Interview: DSTRCT Senior Developer¶

Stakeholder: Technical implementation and engineering perspective on workflow, tooling, and feasibility
Date Conducted: [To be filled]
Interviewer(s): [To be filled]
Notetaker: [To be filled]

PREPARATION¶

Goals (Doelen)¶

What do we want to achieve with this interview?

Understand the technical workflow reality: how developers currently handle compliance-related tasks and how they interact with policy/audit systems
Identify tooling constraints, integration pain points, and gaps in the technical environment
Gather evidence about what information is difficult to capture, automate, or validate from a developer perspective
Validate the feasibility assumptions underlying SQ0/SQ1 regarding what can be machine-assisted
Establish the technical constraints and dependencies that any compliance automation solution must respect
Understand what evidence artifacts developers can provide (logs, commit history, CI/CD artifacts, code reviews, deployment records)

Success Criteria:

Developer confirms the key technical workflows (build, test, deploy, integration with external systems)
We have identified at least 3 concrete technical pain points (missing integrations, manual workarounds, data loss points)
We understand what compliance evidence currently exists in the technical environment and what must be added
We have validated that the proposed automation approach is technically feasible and aligns with developer experience
We have artifact examples (logs, CI/CD configs, code samples) to demonstrate evidence capture points

Roles (Rollen)¶

Who is involved and what are their responsibilities?

Interviewer: Research lead responsible for understanding technical depth, validating feasibility, and probing evidence sources
Notetaker: Captures technical workflow details, tool configurations, pain points, workaround patterns, and artifact references; flags integration risks
DSTRCT Senior Developer (Subject): Provides technical perspective on day-to-day workflows, tooling constraints, evidence capture capabilities, and feasibility concerns
Optional Observers: If permitted, DevOps engineer, release manager, or security engineer to provide infrastructure/CI-CD perspective on evidence and integration

Pre-Interview Coordination:

Confirm availability and duration (suggest 75–105 minutes for technical depth)
Request permission to record or take detailed notes (and potentially screenshots of tools/configs)
Ask stakeholder to prepare examples of recent compliance-related tasks, tool outputs, or CI/CD configurations
Offer to provide a preliminary technical mapping based on tool documentation for feedback

Topics (Onderwerpen)¶

What will we ask? What themes will we explore?

Theme 1: Developer Workflow and Compliance Integration¶

Walk me through how you currently handle a compliance-related requirement in your development workflow
What systems or tools are involved (version control, CI/CD, testing framework, artifact repository)?
At what points in the workflow do you need to demonstrate compliance or collect evidence?
Where do manual steps or workarounds currently exist?

Theme 2: Tooling and Integration¶

What development and deployment tools are currently in use (Git, GitHub/GitLab, Jenkins/GitHub Actions, testing frameworks, artifact storage)?
Are there gaps or missing integrations that make compliance work harder?
What data or evidence does each tool capture, and how is it currently retrieved or validated?
Are there external systems (policy engines, audit tools, compliance databases) that should integrate with the development workflow but don't?

Theme 3: Evidence Capture and Traceability¶

What compliance evidence currently exists in your technical environment (commit messages, code review records, test results, deployment logs, audit trails)?
What compliance evidence is missing and currently captured outside the technical environment (e.g., in spreadsheets or manual approvals)?
How difficult is it to reconstruct or audit a specific deployment or code change?
What would be required to make compliance evidence machine-readable and automatically traceable?

Theme 4: Pain Points and Workarounds¶

What is the most tedious or error-prone part of the current compliance workflow?
Are there recurring manual steps that could be automated?
Have you had to work around tool limitations, and if so, how?
What information is lost or duplicated in the current workflow?

Theme 5: Feasibility and Automation¶

Which compliance requirements do you think could be automatically enforced in the build/test/deploy pipeline?
Which requirements would require human judgment and cannot be fully automated?
What would be required to make compliance checks part of the CI/CD pipeline?
Are there regulatory or security constraints that would prevent certain automation approaches?

Theme 6: Data and Artifact Examples¶

Can you show me an example of a recent deployment or compliance-related code change with its associated artifacts (commit, PR review, test results, deployment log)?
What information is captured, and what is missing?
How would you propose storing or querying compliance evidence over time?

Procedures (Procedures)¶

Where, when, how long, and with what logistics?

Location: [To be determined — in-person or remote with screen-sharing preferred for live tool demonstration; access to development/CI-CD environment]
Duration: 75–105 minutes (confirm availability; request focus time without interruption)
Recording/Notes: [Explicit permission requested; notetaker present; optional screen capture or screenshot permission for tool examples]
Setup: Access to development environment, CI/CD dashboard, version control history, and artifact repositories; ability to demonstrate or discuss specific recent tasks/deployments
Follow-Up: Schedule follow-up confirmation call (30–45 min) within 1 week to validate technical understanding and clarify feasibility constraints
Artifacts to Bring/Discuss: Recent commit/PR example, CI/CD workflow config, test report sample, deployment log sample, any compliance-related code or policy examples, list of integrated and missing tools

EXECUTION¶

Pre-Interview Checklist¶

Date, time, and location confirmed with stakeholder
Recording/note-taking and screen-capture permission secured
Agenda shared; stakeholder asked to prepare recent task/deployment examples
Access to development environment or tools arranged (or remote access confirmed)
Notetaker briefed on technical focus areas: CI/CD workflow, evidence artifacts, integration gaps, feasibility signals
Baseline research on tool stack (Git, CI/CD, testing framework, artifact storage) completed

Interview Notes¶

[Record technical workflow details, tool specifics, evidence capture points, pain points, and feasibility constraints below.]

Date: [To be filled]

Attendees:

Environment/Tools Discussed:

Opening Remarks/Context from Stakeholder:

Theme 1: Developer Workflow and Compliance Integration

Findings:

Workflow Steps / Tools Involved:

Evidence/Artifacts Mentioned:

Theme 2: Tooling and Integration

Findings:

Current Tool Stack:

Integration Gaps Identified:

Evidence/Artifacts Mentioned:

Theme 3: Evidence Capture and Traceability

Findings:

Evidence Sources Currently Available:

Evidence Gaps (Missing or Manual):

Evidence/Artifacts Mentioned:

Theme 4: Pain Points and Workarounds

Findings:

Specific Workarounds / Manual Steps:

Evidence/Artifacts Mentioned:

Theme 5: Feasibility and Automation

Findings:

Automatable Requirements (with conditions):

Non-Automatable Requirements (human judgment):

Evidence/Artifacts Mentioned:

Theme 6: Data and Artifact Examples

Findings:

Artifact Examples Reviewed:

Evidence/Artifacts Mentioned:

Post-Interview Analysis¶

Key Findings¶

[Synthesize technical workflow, tooling landscape, evidence sources, and feasibility insights that inform SQ0/SQ1.]

Identified Pain Points¶

[Description, impact on workflow, frequency/severity, automation potential]
[Description, impact on workflow, frequency/severity, automation potential]
[Description, impact on workflow, frequency/severity, automation potential]

Evidence Artifacts and Sources¶

Commit/PR history and metadata (accessible / to be requested)
CI/CD workflow configuration and logs (reviewed / to be requested)
Test results and coverage metrics (reviewed / to be requested)
Deployment logs and artifact metadata (reviewed / to be requested)
List of integrated external systems and APIs (documented / to be requested)
Code review process and approval records (verified / to be requested)
Other: [Specify]

Feasibility Assessment¶

Requirements automatable in CI/CD pipeline: [List with conditions]
Requirements requiring human judgment: [List with compensating controls]
Technical constraints or risks: [List]
Integration gaps to be addressed: [List]

Mapping to Research Questions¶

SQ0 (Existing Work):

What did we learn about current tools, languages, frameworks, and integration points?
What evidence capture capabilities already exist, and what is missing?
What workarounds or manual processes are currently in place?

SQ1 (Meta-Model Definition):

What technical attributes must the meta-model capture to represent compliance requirements and evidence?
What constraints from the technical environment must the meta-model respect?
How must the meta-model integrate with existing tools (Git, CI/CD, artifact storage)?

Follow-Up Items¶

Item: [Action], Owner: [Name], Due: [Date]
Item: [Action], Owner: [Name], Due: [Date]
Item: [Action], Owner: [Name], Due: [Date]

Next Steps¶

[Describe how findings inform next interview, feasibility analysis, or technical architecture step.]