Our business unit is currently transforming into an agile organization, forming long-lived product/process-centric teams - I will refer to them as squads. However, coming from a very governed, gated, waterfall model, there's some shared teams that currently are still required to give approval for changes. The most obvious of these gates are: Information Protection, Architecture

Ideally, we would have a representative of these teams in each of the squads, but

  1. they don't have enough resources
  2. there probably isn't enough work for them in a single squad to warrant a full-time resource

I'm seeing the following options

  1. keep the gates as they are now. This would mean that every change will need to get formally improved by these teams, and the work can't start before that stamp of approval is received. Previously, they would give that approval on a project basis, now they would have to start doing that on feature or story level. I'm assuming that this will introduce a massive delay, which sounds very sub-optimal
  2. try to convince the teams in having a representative in some recurring meetings, where they can either directly give the approval (per story/feature/epic) or identify some take-away work for them. Backlog Refinement is most likely the best moment for this. This would mean that these teams should at least make them available once per week, per squad. Not sure what should happen if they decide not to show up. It probably would mean that Definition of Ready is not met, and work can't start.
  3. move the approval gate from "before the work starts" to "before the increment is released into production". This would allow squads to make assumptions regarding security, design, etc - and it will be up to the Architecture & Security Protection team to make sure they conduct a review at any time before it goes live. Maybe they can attend Sprint Review sessions, or they can conduct offline reviews however they see fit. The risk I'm seeing here is that their feedback might come quite late into the process, resulting in more rework than needed. Additionally, it also feels like a delay in creating value, just in a different part of the process.

Which of these options make most sense, or which option am I not thinking about? Are you working in similar set-ups, and do they work? All feedback and/or reading material is greatly appreciated!

  • Eventhough you already have some answers, I would like to ask this: You mention in option 1 that you assume there will be massive delay. On this I base the assumptium that you are not working like this yet. Would it be an option to do it as is and then make the pain visible? Making the pain visible can be done in several ways, e.g. monitor the time between a sending an approval request and the response between it. If that takes 2 weeks, you cleary show what the problem is. Then you can start working on a solution
    – Bart
    Mar 11, 2020 at 7:00

2 Answers 2


If I had anything to say about it, I would aim for a variation of your option 2.

During the refinement meetings of each squad, a team member from the Architecture & Security Protection team joins the meeting to identify which stories need explicit approval from the Architecture & Security Protection team and which stories don't.

Then, when somebody starts to work on a story that needs explicit approval, they would first create a design and discuss that with the Architecture & Security Protection team before starting to write actual code.

In my perception, a large portion of the stories probably don't need the formal approval, because their changes don't touch on architectural or security issues.
For the stories that do need approval, the process can be made faster by preparing a proposal within the squad and reviewing that.

  • Fully agree with that approach. They don't have to solve the design, but just need to indicate where they think approval or explicit work for them is needed. The problem with this approach is that both the SP and Arch team are saying that they don't have time to be in the refinement sessions of our (5) squads. What we're currently trying to aim for is that both shared service teams agree with empowering the squads to decide whether formal approval is needed for a story or not. This sounds like an ideal situation, but I'm a bit afraid that this will hit us in the face if stuff goes wrong. Mar 10, 2020 at 12:43
  • @JorisVanRegemortel, then you should get the management layer above the SP and Arch team involved and discuss with them the possible choices. They should have the power to either increase the SP and Arch team or to delegate part of the responsibility to the squads. Mar 10, 2020 at 13:45
  • I'm currently going for your second option: empower the squads to independently assess whether more involvement and/or explicit approval from SP and Arch are needed. We will take that assessment up as part of the Definition of Ready of every squad, so it should count as an explicit control for our internal auditors. If we can get that in place, I think that would be a fairly agile process. Thanks a lot for your suggestions! Mar 10, 2020 at 13:49

Scrum of Scrums facilitates cross-team coordination

Your second option:

try to convince the teams in having a representative in some recurring meetings

is a well established scaling approach called Scrum of Scrums. Here is one reference by Mike Cohn outlining this approach.

You are rightly perceiving the risk in the third option:

The risk I'm seeing here is that their feedback might come quite late into the process

I wouldn't recommend this approach at all. Trying to get approval even though the requirements are not known, is a formula for disaster.

  • We do have a scrum of scrums, but they don't touch on each story on the backlog, they only talk about stories/features where there are dependencies between squads. However, if the shared service teams are okay with allowing squads to decide whether they think formal approval is needed, the scrum of scrums could be a good moment to go over the stories that have been flagged with that "formal approval request". However, I feel like it might be better to assign stories that require formal approval directly to the shared service teams. Mar 10, 2020 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.