Most organizations have the same bottleneck: the list of software the business wants is far longer than the list IT can deliver. The backlog grows, teams route around it with spreadsheets and disconnected tools, and shadow IT quietly becomes a risk nobody owns. Mendix offers a way out – not by replacing your engineers, but by letting the people closest to the problem help build the solution, inside guardrails your IT team sets. Done well, that is governed citizen development, and the structure that makes it work is a Center of Excellence (CoE). This is a practical game plan for standing one up.
The problem: app demand outruns IT capacity
The demand for internal applications – portals, workflows, dashboards, approvals, integrations – keeps climbing, and a central IT team cannot absorb all of it. Meanwhile the people who understand the process best (the underwriter, the plant supervisor, the operations analyst) are the furthest from the tools to fix it. So they wait, or they build fragile spreadsheets that later become someone else’s problem.
The instinct to “just let people build their own apps” is right in spirit and dangerous in practice. Ungoverned, it produces exactly the sprawl, security gaps, and unmaintainable one-offs that gave earlier low-code experiments a bad name. The answer is not less building – it is governed building.
Citizen development, done right (governed, not a free-for-all)
A citizen developer is a business person – an analyst, a domain expert, a “spreadsheet wizard” – who builds applications on a platform IT has vetted, using standards and building blocks IT provides. The distinction that matters is not who touches the tool; it is who owns the guardrails. In a governed model, IT sets the platform, the standards, the security model, and the release process. Business builders work fast inside that frame, and everything they ship is reviewed before it reaches production.
This reframes technical oversight from a brake into an enabler. Good low-code governance is a set of guardrails designed to make the right choice the easy choice and the wrong choice hard to make – so more people can contribute without more risk. Oversight is what makes citizen development safe to scale, not the thing that slows it down.
What a Mendix Center of Excellence is (and what it owns)
A Center of Excellence is the small, IT-run team that owns how your organization builds on Mendix. It is not a project team; it is the group that makes every project safer and faster. A CoE typically owns:
- The platform and environments – Mendix licensing, environments, deployment targets, and the path from development to test to production.
- Standards and guardrails – naming conventions, architecture patterns, security rules, and the review gates an app passes through before release.
- A reusable foundation – shared templates, building blocks, a design system, and approved connectors, so builders start from 70% rather than a blank canvas.
- Governance and oversight – who can build what, portfolio visibility, security and dependency checks, and audit trails – the things that keep the estate maintainable and compliant.
- Enablement – training, onboarding, office hours, and a community that turns interested specialists into capable, safe builders.
Mendix organizes this journey into three stages – start, structure, and scale – and its governance framework frames the goal as two kinds of control: risk control (build sustainable software within acceptable risk) and investment control (maximize return on the platform and measure the business outcomes). Both matter to the people signing the cheque.
The roles: who governs, who builds
A workable CoE does not need to be large to start. The core roles:
- CoE lead – owns the program, the standards, and the relationship between IT and the business.
- Platform owner / architect – owns the target architecture, environments, security model, and integration patterns.
- Lead (professional) developers – build the hard parts, own the reusable foundation, and review what citizen developers produce before it ships.
- Citizen developers – the business specialists who build the apps and workflows for their own domain, inside the guardrails.
- Business sponsor – owns the outcomes and the priority list, and keeps the effort tied to real value.
The relationship between the last three is the whole game: professional developers and the CoE make it safe and fast; citizen developers bring the domain knowledge and the volume; the sponsor keeps it pointed at what matters.
Recruiting citizen developers from the people you already have
You are not hiring for this – you are looking for it. The best citizen developers usually already work for you, and they announce themselves: they are the ones who built the elaborate spreadsheet the whole team depends on, who automate their own busywork, who can explain a gnarly process end to end. Look for domain expertise plus a builder’s instinct – process owners, analysts, power users, and operations people who are close to the pain and curious about the tools.
- Start with one or two motivated people in a team with a real, bounded problem – not a platform-wide rollout.
- Prioritize people who own a process, not just people who are technical. Domain knowledge is the scarce ingredient; the platform is learnable.
- Give them a sponsor and protected time. A citizen developer squeezed in around a day job rarely gets past the first app.
Training and enabling your specialists
Enablement is what separates a CoE from a hopeful memo. A practical path takes a specialist from interested to productive without pretending they are now a software engineer:
- Structured learning – the Mendix Academy and certification path give a real, credentialed starting point rather than trial and error.
- Paired delivery – the fastest way to learn is to build a first real app alongside a senior engineer who models the standards, then peels away as confidence grows.
- A reusable head start – templates, building blocks, and a design system mean builders spend their time on the domain problem, not on plumbing.
- A community and office hours – a regular forum where builders share patterns, ask questions, and get unblocked keeps momentum and quietly spreads the standards.
Guardrails: control without the bottleneck
The point of guardrails is to let people move fast because the risky paths are closed off. In a Mendix CoE that typically means:
- A review-and-promote pipeline – citizen-built apps move from development to test to production through checkpoints, with senior review before anything customer-facing or data-sensitive goes live.
- Security and data controls owned by IT – access rules, authentication, approved connectors, and what data an app is allowed to touch are set centrally, not per app.
- Automated quality gates – consistency checks, quality and security scanning, and portfolio-wide dependency monitoring catch problems before people do.
- Clear tiers – a personal productivity app and a core business system are not held to the same bar. Defining tiers up front lets low-risk work move quickly and high-risk work get the scrutiny it deserves.
This is also where maintainability is won or lost. Applications built to shared standards, documented as they go, and reviewed by senior engineers stay cheap to run and safe to change – which is the difference between a portfolio that compounds in value and one that becomes technical debt.
Measuring the ROI
A CoE has to earn its keep, and the good news is that governed low-code is measurable. The metrics that build confidence with the people funding it:
- Throughput and backlog – apps delivered, and the shrinking gap between what the business asks for and what gets built.
- Time to value – how quickly a request becomes a working app in production, versus the old cycle.
- Cost per app and total cost of ownership – build cost, but also the cost to run and maintain over time – where standards and documentation pay off.
- Adoption and reuse – how many teams are building, and how much of each new app comes from shared, already-proven building blocks.
- Risk reduction – shadow-IT spreadsheets retired, audit findings closed, and a portfolio you can actually see.
Framed this way, the CoE is not a cost centre – it is the mechanism that turns platform spend into measurable delivery, and does it with the risk under control.
How Golden Earth helps you stand this up
This is the work we do. We are not here to sell you a platform – we are here to make the operating model around it actually deliver. That usually means helping you:
- Assess readiness and design the model – the roles, tiers, guardrails, and the start-structure-scale path that fits your organization, not a template.
- Build the foundation – the reusable templates, building blocks, design system, and integration patterns your builders start from.
- Train and pair with your people – senior engineers who deliver the first real apps alongside your specialists and model the standards, so capability stays in-house.
- Provide senior review and oversight – the checkpoint that lets citizen-built apps reach production safely, with documentation-first delivery so you own the knowledge, never a black box.
Senior engineers, documentation-first, embedded in your team, delivering when you need it – the discipline that makes citizen development a durable advantage rather than a new source of risk.