The platform team should own the golden path as a product, the security team should own what the policies say and why, and product teams should be able to contribute. That split keeps the road usable and the rules sound, and it avoids the gatekeeping pattern DORA warns about.
Why one team alone struggles
If security owns the whole road, it tends to become a gate: rules arrive from outside, and developers see it as someone else's list. DORA calls this the ivory tower approach, where a central team acts as gatekeeper rather than enabler and teams respond with workarounds.
If the platform team owns everything without security input, the road may be pleasant but miss important controls.
A workable split
| Area | Platform team | Security team | Product teams |
|---|---|---|---|
| Templates and pipelines | Owns and maintains | Reviews security steps | Give feedback, propose changes |
| Policy content (what blocks) | Implements it | Owns the rules and rationale | Raise cases where a rule does not fit |
| Exceptions | Provides the mechanism | Approves or sets criteria | Request with a reason |
| Metrics | Adoption and satisfaction | Risk and coverage | Report friction |
| Support | Day to day questions | Security questions | Share fixes |
DORA recommends assigning a product manager to focus on developer experience and building a roadmap from a deep understanding of developer needs. The CNCF platforms white paper similarly treats the platform as an internal product and notes that platform teams consolidate management of common functionality, which makes governance easier.
Keep the roles light in a small company
In a small company one person may wear both hats. Even then, separate the questions: "does the road work for developers?" and "do the rules protect us?" Reviewing them on different days stops one from drowning out the other.
Questions to settle in writing
- Who decides when a check moves from warn to block?
- Who can grant an exception, and for how long?
- Who is on call when the shared pipeline breaks?
- How does a product team propose a change to the road?
DORA also notes that a central team cannot and should not build everything, so a clear contribution model prevents the platform team from becoming a bottleneck.
Handling disagreements
Disagreements are normal: security wants a check to block, and a product team says it is too noisy. Settle them with evidence. Pull the false positive rate, the time cost and the risk, and decide together. Record the decision so it does not resurface every quarter.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings sit in one shared view, which is what makes the platform and security split workable.
Where Safeguard fits
Safeguard provides policies, gates and compliance evidence automation, so security can own the rules while the platform team wires them into pipelines. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Should security sit inside the platform team?
Some companies embed a security engineer in the platform team, others keep a separate team with a standing review. Either can work if the policy owner and the road owner are clear.
Who pays for maintaining the road?
Treat it as a funded product with a roadmap. An unfunded road decays, and developers notice quickly.
Sources
Last reviewed: 19 October 2026.
