Compliance) tools.
- Continuous Alignment: Replacing "status report" meetings with weekly working sessions that focus on strategy and pathfinding.
The Design Philosophy: Why STAR Lives in Jira
One of the most radical aspects of the STAR initiative is its refusal to adopt a standalone GRC platform. While GRC software is standard for most firms, these tools often create a "governance island"—a place that engineers visit only when they have to, leading to friction and delayed compliance reporting.
New Relic chose to build STAR entirely within Jira. By embedding governance into the existing engineering toolchain, the company achieved a collapse of distance between the "gatekeepers" and the "builders."
The "One Door" Advantage
Under the STAR model, every material change—whether a new product feature, a third-party vendor integration, or a local software exception—enters through a single portal.
- Automated Routing: The system identifies the nature of the request. If it involves procurement, IT and the Vendor Management Office are tagged. If it involves architecture, the SLC review team is notified.
- Total Transparency: For the requester, there is one ticket and one dashboard. They no longer need to manage multiple email threads or chase down updates from three different departments.
- Data-Rich Reviews: When the SLC team reviews a request, they have immediate access to the design documents, threat models, data flow diagrams, and the roadmap epic within the same Jira record.
Implications: Building for a Regulatory Future
The shift toward a unified review system has significant implications for how New Relic interacts with its customers. By treating governance as a unified discipline internally, the company can provide faster, more transparent, and more cohesive answers to customer inquiries.
Meeting the AI Challenge
The true test of any governance system is its ability to handle volatility. As AI adoption accelerates, regulatory frameworks like the EU AI Act and evolving state privacy laws are changing the game. Traditional, siloed review functions struggle to keep pace because these new requirements don’t respect departmental boundaries.
For example, a request involving generative AI touches upon legal (copyright and contract law), security (prompt injection and data leakage), and compliance (data privacy). Under the old model, these might have been treated as three separate, potentially conflicting reviews. Under STAR, they are viewed as a single, multidimensional problem.
Cultural Transformation
Beyond the operational efficiency, the STAR system has fundamentally altered the culture at New Relic. Because review teams are now embedded in the engineering workflow, they are present at the beginning of the design phase. They move from being "blockers" who approve or reject at the finish line to "consultants" who help shape the architecture to be compliant by design. This early intervention significantly reduces the cost of course correction and fosters a culture of shared accountability.
Official Perspectives on the New Model
Joseph Jang, legal counsel at New Relic, emphasizes that the goal of this system is to meet teams where they are. By focusing on the engineering architecture and the specific product capabilities, the legal and compliance functions become proactive partners in innovation rather than just auditors of it.
"The SLC review team sees it together in the same Jira record," notes the internal team. "When a question in the compliance lane has implications for the security assessment, the two reviewers are in the same conversation. This isn’t just about efficiency; it’s about building a foundation of trust that can scale as fast as the technology does."
Supporting Data and The Customer Experience
The customer-facing benefits of this internal re-engineering are measurable. When a customer’s security officer asks a complex question about data handling or architectural integrity, New Relic’s Customer Trust team does not have to hunt for answers across five different departments. They leverage the collective STAR data to provide a comprehensive, unified response.
The effectiveness of this model is being validated by the increasing complexity of customer security questionnaires. As these questionnaires grow in length and specificity, the ability to synthesize information across security, legal, and compliance becomes a competitive advantage.
Conclusion: A Blueprint for Enterprise Governance
The STAR system serves as a case study for companies looking to bridge the gap between agility and governance. By rejecting the "waterfall" review process and embracing a "one intake, five disciplines" model, New Relic has demonstrated that governance does not have to be a drag on innovation.
As the industry moves toward a future where AI and cloud-native infrastructure require constant, real-time compliance, the "siloed" model of the past is effectively obsolete. New Relic’s approach suggests that the companies that win in the next decade will be those that view trust, security, and compliance not as secondary functions, but as core components of their engineering DNA.
For New Relic, the journey of STAR is just beginning. As the remaining chapters of their series on this topic suggest, the framework is robust enough to handle everything from vendor procurement to the ethical complexities of artificial intelligence. One intake, five disciplines—it is a simple, yet powerful, starting point for any organization striving for true, customer-centric trust.
