>> Decentralize decision-making authority as much as possible. Remove barriers in their way, slash approval layers, attack dependencies.
> This is awful advice. You can only operate in this mode for at best 2-3 months before your entire SDLC grinds to a halt because it's been the wild west in github.
If that happens, you decentralised more than was possible ("as much as possible" doesn't mean "completely"). You removed too many important barriers. A bit more concretely, you gave authority to those that weren't capable of handling it, or weren't supported properly. You removed an approval layer without supporting your team to check these things for themselves.
The idea is that you should already have the decision in the right way, if you push more towards decentralization then you are already in the danger zone. Yes, you should not do that.
I think the advice is based on "peace time" management, during more comfortable profitable times, leaning towards more centralised control. There's no appetite for the risk of moving faster by removing approval bottlenecks or changing processes.
The advice here is to challenge what actually needs to be centralised.
Identify things that could be safely delegated. For example, why does a list of managers and an exec need to approve a $10 per month subscription that saves a bunch of engineering time by managing cascading PR merges?
And identify safe ways to delegate. For example, if we move container image vuln scanning into CI/CD pipelines, the dev team can update dependencies themselves without a security team being involved to do it for them and approve.
These might seem like silly examples to someone working at a half decent start up or tech first org. But these kinds of centralised control structures are the norm for most large organisations until they are very strongly challenged.
If that happens, you decentralised more than was possible ("as much as possible" doesn't mean "completely"). You removed too many important barriers. A bit more concretely, you gave authority to those that weren't capable of handling it, or weren't supported properly. You removed an approval layer without supporting your team to check these things for themselves.