The best software factory is a product-run platform with one golden path, not a ticket queue
Asked:
“what is the best way to set up a software factory”
Evidence below draws on 18 guidance rows from 9 independent sources — DORA, CNCF, NIST, SLSA, Google SRE and Cloud, Microsoft, AWS, and Martin Fowler — covering nine capabilities from operating model to measurement; the most-cited single source backs only 2 of 18 rows, so no finding rests on one voice. Universal principles are separated from vendor-specific implementation examples (AWS and Microsoft rows are implementation illustrations).
The target operating model: one golden path, platform as a product, guardrails embedded
Hover or tap any stage for what it must include and the source behind it. Blue boxes are the developer's golden path; the platform team band supplies it as a product; policy, identity and provenance run inside every stage, not as a gate at the end. The telemetry stage feeds back to product teams (dashed arc).
Product teams own services in production; a durable, continuously funded platform team owns the paved road — never a ticket queue or a new silo. martinfowler.com
Centralized CI/CD for production builds is the most-established supply-chain practice (63% of respondents), and teams scanning during CI were nearly twice as likely to find a real vulnerability. dora.dev
Golden paths must stay optional but be the fastest compliant route; co-develop each template with at least two teams and track adoption, not mandates. cloud.google.com
Map the value stream and attack the biggest constraint first — elite performers deploy on demand, lead time under a day, restore in under an hour, 0–15% change failure rate. dora.dev
The first 90 days
Days 0–30 — baseline
Appoint a platform product manager and a small cross-functional platform team
Pick 1–2 representative pilot teams
Value-stream map commit-to-production and incident recovery
Baseline DORA metrics, reliability, provisioning lead time, developer experience
Define the one target job and its SLOs
Days 31–60 — one thin path
Build one end-to-end golden path and a platform API
Integrate existing source control, CI/CD, registry, IaC, identity and secrets, policy, observability, docs and catalog
Automate a production-like test environment and safe deployment with rollback
Add minimum security controls and ownership metadata
Days 61–90 — pilot and decide
Onboard pilots with white-glove help; ship real changes
Measure outcomes against the baseline; remove friction
Document and publish the path; set up support, contribution and exception processes
Scale only if lead time or toil drops without hurting stability
Scorecard: measure outcomes per service, never output
Track DORA's delivery metrics — change lead time, deployment frequency, failed-deployment recovery time, change fail rate — plus reliability and SLO attainment, platform adoption (services on the golden path), provisioning and onboarding time, developer-experience surveys, and a business outcome per team. Never use lines of code, ticket counts, tool counts or utilization as goals: optimizing for utilization lengthens end-to-end cycle time.
Anti-patterns that sink software factories
Buying a portal and calling it a platform; copying all tool data into it instead of deep-linking
Building every capability before one usable end-to-end path exists
Mandating adoption too early — keep paths optional until mature
The platform team becoming a ticket queue, gate, or center-of-excellence silo
Bespoke pipelines per team; production builds on developer laptops
Long-lived credentials and manual change approval boards
Tool-count, utilization or lines-of-code metrics as productivity goals
Optimizing AI code generation before fixing downstream constraints
Evidence by capability
Capability
Recommendation
Caution
How to measure
Source
Method: 18 guidance rows selected from live web research on 2026-10-24 across 9 independent hosts (DORA, CNCF, NIST, SLSA, Google, Microsoft, AWS, Martin Fowler, Backstage-adjacent sources); each row carries a recommendation, implementation guidance, caution, and measure tied to one source URL. Numbers quoted (63% centralized builds, elite DORA thresholds) come from the cited reports. Implementation details were shortened for space; full text sits in the source pages. No single URL backs more than 2 rows (11.1%).