1. Technical Support to SOA Governance E-Government Conference May 1-2, 2008 John Salasin, Ph.D. DARPA 571 218-4925 jsalasin@darpa.mil jsalasin@verizon.net

2. Objectives Provide examples of Governance functions that need (should have) automated support. Using functions that one or more infrastructure vendors claim to provide.

3. Outline

4. "specifying the decision rights and accountability framework to encourage desirable behavior in the use of IT.”*  Peter Weill, Richard Woodham, “Don't Just Lead, Govern: Implementing Effective IT Governance”, MIT Sloan Working Paper No. 4237-02, Massachusetts Institute of Technology (MIT) - Sloan School of Management, April 2002 Governance Definition includes “….leadership and organisational structures and processes that ensure that the organisation’s IT sustains and extends the organisation’s strategies and objectives.”

5. Policies (Design/process guidance)  Standards compliance — for example, WS-I Basic Profile compliance for service interfaces  Use architectural assessments, including reviews and change processes  Use architecture documents and guidelines covering use cases, views, service interface design, and design patterns  Use service-based application blueprints  Adhere to reference architectures  Provide policy assertions at multiple levels of granularity

6. SOA Infrastructure Support (Run-time) (1 of 4) authentication and authorization, encryption, logging, auditing and service versioning in a centralized and configuration-driven approach –auditing and logging for compliance enforce architectural standards, guidelines, and processes during design and construction Support continuous evolution through dynamic deployment of BPEL and SOA artifacts and version management at multiple levels of granularity. Execute process persistence policy Provide registry integration by importing WSDL definitions and XML schemas from enterprise stores and publishing new interfaces –Automatically collect and populate the registry / repository with existing services and other assets

7. Support policy assertions for partner interaction WS-Policy assertions at multiple granular levels Web Service invocation retry policy (policy can be programmatically asserted) Setting JMS messaging properties through WS-Policy assertions Support exception management –Process may be suspended on uncaught fault for examination and recovery Provide a (WS-Distributed Management) standard-based secure remote deployment and management interface SOA Infrastructure Support (Run-time) (2 of 4)

8. SOA Infrastructure Support (Run-time) (3 of 4) Deliver the critical traceability necessary for accurate impact analysis, change management, risk management, and optimized reuse Map and manage existing relationships and dependencies that connect services, assets, business processes, policies, and applications Automatically discover, map, and manage new dependencies as the service network expands Support impact analysis with visualization into the composite flow of individual services or applications Keep service metadata up to date through automated introspection –Automatically publishe service metadata, response time statistics, service level objectives, historical statistics, exceptions, and other vital information and key performance indicators –Automate notification of policy changes that affect services

9. SOA Infrastructure Support (Run-time) (4 of 4) Establish visibility into the architecture, relationships, and interdependencies that connect assets to each other, to the policies that govern their use, and to the projects that produce and consume them Collect and communicate information on service performance, quality, and compliance with corporate standards Automate processes to control the creation and registration of services and related assets

10. Value Discriminators Do the Governance-related mechanisms: Cover the complete life-cycle, starting at service conception and extending to services and consumers in the operational environment—including unanticipated rogue services? Provide every stakeholder with a clear, easily understandable view of planned and available services and other software assets to reduce duplication and optimize reuse? Support human, approval-based processes through automated workflow, including community reviews, lifecycle transitions, and change management? Reduce risk and promote trust by ensuring that services and other assets meet standards and guidelines before they are promoted for broader use? Help enforce architectural standards, guidelines, and processes during design and construction? Ensure that projects and the assets they consume align with goals and policies? Communicate both the existing and to-be states of the architecture and track progress?