SOA governance

Service-Oriented Architecture (SOA) governance is a concept used for activities related to exercising control over services in an SOA. SOA governance can be seen as a subset of IT governance which itself is a subset of Corporate governance. The focus is on those resources to be leveraged for SOA to deliver value to the business. SOA requires a number of IT support processes as well as organizational processes that will also involve the business leaders. SOA needs a solid foundation that is based on standards and includes policies, contracts and service level agreements. The business is expected to be able to use services to build and change the organisations business process quickly. To do so, a degree of granularity in the services available will be required. Consequently an SOA increases the need for good governance as it will help assign decision-making authorities, roles and responsibilities and bring focus to the organisational capabilities needed to be successful.

Definition

The definitions of SOA governance agree in its purpose of exercising control, but differ in the responsibilities it should have. Some narrow definitions focus on imposing policies and monitoring services, while other definitions use a broader business-oriented perspective.

Anne Thomas Manes defines governance as: “[T]he processes that an enterprise puts in place to ensure that things are done ... in accordance with best practices, architectural principles, government regulations, laws, and other determining factors. SOA governance refers to the processes used to govern adoption and implementation of SOA.”

The specific focus of SOA governance is on the development of services that add value to the business, effective SOA governance must cover the people, processes, and technologies involved in the entire SOA life cycle from business point of view and connectivity and reuse from IT point of view, thus aligning business with IT.

To quote Anne Thomas Manes again: “SOA is about behavior, not something you build or buy. You have to change behavior to make it effective.”

Gartner defines SOA Governance as “Ensuring and validating that assets and artifacts within the architecture are acting as expected and maintaining a certain level of quality.”

ISO 38500 describes a framework with six guiding principles for corporate governance of information technology and a model for directors to govern IT with three main tasks: evaluate, direct and control. ISO 38500 differentiates between "Governance", "Management" and "Control".

Scope of SOA governance

Some typical governance issues that are likely to emerge in a SOA are:

• Delivering value to the stakeholders: investments are expected to return a benefit to the stakeholders - this is equally true for SOA
• Compliance to standards or laws: IT systems require auditing to prove their compliance to regulations like [Sarbanes-Oxley]. In a SOA, service behavior is often unknown
• Change management: changing a service often has unforeseen consequences as the service consumers are unknown to the service providers. This makes an impact analysis for changing a service more difficult than usual.
• Ensuring quality of services: The flexibility of SOA to add new services requires extra attention for the quality of these services. This concerns both the quality of design and the quality of service. As services often call upon other services, one malfunctioning service can cause damage in many applications.

Some key activities that are often mentioned as being part of SOA governance are:

• Managing the portfolio of services: planning development of new services and updating current services
• Managing the service lifecycle: meant to ensure that updates of services do not disturb current service consumers
• Using policies to restrict behavior: rules can be created that all services need to apply to, to ensure consistency of services
• Monitoring performance of services: because of service composition, the consequences of service downtime or underperformance can be severe. By monitoring service performance and availability, action can be taken instantly when a problem occurs.