Analysis: SOA-Aware Network Infrastructure: Page 6 of 14

In principle, SOA governance means ensuring that services are aligned with business processes, from the moment they're planned through to each time they're accessed by a composite application. In practice, it's the least-mature product category in SOA, with most vendors focused more on development than implementation. This isn't surprising: Service cataloging and validation are functions that a governance product can do by itself, whereas enforcement of policies at run-time requires integration with the ESB or services themselves.

The core of a governance platform is the repository, a database that keeps track of every service within the SOA, as well as associated metadata and information about policies. Whenever a new service is added, the repository is responsible for verifying that it complies with policy and conforms to the appropriate standards. Unlike the ESB, the functions governed by the repository usually aren't fully automated; these include steps such as code review and version control. Business rules can be created that require these steps to be performed, but intervention from human developers and testers is still mandatory.

The repository also includes a UDDI (Uniform Description Discovery and Integration) registry, a SOAP Web service that exposes the repository's catalog of services to applications or developers. If the services available have been designed as reusable components that are widely applicable across an organization's business processes, this results in one of SOA's greatest benefits: More agile programming, as developers can put applications together from a registry of existing services rather than write them from scratch.

Because the repository is so closely involved with the development lifecycle, many development platform vendors offer SOA governance products; IBM, Microsoft, Oracle and Sun all offer UDDI functionality within their SOA suites, primarily intended to be used with their own products and ESBs. BEA acquired repository specialist Flashline last year, while IBM and Sun have developed their own registries.

As with an ESB, a single-vendor architecture is appropriate for organizations whose services all run on one platform. A unified setup also means that the governance platform is more likely to be integrated with an ESB, an important consideration if it is to enforce policies at run-time. However, enterprises with multiple app platforms may be better off with a dedicated repository vendor, such as LogicLibrary or Systinet, which is now part of HP Mercury. SOAs with fewer than, say, 15 services can probably get by without a repository--especially if developers have decent source-code versioning systems--as the repository replicates much of that functionality.