In the high-stakes world of enterprise software, trust is the primary currency. For vendors, that trust is tested daily by a complex web of regulatory requirements, security protocols, and legal frameworks. However, the traditional corporate approach to managing these mandates—fragmented, siloed departments operating in isolation—often creates a disjointed experience for the very customers they aim to protect.
New Relic, the observability powerhouse, recognized that the industry-standard "waterfall" model of review was no longer tenable. In response, they engineered STAR (System, Tooling, and Architecture Review), a unified governance ecosystem designed to collapse the distance between internal operations and customer trust. By replacing five distinct departmental queues with a single, integrated intake system, New Relic has fundamentally shifted how security, legal, and compliance teams collaborate, proving that operational efficiency and rigorous oversight are not mutually exclusive.
The Anatomy of a Broken Process: Why Enterprise Governance Fails
Every enterprise software company has navigated the frustration of the "staggered review." A product team ships a feature, only to have it stalled by a cascade of sequential approvals. Security inspects the architecture; Legal reviews the contracts; Compliance validates the certifications; IT verifies infrastructure compatibility; and Procurement audits the vendor status.
In the traditional model, these functions operate as independent fiefdoms. Each possesses its own intake form, ticket queue, and specialized vocabulary. When these teams work in isolation, the seams become visible. A compliance requirement may conflict with a security protocol, or a legal concern might necessitate an architectural change that was already "approved" by IT. This creates a cycle of repetitive meetings, redundant questionnaires, and significant project delays.
More critically, this siloed approach treats compliance as a series of boxes to check rather than a unified discipline. From the customer’s perspective, a security gap or a legal oversight is a singular failure of trust. By treating these functions as separate entities, companies often deliver fragmented, inconsistent answers to customer audits, eroding confidence and stalling procurement cycles.
The Genesis of STAR: A Chronology of Change
The shift toward a unified review system at New Relic did not begin with a directive from the C-suite to reorganize the org chart; it began with a customer-centric design philosophy.
Phase 1: The "Customer-First" Realization
New Relic recognized that their customers—engineers, SREs, and security officers—operate under a heavy burden of regulatory frameworks, including HIPAA, FedRAMP, SOC 2, ISO 27001, GDPR, and CCPA. These frameworks do not view security, privacy, and legal as distinct entities; they view them as a holistic posture. New Relic realized that if they wanted to provide a seamless, authoritative answer to these customers, they had to mirror that unity internally.
Phase 2: Forming the SLC Review Team
The company moved to establish the SLC (Security, Legal, and Compliance) review team. Unlike a traditional committee that merely meets to sign off on projects, this team was empowered to act as a single, accountable entity. The objective was clear: ensure that questions from customers and regulators are addressed in concert, not in sequence. This structure, which mirrors the governance requirements of a Change Advisory Board, transformed "check-the-box" compliance into a collaborative, strategic partnership.
Phase 3: Designing the "One Door" Portal
The final piece of the puzzle was the creation of STAR. By moving from a multi-portal submission system to a single JSM (Jira Service Management) portal, New Relic eliminated the administrative friction that plagues most product launches. Whether the request involves a new third-party tool, a product feature, or a change to existing infrastructure, it enters through the same door. The system uses automated routing to pull in the necessary stakeholders, ensuring that parallel tracks begin simultaneously on a single parent record.
Engineering Governance: The Power of the Native Toolchain
One of the most radical design choices in the development of STAR was the decision to build it entirely within Jira. Many organizations default to dedicated GRC (Governance, Risk, and Compliance) platforms. While these systems offer robust reporting, they often exist in a vacuum, forcing engineers to step out of their native development environment to participate in governance.
By embedding STAR into the existing engineering toolchain, New Relic achieved two critical outcomes:
- Contextual Transparency: When a reviewer opens a STAR ticket, they see the entire history of the project—the design documents, the threat models, the data flow diagrams, and the linked code repositories. There is no need to hunt through disconnected email threads or wait for a meeting to understand the technical architecture.
- Cultural Integration: Governance is no longer a "gate" at the end of the development cycle. Because the review team is active within the same Jira instances as the engineers, they can provide guidance during the design phase. This shift moves governance from a reactive, punitive function to a proactive, consultative one. A comment from a security reviewer now lands in the engineer’s workflow in real time, allowing for rapid iteration rather than late-stage rejection.
Supporting Data: Efficiency and Accuracy
While the primary driver of STAR was the improvement of the customer trust experience, the operational gains have been significant. By eliminating redundant intake forms, New Relic has drastically reduced the "context switching" that previously hampered both product managers and reviewers.
The unified dashboard provides a single source of truth for the status of any request. When a blocker emerges, it is visible across all tracks simultaneously. This allows the SLC team to identify patterns—such as recurring architectural weaknesses or common vendor risks—that might otherwise go unnoticed in a siloed environment.
Furthermore, the "Tuesday meetings," where the SLC team reviews escalations, have evolved from status updates into strategic working sessions. By analyzing the data housed within the STAR system, the team can align on complex, cross-functional problems, ensuring that the guidance provided to product teams is consistent and informed by the latest regulatory shifts.
Official Perspective: Governance as a Strategic Asset
Joseph Jang, legal counsel for New Relic, emphasizes that the goal of STAR is to "meet teams where they are." In his role, providing guidance on emerging technologies like generative AI requires a deep understanding of both the legal landscape and the underlying engineering architecture.
"The goal is to provide practical solutions," Jang notes. By having access to the same Jira tickets as the developers, he can offer legal and compliance guidance that is actually applicable to the specific technical architecture being built. This level of granular visibility ensures that the advice provided is not just a high-level legal theory, but a actionable roadmap for safe, compliant deployment.
The company acknowledges that these solutions are highly environment-specific and tailored to their unique product landscape. However, the principle remains universal: governance should be a frictionless extension of the development process, not an external barrier to innovation.
Implications: Preparing for an Unstable Regulatory Future
The regulatory landscape for enterprise software is in a constant state of flux. With the implementation of the EU AI Act, the proliferation of state-level privacy laws, and the increasing complexity of FedRAMP requirements, the old model of "siloed expertise" is increasingly fragile.
If a company’s security team doesn’t know what the compliance team is promising, or if the legal team is unaware of how a new AI agent processes customer data, they cannot hope to survive the next generation of audits. STAR provides a blueprint for scalability. As new frameworks emerge—such as those surrounding AI safety and prompt injection risks—the system can accommodate new tracks without requiring a fundamental redesign of the process.
Conclusion: A New Standard for Trust
New Relic’s journey with STAR is a testament to the power of designing for the customer experience first. By acknowledging that customers view security, legal, and compliance as a single, indivisible promise, the company was able to work backward to build an operating model that delivers on that promise.
The "One Intake, Five Disciplines" approach is more than just a software implementation; it is a cultural shift. It acknowledges that in the modern enterprise, the wall between "building" and "governing" must be dismantled. For customers, the result is a transparent, cohesive, and professional engagement. For New Relic, it is the ability to navigate an increasingly complex world with the confidence that they are not just checking boxes, but building a foundation of enduring trust.
