In the complex ecosystem of enterprise software, the gap between "shipment" and "compliance" is often where trust is either forged or fractured. For years, the industry standard for vetting new features or third-party tools has been a disjointed, waterfall-style relay race: security reviews, legal vetting, compliance audits, IT architecture checks, and procurement approvals occurring in isolated silos.<\/p>\n
New Relic, the observability platform provider, recently shattered this legacy model. By introducing "STAR"\u2014an acronym for System, Tooling, and Architecture Review\u2014the company has moved away from the departmental "ticket queue" paradigm toward a unified, customer-centric governance engine. This transition represents a shift from viewing compliance as a hurdle to viewing it as a core component of the product lifecycle.<\/p>\n
In a typical enterprise software company, a product team\u2019s excitement over a new feature is frequently dampened by the administrative friction of internal reviews. When a team ships a new capability, it often triggers a series of disconnected requests. Security wants to review the threat model; Legal needs to assess contractual liability; Compliance must check for regulatory alignment; IT checks for architectural compatibility; and Procurement evaluates vendor risk.<\/p>\n
Each department operates within its own ticketing system, following its own timeline and its own definition of a "complete" submission. The result is a fragmented experience where the customer receives an answer that is a "composite of five separate opinions," often riddled with seams and delays. <\/p>\n
"We retired the waterfall method from engineering twenty years ago for good reason\u2014sequential stages, late error discovery, and expensive course corrections," notes the New Relic team. "Yet, most companies retained it in their review processes."<\/p>\n
This departmental separation creates redundancy. Product teams are forced to answer the same questions\u2014what data is touched, who has access, what are the third-party dependencies?<\/em>\u2014multiple times across different platforms. This friction ensures that reviews often happen late in the development cycle, when the cost of changing architecture to satisfy a security or compliance concern is at its peak.<\/p>\n The impetus for the STAR system was not merely internal efficiency; it was an external mandate driven by the demanding reality of New Relic\u2019s customer base. The company serves engineers and security officers who operate under stringent frameworks, including HIPAA, FedRAMP, SOC 2, ISO 27001, GDPR, and CCPA.<\/p>\n New Relic recognized that their customers do not evaluate security, legal, and compliance as separate entities. To the customer, a failure in any one of these areas is a singular failure of trust. Consequently, New Relic established the SLC (Security, Legal, and Compliance)<\/strong> review function. This was not a committee or a chain of sign-offs, but a single, accountable team tasked with ensuring that all material changes to the ecosystem are vetted in concert.<\/p>\n The design mandate was simple: "One door." The team built the STAR portal on Jira Service Management (JSM). Every material change\u2014whether a new product feature, a modification to an existing service, a vendor renewal, or a request for a software exception\u2014must enter through this single portal. <\/p>\n Rather than adopting a separate GRC (Governance, Risk, and Compliance) platform\u2014which would force engineers to leave their primary working environment\u2014New Relic chose to build STAR entirely within Jira. By keeping the governance process inside the same tool where the product roadmap, design documentation, and code repositories reside, the company collapsed the distance between developers and reviewers.<\/p>\n The decision to avoid a standalone GRC tool was a strategic cultural choice. In organizations where governance lives in a disconnected portal, review teams are perceived as "gates" at the end of the process\u2014an adversarial hurdle encountered only when a launch is imminent.<\/p>\n By embedding STAR into Jira, New Relic fundamentally changed the relationship between governance and engineering:<\/p>\n While specific internal performance metrics are proprietary, the qualitative shift in New Relic\u2019s operational velocity is evident. By eliminating the "five-form" requirement, the company has drastically reduced the administrative overhead for product teams. <\/p>\n Furthermore, the "Customer Trust" team now leverages the collective data generated within the STAR system to provide customers with cohesive, comprehensive answers during their own procurement and audit processes. Instead of sending the customer three different reports from three different departments, the trust team provides a unified perspective that reflects the company\u2019s internal alignment.<\/p>\n The regulatory landscape is not becoming simpler. With the introduction of the EU AI Act and the rapid evolution of state-level privacy laws, the burden of compliance is increasing. <\/p>\n Artificial Intelligence has become the ultimate stress test for governance models. Questions regarding AI\u2014such as how customer data is used to train models, how prompt injection risks are managed, and how AI agents operate within customer environments\u2014do not respect departmental boundaries. <\/p>\n A traditional, siloed organization would struggle to answer these questions because they require simultaneous expertise in security, legal, and engineering architecture. New Relic argues that their unified STAR approach is uniquely positioned to handle AI because the framework was already built to integrate disparate disciplines.<\/p>\n The implications for the broader SaaS industry are significant. If software vendors continue to treat governance as a series of disconnected chores, they will continue to frustrate their customers and expose themselves to unnecessary risk. <\/p>\n New Relic\u2019s approach suggests that the future of enterprise software lies in Governance as Code<\/strong>\u2014a model where compliance is integrated into the product development lifecycle from day one. By prioritizing the customer\u2019s experience of trust over the company’s organizational chart, New Relic is not just streamlining their own internal operations; they are setting a benchmark for how modern software companies should handle the intersection of speed and security.<\/p>\n The creation of STAR was never about internal bureaucracy; it was about acknowledging that the customer deserves a vendor that operates with a singular, unified vision. <\/p>\n By unifying Security, Legal, and Compliance into a single, Jira-native workflow, New Relic has replaced a fragmented, adversarial process with a collaborative, transparent, and agile system. As the regulatory climate continues to intensify, the ability to pivot quickly while maintaining rigorous standards will become the primary competitive advantage for enterprise software providers. <\/p>\n For New Relic, the journey begins with a single, simple premise: if you want to deliver trust, you must first design it into your operations. One intake, five disciplines\u2014this is the new architecture of accountability.<\/p>\n Joseph Jang, Legal Counsel at New Relic, emphasizes that this approach is rooted in the belief that meeting engineering teams where they are is the only way to provide practical, scalable solutions in a high-velocity environment.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" In the complex ecosystem of enterprise software, the gap between "shipment" and "compliance" is often where trust is either forged or fractured. For years, the…<\/p>\n","protected":false},"author":1,"featured_media":1374,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[5,560,1453,307,4,1454,20,1455,3,741],"class_list":["post-1375","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network-testing-and-monitoring","tag-diagnostic","tag-enterprise","tag-front","tag-governance","tag-monitoring","tag-reimagined","tag-relic","tag-star","tag-testing","tag-unified"],"_links":{"self":[{"href":"https:\/\/voicecabling.com\/index.php?rest_route=\/wp\/v2\/posts\/1375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/voicecabling.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/voicecabling.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/voicecabling.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/voicecabling.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1375"}],"version-history":[{"count":0,"href":"https:\/\/voicecabling.com\/index.php?rest_route=\/wp\/v2\/posts\/1375\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/voicecabling.com\/index.php?rest_route=\/wp\/v2\/media\/1374"}],"wp:attachment":[{"href":"https:\/\/voicecabling.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/voicecabling.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/voicecabling.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The Genesis of STAR: A Chronology of Change<\/h2>\n
Phase 1: Defining the "SLC" Model<\/h3>\n
Phase 2: Centralizing the Intake<\/h3>\n
Phase 3: Integrating into the Engineering Workflow<\/h3>\n
The Architecture of Trust: Why "In Jira" Matters<\/h2>\n
\n
Supporting Data: The Impact of Unified Governance<\/h2>\n
Implications for the Future of Enterprise Software<\/h2>\n
The AI Challenge<\/h3>\n
A New Standard for Trust<\/h3>\n
Conclusion: One Intake, Five Disciplines<\/h2>\n
\n