devopsy.kinsta.cloud

Author: Mark Tognetti

Citizen Development Program: Establishing Guardrails
Citizen development is as easy as one, two, three.
1. Select the right use cases
2. Enable the citizen developer(s)
3. And establish the guardrails, which I will cover here.
Of course, there is a little more to it than this. Success requires focus, planning and patience. We previously discussed, in parts one and two of the series, the discipline required around use cases and citizen developers (CDs). This third and final post covers how to establish the appropriate technical and process guardrails to ensure the wider enterprise, platform and developers are protected.

Establishing the Guardrails

Guardrails exist for two primary purposes: alignment and independence. Clear and concise guardrails ensure alignment across organizational objectives, company policies and disparate teams. Those same guardrails provide CDs with a degree of independence – a safe operating space where they will not be micromanaged or unnecessarily burdened by processes.
Effective guardrails define and enforce a range of acceptable behaviors, as well as reduce risk and speed application delivery.

While low-code application platforms (LCAPs) each have their unique capabilities and technical implementations, relevant features can be viewed in three broad categories: platform foundation security, app dev access control and development tools & processes.

Within the context of your specific LCAP and development methodology, you need to consider and answer the following questions:

Platform Foundation Security
- How will you provide your CDs a “safe” environment to build and test their applications? Does your platform support separate and secure development, test and production environments? Will you put your citizen developers in their own discrete development environment?
- Will your developers be working with data that requires encryption and/or localization? If so, does your platform support data encryption and compliance with relevant data residency laws?
- Does your LCAP support anti-virus scanning and/or HTML sanitization, and if not, how will you prevent a CD from inadvertently putting your organization at risk?
- What logging and auditing is required for your CD activities? Who reviews logs? How long is the information kept?
- Does your platform support enhanced security mechanisms like two-factor authentication (2FA) or virtual private networks (VPNs)? Will citizen developers be working in areas or with applications that require enhanced security?
- Are there other risk, compliance and security standards that your organization mandates? If so, how will you incorporate them?
App Dev Access Control
- How will you provision or deprovision developer and tester accounts? How will you handle developer login and authentication into the development environment?
- Will CDs have development access to downstream environments across testing, staging and production?
- Will you use groups to control access to applications in development, and if so, who will manage these groups?
- Will you use roles to grant access to distinct development capabilities like tables, workflows, UIs, mobile, reporting, analytics, etc.? What determines which role(s) a citizen developer is granted?
- Will you provide a library of pre-built application components (e.g., workflows, dashboards, virtual agents, etc.)? How will you control access to and usage of the pre-built components?
- Will you allow citizen developers to access pre-built integrations? How will you control access to and monitor usage of those pre-built integrations?
- Does the developer identity and access management process need to be driven by an enterprise identity provider, such as Azure Active Directory?
- Will citizen developed applications be able to access other citizen developed applications? How will app-to-app access be controlled?
Development Tools and Processes
- How will you manage your demand intake process? How will you ensure that new applications do not duplicate existing application functionality? What criteria will you use to determine if an application is a good fit for a citizen developer?
- Will you require your CDs to adhere to all, some or none of your existing development methodology? Can you explain the methodology in terms the citizen developer will understand and accept?
- Will you require CDs to create requirements or agile stories before building an application?
- Will you require tests be developed for CDs’ applications, and if so, can these be automated? Who will develop those tests?
- Will you require code or application reviews of citizen developed applications? What best practices and standards will be used during those reviews? Can those reviews be automated?
- What level of documentation, if any, will you require developers to produce?
- How will you promote applications through the development pipeline (i.e., dev to test to prod)? Can the app promotion process be automated?
- How will you track and manage CDs’ applications through the development pipeline and their life cycle?
Reflections on Citizen Development Programs

The exercise of writing this series and your feedback has encouraged me to reflect on parts one (selecting the right use cases) and two (enabling citizen developers). Here are a few final thoughts to consider:
- Do you care that a CD builds just one app or do you want them to build more?
  Ideally, a CD continues to deliver app after app. But attrition can be high in a CD program. Therefore, if your CD built a single application that delivers business value and then returned to their “day job,” you should still celebrate that success.
- Is citizen development better suited for creating new apps or maintaining existing apps?
  In my view, the answer is both. LCAPs provide great opportunity for CDs to prototype or even produce an MVP of an application. At the same time, LCAPs allow professional developers to build more complex applications and turn the maintenance of those applications over to CDs.
- How many LCAPs can you reasonably expect a citizen developer to understand?
  Realistically, perhaps one, or maybe two. Keep in mind that app development is important, but having CDs focus their technology choices on a single LCAP vastly improves their chances of success.
- Do citizen developers make good professional developers?
  Consider this – some of the best developers I have worked with do not have computer science or software engineering degrees. It’s more important that a developer has a passion for technology and, more importantly, for understanding how technology solves business problems.
- Finally, explore and embrace citizen development before your competitors do, as the value proposition is real in this new world of work we have found ourselves in. After 30 years in enterprise IT, I can confidently say we’ve reached an inflection point in technology and business, truly democratizing application development.
This post is the third of a three-part series from Mark Tognetti that provides real-world insights on delivering business value from citizen development initiatives.
April 1, 2021
Citizen Development Program: Enabling Citizen Developers
In part one of this series, we made the case for embracing citizen developers to close the developer demand-supply gap while delivering true business agility. We outlined the foundational elements that are consistent across successful citizen development programs: 1) adopting a low-code application platform, 2) embracing the citizen development journey and 3) marketing (internally) citizen development successes.

We also discussed finding the right citizen developers – individuals with the right aptitude and attitude to be successful building applications using low-code tools. Now that we have identified the right use cases and the ideal citizen developer, we will focus on the key decisions for enabling (and empowering) citizen developers.

Enabling (and Empowering) Citizen Development

To enable citizen developers, you must focus on the individual and set them up for success through training, support, and recognition. Empowerment addresses the citizen development process, the life cycle of an application and, more importantly, reducing the organizational friction associated with both.

As you look to build out a citizen development enablement program, you need to answer the following questions about training, support and recognition of your citizen developers:
- Training
  - What is the training curriculum for citizen developers? Do learning paths differ based on developer category?
  - Is there organization-specific content that needs to be included in the training? If so, who owns the creation and maintenance of that content?
  - How will developer proficiency be assessed?
- Support
  - How will citizen developers obtain ongoing support?
  - Will you schedule office hours hosted by subject matter experts?
  - Will there be an online community?
  - Will citizen developers be aligned with a specific SME / pro developer?
  - How quickly do you want to scale the program?
  - What are the appropriate checkpoints / milestones associated with scale?
- Recognition
  - Will you formally recognize training accomplishments? Perhaps though gamification via badges?
  - How will you track, celebrate and reward successful applications?
  - Does demonstrated competency equate to increased developer access?
It is important to remember that the role of “citizen developer” is frequently an additional responsibility beyond an individual’s day job. As such, it is critical to educate them, support them and celebrate their wins in order to ensure success.

In order to empower your citizen developers, you need to consider both the application development process and the overall application life cycle. You need to answer the following questions about the process and the life cycle:
- Application Development Process
  - What is the overall objective for citizen development? What metrics will you use to track progress?
  - Does each application require a separate approval or are developers, once approved, able to build multiple applications?
  - What are the technical standards and best practices specific to your organization?
  - What is your development process? Who has authority over development, testing and deployment?
  - Is your core development team / center of excellence structured, resourced and funded to support citizen development?
  - How will citizen developers and pro coders collaborate on applications?
- Application Life Cycle
  - What is your application intake process? Who evaluates new app requests for platform fit, redundancy, cost, etc.?
  - Once an application is moved to production, who is responsible for the ongoing support and maintenance?
  - What is your process for rationalizing and deprecating applications?
As low-code platforms continue to evolve, the capabilities that facilitate the collaboration between the citizen developer and the pro coders are critical to deliver a successful application. It is not uncommon for a pro coder to collaborate with a citizen developer to deliver the last 5% to 10% of an application’s necessary functionality.

We have identified the right use cases and the right citizen developers in part one. We have enabled and empowered the citizen developers in part two. In part three of this series, we will explore establishing technical guardrails to protect the platform from the citizen developers, and the citizen developers from each other.

This post is the second in a three-part series that provides real-world insights on delivering business value from citizen development initiatives.
February 22, 2021
Citizen Development Program: Selecting the Right Use Cases
The COVID-19 pandemic forced us into new ways of working that demanded a truly digital enterprise. Digital enterprises require we deliver applications for our everyday tasks and processes with unprecedented speed. Our traditional development resources – our professional developers – and traditional, professional code development environments simply cannot meet the demands from our lines of business.

The rapid adoption of low-code application platforms and the ability to use more readily available “low-code developers” partially closes the demand-supply gap by improving app delivery velocity for IT organizations. But velocity is only half the battle. Because our app development teams (pro and/or low code) can be so focused on the application itself, they may not fully understand the larger context around that application, the business processes they are attempting to digitize or how to connect with the process owners to gain that understanding. We become faster at app delivery, but not necessarily more agile. True business agility comes when we push app development to the edge; out into our lines of business and into the hands of “citizen developers.”

Now let’s all take a deep breath, pause for a moment, and accept that citizen development is not the panacea for all our digitization needs – nor is it the beginning of application anarchy. A well-executed citizen development program can dramatically improve delivery velocity and business agility if organizations make good decisions in three key areas: 1) selecting the right use cases for citizen development; 2) enabling and empowering our citizen developers; and, 3) establishing citizen development guardrails that protect our organization.

Before exploring the key decisions, it is important to note a few elements that are consistent across successful citizen development programs:
- Adopting a Low-Code Application Platform (LCAP) – LCAPs benefit IT developers (both professional and low-code) but are critical to citizen developers. Teaching Java to your lines of business is what’s called a distributed development model – and that’s a whole different article.
- Embracing the Journey – A citizen development program is a learning process for both the IT organization and the lines of business. Start focused, learn from the experience, adjust the approach and expand the reach.
- Marketing Success – It is important to raise awareness of the program by telling the company about both the successes and the lessons learned – be candid and clear. People feel good about successful programs and rally around them.
Selecting the Right Use Cases for Citizen Development

We want to set up citizen developers, and the citizen developer program, for success, which means matching the business need to the citizen developer skillset.
We need answer the following questions regarding line of business needs.
- What business use cases are a good fit for our LCAP?
- What technical requirements are a good fit for our LCAP? What technical requirements are not?
- What types of applications in our enterprise are a good fit for citizen development?
- Are there lines of business / departments that could benefit more than others from empowering citizen developers?
- Are there specific risk, compliance, security and legal (RSCL) mandates that need to be addressed?
- Are there other core enterprise systems that need to be considered for certain use cases?
- Are there legacy technologies and/or is there technical debt that should be targeted?
- What is the potential return on investment? How quickly can we start achieving that ROI?
The answers to these questions are not binary. These questions, and others unique to each company, provide a filter to vet – and possibly score – use cases to determine suitability for a citizen development program.

Just as important as selecting the right use cases is finding the right citizen developers. We need to answer the following questions about any potential citizen developers.
- Will we have different categories of distributed / citizen developers? Are those categories based on skill level, organization and/or access?
- Have we identified the aptitude and attitude characteristics of a good citizen developer?
- How will we recruit and incentivize developers to join the program?
- What is our value proposition to the citizen developer’s manager? Why would they support allocating some portion of their resource(s) building apps?
In the early stages of a citizen development program, the most successful programs tend to prioritize the right developer over the right use case. A “high fit” developer delivering a “medium value” use case is a better bet than a “low fit” developer attempting a “high value” use case. Early wins matter.

In part two of this series, we will explore enabling and empowering our citizen developers. We have now identified the right use cases and the right citizen developers, so let’s set them up for success.

This post is the first of a three-part series offering real-world insights on delivering business value from citizen development initiatives.
February 1, 2021