Governance: Could vs. Should

These days, every SaaS conversation eventually turns to AI, automation, and how fast a platform can move. Fair enough, speed is a real advantage. But there’s a scene in Jurassic Park that keeps coming to mind whenever I sit in a product roadmap meeting: Dr. Ian Malcolm points out that everyone was so absorbed in what’s technically possible that nobody stopped to ask whether it should be built that way at all.

That’s the trap a lot of enterprise SaaS platforms fall into. Feature velocity becomes the metric that matters, while governance gets treated as a compliance checkbox to bolt on later. In consumer software, that trade-off is sometimes acceptable, even survivable. In enterprise environments, it isn’t. The data has to hold up in an audit five years from now, not just in a sales demo next week.

Governance is usually framed as something that Legal or Compliance owns. In practice, it needs to be an architectural decision. One that should be made at the schema level, long before any policy document exists.

A few examples of talking points that always come up when building multi-tenant platforms in this space:

·       Data quality needs to always be a design constraint, not a cleanup task. If a platform doesn’t enforce data integrity at the point of entry — asset hierarchies, condition assessments, ownership records. Remember, no amount of downstream reporting will fix it. Governance means deciding architecturally what bad data is not allowed to exist in the first place.

·       Audit readiness has to be native, not retrofitted. Enterprise clients don’t ask, “Can you generate a report?” They ask, “Can you show me exactly who changed this record and why, three years ago?” That requires immutable history baked into the data model from day one, not a logging feature added after a client asks for it.

·       Scalability and governance are the same problem at different volumes. A permissions model that works for ten users often collapses at ten thousand, not because the code breaks, but because the governance assumptions baked into it don’t scale. Multi-tenancy forces this question early, which is uncomfortable, sure — yet it’s much better to face it in architecture reviews than in a client’s compliance audit.

This shows up constantly in shared-but-isolated data models. A client builds something worth reusing, a template, a configuration, or a workflow. The instinct is to let other clients benefit from it. But the moment that asset gets copied into another tenant’s environment, it becomes part of that tenant’s own record: its own audit trail, its own version history, fully decoupled from the original. Get this wrong, and you either lock every client into a silo with no shared learning, or you create a data lineage nightmare where nobody can say for certain which client’s decisions produced which outcome.

Of course, this isn’t really about avoiding risk. It’s about compounding advantages. A platform with genuine governance built in becomes easier to sell into regulated, risk-averse enterprise buyers, because the sales conversation shifts from “trust us” to “here’s exactly how this works.” That’s a real moat. Feature parity is easy to copy. A defensible data governance model, proven in production over years, is not.

As SaaS platforms lean further into AI-driven automation, the gap between “technically capable” and “operationally trustworthy” will widen, not shrink. The platforms that win the next decade in enterprise verticals won’t be the ones that just moved fastest. They’ll be the ones who built governance in from the start, so that speed and trust never had to be traded off.

A lot of SaaS built around AI right now is like Hammond’s flea circus, which he scaled up to island size. Shinier, bigger, more impressive stagecraft, but — it’s still the same underlying con, one misstep away from a T-Rex chase. The platforms that actually win won’t be that. They’ll look more like Brazil’s Carnival: not a stunt, but infrastructure — something real enough to run year after year after year, without anyone needing a helicopter rescue.