> Markdown version of [/videos/1426-great-devex-and-regulatory-compliance-possible?t=147](https://www.wearedevelopers.com/videos/1426-great-devex-and-regulatory-compliance-possible?t=147). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Great DevEx and Regulatory Compliance - Possible?

Think balancing fast DevEx with strict compliance is impossible? It isn't. Discover how automated guardrails and golden pathways can seamlessly satisfy both engineers and auditors.

- **Speakers:** [Martin Reynolds](https://www.wearedevelopers.com/@martin-reynolds)
- **Event:** World Congress 2025
- **Published:** August 20, 2025
- **Duration:** 23:26
- **URL:** https://www.wearedevelopers.com/videos/1426-great-devex-and-regulatory-compliance-possible

## Summary

The modern software development lifecycle is notoriously complex, often requiring developers to context-switch across an average of 14 separate tools while navigating stringent regulatory and security requirements. Balancing developer experience (DevEx) with regulatory compliance—such as GDPR or internal auditing—requires a shift from manual bottlenecks to automated oversight. The key to mitigating developer dissatisfaction and accelerating release cycles lies in securing executive sponsorship alongside grassroots engineering champions to seamlessly modernize the internal toolchain without sacrificing security protocols.

To streamline the journey from code to production, organizations must establish "golden pathways" and standard stage gates that offer an integrated, pre-approved workflow. By leveraging an internal developer portal, teams can abstract the friction of scaffolding repositories, attaching CI/CD pipelines, and provisioning infrastructure behind a single pane of glass. A critical component of this methodology is transitioning from manual approval gates to automated guardrails using policy as code. Natively enforcing rules—like validating 80% code coverage or blocking critical vulnerabilities—ensures engineers face significantly less friction while continuously maintaining SLSA compliance. This proactive approach aims to "make it easy to do the right thing and hard to do the wrong thing."

Driving continuous improvement in platform engineering requires rigorous tracking of both quantitative tracking frameworks, such as DORA and SPACE, alongside qualitative developer feedback. Unwavering consistency in how these metrics are measured is vital for actively identifying pipeline bottlenecks without penalizing unique team workflows. By embedding compliance directly into automated workflows and systematically shifting context-rich information left rather than just shifting the toil, organizations can build robust self-service platforms that effectively reduce cognitive load, empower engineering autonomy, and effortlessly satisfy strict regulatory audits.

**Keywords:** developer experience, regulatory compliance automation, internal developer portal, policy as code, golden pathways, DORA metrics, SPACE framework, platform engineering guardrails, automated security scans, SLSA attestation, CI/CD pipeline scaffolding, cognitive load reduction, RBAC governance, software delivery lifecycle

## Chapters

1. **Introduction to DevEx and regulatory compliance** (00:10) — The challenge of delivering software quickly while ensuring robust regulatory compliance.
1. **Current state of software development lifecycles** (02:27) — The impact of tool sprawl, context switching, and manual governance on developer toil.
1. **Standardizing ways of working for developer experience** (05:11) — Establishing clear stage gates and shared practices improves team mobility and delivery speed.
1. **Implementing golden pathways and integrated toolchains** (07:26) — Creating paved paths from code to production reduces cognitive load and ensures consistent deployments.
1. **Enforcing compliance with guardrails and policy as code** (10:21) — Automating security checks through code empowers engineers by embedding standards directly into their workflow.
1. **Measuring success with hard and soft metrics** (12:53) — Tracking progress requires a balance of quantitative frameworks like DORA and qualitative team feedback.
1. **Generating compliant services with internal developer portals** (14:15) — A practical walkthrough showcases self-service workflows automating repository creation, pipelines, and compliance verification.
1. **Key principles for engineering compliance and speed** (22:04) — A final review of strategies concerning unified toolchains, automated guardrails, and platform performance visibility.

## Related Moments

- [Balancing developer self-service with strict compliance requirements](https://www.wearedevelopers.com/videos/1689-empowering-developer-innovation-balancing-speed-security-and-scale) (from "Empowering Developer Innovation - Balancing Speed, Security, and Scale")
- [Why automated compliance matters for developers](https://www.wearedevelopers.com/videos/100181-my-lawyer-merged-my-pr-automating-oss-compliance-at-scale) (from "My Lawyer Merged My PR: Automating OSS Compliance at Scale")
- [Balancing coding productivity with enterprise data governance pipelines](https://www.wearedevelopers.com/videos/100245-theia-ai-live-demo-air-gapped-ai-for-developer-tools-and-ides) (from "Theia AI Live Demo: Air Gapped AI for Developer Tools and IDEs")
- [Summarizing the organizational benefits of platform engineering](https://www.wearedevelopers.com/videos/885-platform-engineering-vs-devops-why-not-both) (from "Platform Engineering vs. DevOps Why not both?")
- [Core principles for implementing DevSecOps in teams](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) (from "DevSecOps: Security in DevOps")
- [Defining developer experience functions within modern engineering teams](https://www.wearedevelopers.com/videos/546-securing-secrets-in-the-gitops-era) (from "Securing Secrets in the GitOps era")

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Now is the time for industrialized software development](https://www.wearedevelopers.com/magazine/601-now-is-the-time-for-industrialized-software-development)
- [Exploring AI: Opportunities and Risks for Developers](https://www.wearedevelopers.com/magazine/522-exploring-ai-opportunities-and-risks-for-developers)
- [Why developer experience matters](https://www.wearedevelopers.com/magazine/514-why-developer-experience-matters)

## Related Jobs

- [Tribe Lead - ( Software) Engineering Centre of Excllence](https://www.wearedevelopers.com/jobs/ext/1475530-tribe-lead-software-engineering-centre-of-excllence) at **SD Worx**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Principal Software Engineer, Enterprise AI Platform](https://www.wearedevelopers.com/jobs/ext/1467292-principal-software-engineer-enterprise-ai-platform) at **GitHub**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Senior Software Engineer, Enterprise Products](https://www.wearedevelopers.com/jobs/ext/1841248-senior-software-engineer-enterprise-products) at **GitHub**
- [Senior Engineer, Infrastructure Platform](https://www.wearedevelopers.com/jobs/ext/328836-senior-engineer-infrastructure-platform) at **Intercom, Inc.**