A template is a starting skeleton, a golden path is a template plus documentation and tooling for a whole journey, and a paved road is the broader set of easy, supported ways to do things. A golden image is a prebuilt machine or container base. They overlap, but they are not the same thing.
Definitions
| Term | Plain definition | Dependency security example |
|---|---|---|
| Template or skeleton | Starter code with variables filled in at creation | Repo with a lockfile and update config |
| Scaffolder | The tool that runs a template and publishes the result | A create button that opens a new repository |
| Golden path | A template bundled with documentation, often covering build, scan, test, deploy and observe | Service template plus pipeline plus scan and gate |
| Paved road | The set of supported, easy options across the platform | Approved registries, base images and checks |
| Golden image | A prebuilt, approved base image | Approved runtime image refreshed on a schedule |
| Guardrail | A control that limits unsafe choices without removing choice | Merge gate on new critical findings |
The CNCF platforms white paper describes a reusable supply chain workflow for building, scanning, testing, deploying and observing an application, offered with an initial project template and documentation, as a bundle often described as a golden path. Backstage's documentation describes its software templates as loading code skeletons, templating in variables, and publishing to places such as GitHub or GitLab. That is the scaffolder idea in practice.
How the pieces fit
Think of layers. The golden image sits at the bottom. The template builds on it. The golden path wraps the template in a pipeline and docs. The paved road is the whole network of those supported routes. Guardrails run across all of them.
Why the words matter
Teams talk past each other when one means "the template" and another means "the whole supported way of working." That leads to disputes like "the golden path is mandatory" when the speaker really means "the merge gate is mandatory." Decide which one you require.
A useful rule: require guardrails, recommend paths. A guardrail protects outcomes regardless of how the service was created. A path makes the guardrails easy to satisfy. See what a paved road is and whether it is a guardrail.
What a platform team should publish
- One page listing each term as your organization uses it.
- The list of guardrails that apply to every service.
- The list of paths that are available, and which languages each covers.
- How to request support for a language or runtime you do not cover.
- Where the golden images live and how often they are refreshed.
Common mix-ups
- A template is not a policy. It does not stop someone deleting the lockfile later.
- A golden image is not a vulnerability free image. It is a known one; keep scanning.
- A paved road is not a mandate. Teams may leave it with an expiring exception.
See also what a golden image is and secure by design versus a paved road.
Where Safeguard fits
Safeguard supplies guardrail style controls for dependencies: policies and gates, SBOM and dependency scanning, and continuous monitoring. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is a golden path mandatory?
That is a policy choice. Many teams require guardrails and recommend the path.
Is a golden image the same as a template?
No. An image is a base for running software; a template is a starting skeleton for a project.
Sources
Last reviewed: 19 October 2026.
