Policy Federation and SOA Governance

1. Policy Federation and SOA Governance

2. Introducing: Miko Matsumura • VP of Technology Standards, Infravio • VP of Marketing, Infravio • Chair of OASIS SOA Adoption Blueprints • VP of SOA Product, webMethods • Chief Java Evangelist, Sun Microsystems • Software R&D at Hotwired • Limited Partner, Focus Ventures • Advisor, TogetherSoft, Asia Java Fund, Kendara, Dejima • M.S. in Neuroscience from Yale University (Neural Networks research) • MBA, San Francisco State University

3. Who is Infravio? Infravio is The SOA Governance Company. Founded in 1999 Headquartered in Cupertino, CA Approx 20 people in the US Development in Chennai, India Approx 50 people in India X-Registry Platform 6 SOA Governance Registry Repository Platform Top rated SOA Governance platform (Infoworld Labs Review) One of the only vendors that looks at SOA lifecycle properly (MWDAdvisors) “the state of the art in SOA today.” (Loosely Coupled) “Infravio is ahead of the competition with X-Registry.” (Zapthink)

4. Current Customers Telecommunications Sprint-Nextel British Telecom SwissCom NTT IONA MCI IPT Level3 SRA Government: Texas HHS Texas Legislative Council State of Minnesota DPS Government of Quebec National Academies Healthcare: Providence Health System Aventis Integris Finance/Insurance Allianz Life Defense Lockheed Martin JFCOM Travel Sabre Manufacturing Alcoa WW Grainger

5. SOA Governance

6. Interdependent Applications Interdependent Departments Reuse Creates Interdependence Interdependence can destroy agility Interdependent Companies Virtual Enterprise Data Center ERP HR Distributors Outsourcer Mfg. Plant Sales Branch Big Customers Subsidiary Purchasing Suppliers Shipping Dept. Suppliers Customers Consumers How can you change anything when everything is tied together!? Enterprise Contact Center

7. When everything is tied together… Changing IT Systems is slow and error prone! Policies are not being enforced! Change Processes are a mess! Can’t See what’s happening in my SOA? Can’t Trust Services I don’t control! Can’t Manage SOA Policy Enforcement! Can’t Find Services to reuse?? Can’t Understand how to use these! Services don’t work together!

8. Federated SOA Governance

9. What is Service Oriented Architecture? “Service Oriented Architecture is a paradigm for organizing and utilizing distributed capabilities that may be under the control of different ownership domains. It provides a uniform means to offer, discover, interact with and use capabilities to produce desired effects consistent with measurable preconditions and expectations.” OASIS SOA Reference Model Technical Committee

10. Why SOA Adoption Might be Good • Central IT Benefits • Consolidation • Reuse • Compliance • Business Unit Benefits • Agility and Flexibility • Business Visibility • Process Integration • Shared Benefits • Business/IT alignment

11. SOA BenefitsStatements • Strategic Benefits • KPI Improvements and/or ROI ROM Estimates

12. More Groups Adopting Might be More Good • Lifecycle Stakeholders • Architects • Developers • Quality Assurance • Provisioning and Deployment • Administrators • IT Operations staff • Service Consumers • Business Users • Centralized vs. Distributed Stakeholders • Central IT • Business Units • External Stakeholders • Regulators • Customers • Suppliers • Partners

13. SOA Adoption Challenges • Hoarding • Lack of Trust • Externally Imposed Rules • Loss of Control • Assigning Blame • Compromises • Distribution of Burden • Distribution of Incentives

14. SOA Governance • What is Governance? • Governance is the art and discipline of producing managed outcomes through structured relationships, procedures, and policies. • What is unique about SOA Governance? • SOA governance is half human, half machine • The relationships, procedures and policies of SOA are defined by organizational processes • These policies also in part described, enforced and automated by technology systems. • Why is SOA Governance Important? • SOA systems are highly interdependent • Multiple ownership domains, multiple policy domains • Each incident of “Reuse” creates additional dependencies

15. Rearchitecting Silos at HMRC IT Capabilities ‘Horizontal’ business capabilities NO MORE SILOS As-Is NO MORE SILOS To-Be Unified customer identity management, case management and tax / benefit rules administration Automation per regime Automation of Shared functions Common charge management, debt management based upon a single customer account SA SA PAYE CB VAT PAYE CB VAT contact contact case case TO liability liability Business process automation that allows work to be processed regardless of location compliance compliance charge charge debt debt Infrastructure and applications that can support new ways working Ready for cross-government shared services These will enable common shared business functions

16. Physical Architecture View (EA) for 2011 - DRAFT Channel Components Risk, Compliance, MIS, BPM Integration Internal Portal Telephony Paper External Portal B2B Integration ESB Identity Components Risk Assessment Identity Management Registration Identification Authentication Authorisation Government Gateway SAP Siebel Pega CIS-x Tivoli/CA/etc Government Gateway SAP Siebel Pega CIS-x Tivoli/CA/etc Government Gateway SAP Siebel Pega Government Gateway SAP Siebel Pega External Gateways CIS-X SAP MDM MIS Customer Relationship Management Components SAP Internal Integration Campaign Management Advisor Workflow Navigation, Data Entry&Supply Customer Contact Management Call Centre Application Front Office Netweaver XI BPM Extract Transform Load Customer Interaction & Orchestration Components Shared Workspace Operational Reporting Enterprise Content Management Interactive Guidance Application Overall Transact. Orchestration Rules & Validation Processing Informatica, Oracle Streams Internal File Transfer Generic Application Components Transfer Manager Change of Circumstances Comply In/Out Data Provisioning Contact In/Out Collaboration Regime Components PayAsYouEarn / National Insurance Self Assessment Corporation Tax Frontiers National Tax Credits VAT Excise Others PAYE Core NI Core SA Core Application Processing CT Core ProcessReturn Stamp Duty VAT mainframe NIRS Bespoke Application NIRS Bespoke Application Not addressed yet CT Work- management Calculate Duty PAYE/NI specific MIS PAYE/NI Work Management Work Management Entitlements & Awards Calculation Middle Office Business Objects PEGA Rules CalculatePenalty/Interest PAYE/NI – SA Shared Needs deciding Personal Tax Core Maintain Tax/Allow& Deductions Tax calculation Duty Deferment NIRS Bespoke Application NIRS Bespoke Application NIRS Bespoke Application BackOffice Components decided Integrated Trust Accounting Debt Management & Banking Single Financial Account Receipts and Payments Finance Procurements HR Estates & Others Back Office

17. Managed Outcomes • Step One: Establish top level goals and outcomes • Measurable goals • Metrics Reporting and Auditing • Step Two: Establish policies and contracts • Accountability, adjudication, responsibilities • Interoperability Standards • Service Lifecycle Processes • Security Policies • Step Three: Build the Foundation • Assign ownerships, budgets and responsibilities • Develop Organizational Tools (CoE, chargebacks, shared services org) • Establish federated systems of record for policies, contracts and services • Automate governance processes

18. SOA Governance Foundation

19. INFRAVIO X-Registry Platform

20. Registry and Repository “System of Record” Federated UDDI and ebXML Cross-Lifecycle Governance Auditing Multi-Tenancy Access Controlled Managed Lifecycle Processes Federated Lifecycle Promotion Portal-based UI for external/internal access Design Time Governance Automated Artifact Validation Robust classification, attributes, service profiles Run Time Governance Interoperability with disparate run time intermediaries BAM and Monitoring Change Time Governance Impact Analysis Change Notification What is it?

21. X-Registry Platform

22. Source Asset Repository UDDI Registry ESB/ WSM/ Broker Enterprise System Console Portal Business Process/ Contracts Lifecycle Governance Rules and Processes Access Control Policies Security Policies SOA Information Model and Metadata Repository Metadata Lifecycle Ecosystem Design Time Run Time Change Time Lifecycle Stage Organization Ecosystem Component Metadata Governance Mechanisms

23. Lifecycle Governance Rules and Processes Access Control Policies Security Policies SOA Information Model and Metadata Repository Multiple Groups, Same SOA Data

24. Federated Multi-Organization View

25. Governance Lifecycle

26. Design Time GovernanceService Developer Role • Service Discovery Features • Service Description Profiles • Browse by taxonomy • Advanced attribute-based search • Supports Vertical Taxonomies (e.g. eTOM, etc.) • Service Publishing Process • Wizard-based publishing process • Content Validation (e.g. UDDI, WS-I conformance) • IDE integrated UDDI publish option • Workflow-driven approval/notification • Platform Extensibility • Governance API • JAXR Java API for XML Registries • UDDI version 3 • ebXML version 2 • JSR Compliant Governance Rules Engine • Custom content validation callout

27. Run Time GovernanceIT Operations Role • Service Provisioning and Access • Service Level Agreements • Approvals and Rejections • Limited access to services w/o approval • Service request lists • Consumer data collection • Runtime Contract/Policy Enforcement • SLA Management • Service Delivery Contracts™ • Consumer Authentication • Run Time Version Management • Security Management (WS-Sec, etc) • Request/Response Routing Management • Failover/LoadBalancing Routing Management • Logging and Monitoring Management

28. Change Time GovernanceBusiness User Role • Business Activity Monitoring • Report Generation Capabilities • Performance metrics integrated with repository • Runtime metrics warehousing • SLA Performance measurement • Email Performance/SLA Alerts • Service Change Governance • Service Change Subscription (expression of interest) • Service Binding Subscription • Service Metadata Subscription • Email Change Notification • SOAP Notification • Synchronous/Asynchronous Notification • Service relationship and dependency management • Impact Analysis • Change Time version management (deprecation, migration, expiry, etc.)

29. X-Registry Policy Enforcement Policy Authoring Policy Enforcement X-Registry X-Broker or External

30. Infravio Service Delivery Contract™ American Airlines Bank of America Comcast Contract Terms: • Security Terms(e.g. Authentication, Authorization, Encryption ) • Operational Terms (e.g. Logging, Monitoring, SLA, Alerting, Reporting, Routing) • Routing Terms(e.g. Load Balancing, Fail-over, content based routing) • Lifecycle Terms (e.g. Versioning, Deprecation Rules) • Business Terms(e.g. Billing and Metering, Business Activity Monitoring) • Data terms(e.g Transformations, Caching) • Reliable Delivery Terms (e.g. Messaging, Transport Protocol, Transactions Integrity) • Custom Terms(i.e. user defined terms) Contract A Contract B Contract C Delivery Security Transformation Transaction Versioning Transport Routing Delivery … … … … … … Delivery … … … … … … Operations SLA Alerts Notifications Operations … … … Operations … … … Provider System Services

31. Federation • Example: Promotion of a service from a staging instance to production • Technical • Synchronization • Governance Automation • Access Control • Delegated Authority Models • Business • Distributed Policy Authoring • Policy Reconciliation

32. Award Winning INFRAVIO X-Registry Platform 5

33. SOA Maturity and Governance

34. SOA Scope vs Governance SOA Scope & Benefits • Where are you now? • Business Objectives • Architecture & Technologies • Governance & with IT Process • What do you want to be? • Vision • How will you get there? • Pragmatic Plan for Evolution Governance & Maturity

35. Adopting Service-Oriented Architecture: Business and IT Drivers • M&A/divestitures • Multichannel sales/support • Time to market • Continuous innovation • Process flexibility • Process visibility "Top Down" Enterprise Drivers "Perennial" IT Challenges • "Doing more with less" • Business/IT alignment • Data consistency/quality • Time to deployment SOA • Call center integration • Single face to clients, suppliers, employees • Process integration • Real-time B2B "Bottom Up" Business Unit Drivers

36. SOA Adoption: Benefits and Implications Benefits Implication • Higher Upfront Costs • Cultural change • Infrastructure (SOA backplane) • More formal methodology • Longer design time for services • Testing (unit/end-to-end) • Architectural Partitioning • Diverse life-cycle "speeds" • Synergy of different technologies • Optimal tech skills allocation • Processes visibility • Greater maintainability • Easier outsourcing/"offshoring" • More Distributed Infrastructure • Extensive use of middleware • Transaction management • Debugging/troubleshooting • End-to-end management • More granular security • Metering/logging • Incremental Deployment • Gradual migration • Cost "spreading" across projects • Reduced maintenance cost • Sharing (Reuse) of Services: • Faster time to deployment • Lower development cost • Greater adaptability • Tighter Management/Governance • Ownership/accountability • Cost allocation • Prioritization/conflict resolution

37. Stages of SOA Adoption Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau Address Specific Pain (e.g., Customer Portal) Process Integration (e.g., B2B) Process Flexibility (e.g., Time to Market) Continuous Adaptation & Evolution Business Goals Leverage Services Sharing Establish Technology Platform Proof of Concept Enterprise SOA Infrastructure IT Goals Multiple Applications (Cross BUs) Multiple Applications (Single BU) Single Application Virtual Enterprise Scope # of Published Services* # of Service Consumers* Total Service Calls/Day* # of Service Developers* <25 <100 <500 >500 <5 <25 <50 >50 <10,000 <100,000 <1,000,000 >1,000,000 <10 <20 <100 >100 Enabling Technology (cumulative) SOA Reg/Rep BPM Policy Mgmt ESB, WSM Integr. Suite, B2B Application Server, Portal, Adapters Enterprise SOA Backplane * =These figures represent typical scenarios, but they may vary considerably depending on the specific organization’s requirements.

38. SOA Adoption: Required Management Buy-In per Stage Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau Head of Development or Head of Integration P P P P CTO/Head of Architecture O P P P Head of IT Operations O P P CIO/Business Units P O P CEO O P • = Imperative O = Recommended

39. SOA Adoption: Required Technology Skills per Stage Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau Basic Middleware P P P P Web Services P P P P Integration Middleware P P P O Service Oriented Development of Applications (SODA) P P O Business Process Management O P P SOA Operations Management O P P • = Imperative O = Recommended

40. SOA Adoption: Required Capabilities per Stage Stage 1 Introduction Stage 2 Spreading Stage 3 Exploitation Stage 4 Plateau P O P P SOA Center of Execellence Services Life Cycle Mangement O P P Service Design Methodology O P P Planning Control and Quality Management O P P Service Reuse Methodology O P P Operation Management O P P O P Domains O P Cost Allocation Schema Consistent Enterprise-wide Governance Processes O P Enterprise-wide SOA Backplane O P • = Imperative O = Recommended

41. Trusted Operations Fabric

42. INFRAVIO X-Registry Service registry Policy Repositories Metadata Repositories X-Broker and SOA Link Partners Middleware Service Service Service platform Service platform Web Services Framework Standards INFRAVIO X-Registry Platform Burton Group SOA Reference Architecture Service mediation systems Acceleration Routing Transform Security Other Service management SOA Link

43. Intermediary Consumer D Consumer C Consumer A Consumer B Consumer E Service B Service A Service C Intermediary Can Load Balance… Consumers and Services are now “loosely coupled”

44. Consumer D Consumer C Consumer A Consumer B Consumer E Service B Service A Customize Service Delivery… ! ? + $ * Based on Capabilities, Limitations and Preferences of Consumers Intermediary Contract Service C

45. Intermediary Consumer D Consumer C Consumer A Consumer B Consumer E Service B Service A Service C Feed Operational Consoles…

46. Intermediary Consumer D Consumer C Consumer A Consumer B Consumer E Service B Service A Service C Assure Service Level Agreements… Higher priority Consumers get preferred access

47. Intermediary Consumer D Consumer C Consumer A Consumer B Consumer E Service B Service A Service C Enforce Security Terms… Intermediary can enforce security and compliance

48. Contract A Contract A Delivery Security Transformation Transaction Versioning Transport Routing Operations SLA Alerts Notifications Policies Enforced by Intermediary American Airlines Bank of America Comcast Authenticate Engage Contract Access Service Intermediary Sprint Trouble Ticket Service

49. Contract A Contract Delivery Security Transformation Transaction Versioning Transport Routing Operations SLA Alerts Notifications Contracts (Operational Configurations) Process Flows Security & Access Control Governance Rules Who Controls Metadata Controls SOA. The Registry Repository allows the fastest changing elements of IT infrastructure to be externalized as metadata

50. Case Study: Sprint Nextel