Service-Oriented Architecture Governance for the Services Driven Enterprise

Chapter 6. SOA Governance Goals, Principles, and Policies

One of the rapidly developing areas of Service Oriented Architecture (SOA) governance is the domain of policies. While governance and policy enforcement are fairly immature, the concept of policies is still emerging within the context of enterprise governance. What are policies? How do you identify and enforce the right ones? How are policies enforced? How does policy-based governance differ from previous approaches to governance? Governance and policy are immature disciplines and need a lot of work from both a technology as well as an industry standards perspective.

This chapter provides a framework and model to transition from your SOA strategy to a governance model and a complete body of enforceable policies. This is the goal of SOA governance, of course. The domain of SOA policy is an emerging one, yet it is fraught with challenges. The standards of SOA policy are volatile. The tools and technologies are repositioning for SOA governance, runtime governance, runtime policy enforcement, and policy provisioning.

Yet, with all this focus on automating technical SOA policies for security—authentication, authorization, credential passing, and trust domains—there are as many (probably more) challenges around business and process policies. The challenges here relate to the fact that these are primarily behavioral policies, the enforcement of which is accomplished via governance boards, manual policy enforcement processes, and ...