Road to Compliance: Will Your Internal Users Hate Your Platform Team?
InfoQ, Monday, July 13th, 2026
A platform team's phased, inform-then-enforce approach to cloud compliance that avoided alienating internal developers.
Davide de Paolis describes how Sevdesk's platform team implemented cloud infrastructure compliance by shifting from heavy-handed enforcement to a collaborative, data-driven approach.
Instead of immediately blocking non-compliant deployments, the team used AWS Config, Security Hub, and automated Slack notifications to inform developers gradually before enforcing rules.
The strategy centers on minimum viable governance, focusing on high-impact areas such as resource tagging while building momentum through iteration and transparent communication.
This phased inform-first, enforce-later method achieved compliance goals without creating developer friction.