Introduction
Something interesting is happening in software engineering right now. For a long time, infrastructure was the constraint. In the early days of enterprise IT, creating an environment meant ordering hardware, waiting for deliveries, configuring networks, and physically installing machines in data centers. It was slow, expensive, and operationally heavy.
Cloud computing changed that. With infrastructure-as-code and software-defined infrastructure, environments could suddenly be created in minutes. For the first time, infrastructure could move faster than the software being built on top of it. Developers could spin up databases, networks, and compute resources almost instantly, and many of the traditional operational bottlenecks disappeared.
But something has shifted again.
With the arrival of AI coding agents and increasingly powerful developer tooling, software can now be produced faster than compliant infrastructure can be created inside many enterprises. A developer with modern tools can explore ideas and produce working solutions at a remarkable pace. Meanwhile, creating environments that satisfy internal compliance requirements, governance processes, and security reviews can take days or weeks.
Infrastructure has become slow again—not because of technology, but because of process.
The result is a growing mismatch between the speed at which developers can innovate and the speed at which corporate governance allows experimentation to happen.
The Traditional Model
Most corporate security models are built on a simple assumption: control must begin at the developer machine. Developers work inside tightly managed environments, with locked-down laptops, restricted networks, controlled development environments, and tightly governed access to infrastructure.
The intention is understandable. These controls are meant to reduce risk and protect corporate systems and data.
In practice, however, they often produce the opposite outcome. Developers end up spending significant time navigating internal restrictions rather than experimenting with new ideas. The environment becomes optimized for compliance rather than exploration.
The problem is not security itself. The problem is where security is applied.
A Different Boundary
There is another way to think about this.
Instead of trying to tightly control the environments in which developers work, we can move the security boundary. Developers can operate in open, flexible environments outside the corporate firewall—using their own machines, cloud sandboxes, or experimental infrastructure where they can explore ideas quickly.
In this model the corporate firewall does not attempt to contain developer experimentation. Instead, it protects production systems and enterprise infrastructure.
The boundary between these two worlds becomes the one artifact that truly matters: the code.
Code as the Gateway
If code becomes the mechanism through which innovation enters the enterprise, then the logical place to apply security controls is at that gateway.
Platforms such as GitHub already provide the building blocks for this approach. Modern development platforms make it possible to apply automated verification whenever code enters a repository. Static analysis, secret scanning, dependency checks, policy enforcement through workflows, automated testing, and mandatory peer review can all be applied before code moves further downstream.
Security moves away from controlling developer workstations and toward controlling the software supply chain.
This shift aligns closely with several modern security frameworks. The recommendations from the Open Source Security Foundation and the model defined in SLSA both focus on protecting the integrity of builds, artifacts, and deployment pipelines rather than attempting to control the environments where developers write code. The same philosophy is reflected in the NIST Secure Software Development Framework.
In these models, the build pipeline itself becomes the security boundary.
Platform Engineering Inside the Enterprise
Once code passes these verification gates, it can move into the enterprise environment where platform engineering and DevOps teams take over. At this stage the organization can apply its full set of governance controls. Infrastructure patterns can be standardized, network policies enforced, runtime security monitoring enabled, and additional compliance checks applied.
Governance does not disappear in this model. It simply moves to a more effective location in the process.
Instead of governing experimentation, the organization governs what ultimately runs in production.
Why This Matters Now
The pace of technological change has accelerated dramatically. AI-assisted development means that developers can prototype ideas, test technologies, and explore new architectures faster than ever before.
If corporate processes require weeks to create compliant environments for experimentation, developers simply cannot move at the speed modern tools allow. When that happens, organizations risk something more serious than slow development. They risk becoming unable to explore new technologies at all.
Innovation requires the ability to try things quickly, discard ideas that do not work, and double down on the ones that do. When experimentation becomes difficult, innovation quietly disappears.
Trust the Process, Not the Laptop
Traditional enterprise security assumes that control must begin with the developer workstation. Modern software supply chain thinking suggests a different perspective.
What matters most is not where code is written. What matters is how code is verified before it reaches production systems.
The open source ecosystem has operated this way for decades. Thousands of developers contribute code from anywhere in the world, yet the most critical infrastructure software on the planet is built using this model. The security controls focus on review, testing, and artifact verification rather than on controlling contributor laptops.
Enterprises can adopt the same principle.
A Practical Balance
Allowing developers to experiment outside the firewall while enforcing strong controls on the code entering the enterprise creates a more balanced system. Developers retain the freedom required to explore ideas and work with modern tooling, while organizations maintain governance, compliance, and security verification where it matters most.
In an age where AI is accelerating the speed of software creation, the most effective place to apply control is no longer the developer machine.
It is the software supply chain.
References
- OpenSSF – Software Supply Chain Security: https://openssf.org
- SLSA – Supply-chain Levels for Software Artifacts: https://slsa.dev
- NIST Secure Software Development Framework (SSDF): https://csrc.nist.gov/Projects/ssdf
- GitHub Advanced Security: https://github.com/security/advanced-security
