Test & iterate:

How you build an extensible citizen development pilot


Keep your dreams big and your pilot small.

A strong citizen development practice doesn’t always start as a fully formed, enterprise wide program. The most successful companies start small and test, iterate, and perfect their process before expanding to the larger organization. 

Now that you’ve laid the groundwork for citizen development with stakeholder buy-in, backlog prioritization, and the beginnings of a governance process, you need to put your plan into action and get citizen developers on board. From the very start, it’s critical to set strong guidelines on how you’re using low-code development — through governance, security standards, role definition, and training curriculum — and engage a select group of motivated team members to drive it forward. Once you’ve had a chance to evaluate your process performance and adjust as needed, you’ll be ready to scale.


Find tech talent without ever leaving the building.

In the prepare stage, you communicated the value of citizen development to key players in your organization to gain buy-in. Now, as you get ready to launch your pilot program, you’ll want to ensure that the right roles are defined and the right people are recruited to fulfill these responsibilities.

Only 26% of IT organizations say their workforce diversity/inclusivity is excellent. Citizen development provides an opportunity to increase diversity among your organizations’ tech talent.

company logo

The New Frontier of Software Development

Salesforce Research, 2017

The skills gap for development is high but you can find valuable talent across your business by knowing what to look for. Business analysts, the super admins in finance, and the super users in customer success could all be your next citizen developers. Below, you’ll find all the details you need to build your team by finding existing technical talent from the business side of your organization.

How They Did It

Anna Rodriguez and her team: 

  • Defined the release management cycle.
  • Identified a technically inclined citizen developer in the billing department.
  • Provided a simple process for architecture review.
  • Gave the citizen developer a sandbox to build, test, and deploy a solution with ongoing support from IT.
  • Overall kept the whole process lightweight to test viability.
Watch The Video

Career growth and knowledge building: Get team leads on board with citizen development.

Before reaching out to potential citizen developers, it’s advisable to work in close partnership with the business. Some business leaders who have bought in to the process from the prepare stage may already have recommendations of who might be a good fit for these roles. According to leading analyst firms and IT experts who have implemented citizen development, people in business analyst, operations and non-IT app developer roles are the highest skilled prospects to help you launch your pilot program. But any tech-savvy, eager employee from a project manager to an administrative assistant could be a great candidate if they are willing to learn and are provided with the right hands-on platform to do so.

While you may have received the support of other business leads, some department heads may not be keen on their employees completing citizen development work in lieu of other responsibilities they were hired for. Be sure to emphasize the benefits of the program, such as individual career growth, increased technical knowledge across departments, faster deployment, and more accurate solutions, to name a few. Additionally, set the expectation that citizen development work should be done on volunteer time so there isn’t any productivity loss to the department.

Hear Salesforce customer David Ray share his journey from financial analyst to citizen developer.

Watch the Video

The operational teams saw that if they’re going to make these changes and make them officially, they can get value quicker. It was just a natural value understanding that they saw once they were able to make a few of the changes on their own.

Hear Trenton's Story

Trenton Cycholl, VP of Business Technology

The perfect citizen developer formula: 20% IT + 80% business. 

As we mentioned above, citizen development should be a true partnership between the business and IT. You may not have formalized roles for you pilot program — we’ll get more into those in scale — but clearly defining responsibilities among business and IT is an important first step. You can use the guidance below to get started on outlining your IT and citizen developer responsibilities.

Citizen Development Responsibilities
  • Complete training on Platform via guided, online tutorials like those in Trailhead
  • Attend informational sessions
  • Document proposed solution and submit app request to IT
  • Build solution on low-code platform
  • Provide testing documentation
  • Form a testing council, if QA resources are not provided
  • Hand-off app to IT with all necessary documentation
  • Serve on advisory council if needed and attend quarterly backlog reviews
  • Add new features and make app updates if needed
IT Responsibilities
  • Complete training on Platform via guided, online tutorials like those in Trailhead
  • Attend informational session and conduct them if needed
  • Evaluate solution proposed by citizen developers 
  • Attend weekly progress and scope updates with citizen developers
  • Review testing documentation for citizen development apps
  • Develop common components
  • Migrate application from sandbox into production
  • Review all citizen developed apps regularly to prioritize ongoing maintenance by evaluating app usage and potential duplicate efforts
  • Serve on advisory council if needed and attend quarterly backlog reviews and planning sessions
  • Add new features or make app updates if needed

There are tech-savvy, smart users across BP, and, with the right tools, they can build solutions to deal with the things that frustrate daily.

company logo

Andrew Mercer

Director, Solutions Archititecture, BP

Don’t forget: Citizen developers are not traditional developers, and their success depends on your help. Citizen developers will depend on program and IT leaders like yourself to step in when an app requires outside data integration or it isn’t functioning exactly as hoped. This creates an opportunity to strengthen the relationships between business and IT, so business leaders feel safe and supported, while IT doesn’t fear a shadow IT taking over. 

Gartner recommends that you have one to two full-time IT employees devote 10% to 20% of their time to helping out the citizen developers. You should also consider pairing each citizen developer with a member of the IT team. They can then set up weekly check-in calls, 1-to-1 coaching or consulting, and guidance in the form of a buddy system so that citizen developers have a go-to person throughout the entire process. Setting up a citizen development Chatter group is another great way to have both IT and business participants communicate with one another.  

Treat your search for citizen developers like a true hiring process. Just as with any job posting, you’ll want to be crystal clear in the expectations.

When you’re ready to start recruiting, here are some key points to communicate: 

  • That participation is completely optional
  • What the benefits of participation are (rewards, recognition, skills and career growth, collaboration with other departments, problem-solving, and so on)
  • What the expected time commitment is 
  • That training and support around the process and platform will be provided

What is happening is that we’re giving more people more capacity to have more impact as individuals across their divisions and departments.

Jonathan Reichental

former CIO, City of Palo Alto

There are some great ways to increase awareness and educate prospective citizen developers about the program. Consider hosting a job fair experience, lunch-and-learn, or hackathon where attendees can learn about the different roles and their functions as well as how the program works today.

How They Did It

To make employees aware of the citizen development program at BMC, Sudheer and his team leveraged hackathons to rapidly ideate and build citizen development applications while simultaneously drumming up excitement for the program. A hackathon is a sprint-like event in which IT and business collaborate continuously on one or more citizen development projects for a specified period of time.

As a part of their hackathon, the company:

  • Launched a website where business users could sign up for the event
  • Formed teams made up of various departments which submitted ideas for apps
  • Distributed basic training to participants in advance of the event, leveraging Trailhead and other resources
  • Extended the event to two days
  • Built 22 applications, then assessed each application, chose which would go live, and pushed them into production 
  • Decided to repeat the event every quarter in different locations around the world, inviting participants to choose themes and topics
Watch The Video

Don’t do it alone. Form a team of trusted advisors.

During the rollout to your citizen developers, you may also want to ask for volunteers to create an advisory council. The purpose of the advisory council is to guide your program after rollout. The council will meet on a consistent basis, discuss applications being developed, make suggestions for process improvement, and review backlogs quarterly to determine requests to be addressed in your next development cycle. The group should also provide overall platform org management and user access to applications.

You will want to look for people from both the business and technology teams. They should be self-motivated, excellent communicators, and hungry for new challenges. Whether from sales, marketing, or IT, they help drive the program to higher levels of innovation while fostering a stronger connection between business and IT. 


The advisory councils allow the business to build relationships with the IT folks they normally wouldn’t have had.

Hear David's Story

David Neely, Senior Manager of Technology

Your advisory council should also always keep top of mind the number of users the app will touch, the investment required, possible app redundancy, and expected ROI.


Process makes perfect: Structure is key to citizen development success.

Success in citizen development is dependent on guardrails, governance, and a defined process. Putting these guidelines in place is even more critical in citizen development as you bring more individuals into the fold.

Start by defining how citizen developers and IT teams collaborate throughout the app building journey. That journey should start with app requests and continue through post-deployment maintenance.

What does a “typical” process look like? It might look something like this:

Idea Sourcing, Development Process, and Release management flow.

Citizen development processes differ from organization to organization. Ideally, your process follows the general pattern illustrated above, with customization to fit your resources and workflows. 

At BMC, for example, Sudheer and his team iterated on a process until they found what worked best for them, and they’re still improving and adjusting today as their team evolves. The most important thing is to have a clear starting point, test with a pilot program, then scale and refine.


We wanted to be careful not to put roadblocks for our businesspeople to develop the application. So we came up with very lightweight steps, like how you first request for a citizen development application.

Hear Sudheer's Story

Sudheer Sura, IT Director

Process already in place? Download the ultimate app request form to kick it off.


Low-code governance: Everyone needs it, only 24% of IT has it.

Governance is key to building a well-managed, scalable citizen development program. From development standards to compliance adherence, your citizen development program should have the same level of protocol and documentation as any of your existing IT processes. Proceeding without governance creates major risk, and it’s more common than you think. In fact, 88% of IT leaders use or plan to use low-code development in the next 12–18 months, but only 24% strongly agree they have IT governance processes in place for app building by citizen developers.

By setting common groundwork early, you will make it easy for your IT team and citizen developers to stay aligned throughout the entire app building process. But there’s no need to reinvent the wheel. If you have a general governance model in place already, use that as a starting point, making adjustments as necessary to provide IT oversight or an approval workflow.


We had a well-established governance structure as it relates to IT environments and technology platforms with great process, tools, and security around all the controls. We extended those to additional constituents and still refine them over time.

Hear Trenton's Story

Trenton Cycholl, VP of Business Technology

Three essential assets to help you write standards that stick.

Investing in discussions about standards will reduce the time your technology team needs to spend later when team members review the applications. Having a project kickoff is a great way to begin capturing the team’s ideas. Follow the session with documentation which broadly communicates the process. 

Some of the content this document should include:

  • Governance process
  • Description of roles and responsibilities
  • Credentialing

  • Application and component naming conventions
  • User experience (UX) standards
  • Data sharing restrictions and integration rules
  • Security guidelines
  • Platform recommendations
  • Maintenance and auditing
  • Protocol and tools testing
  • Training requirements

To make documenting process easier for you, reference the three tools below for Salesforce best practices, and examples of how other organizations have built and managed standards.

Select the right level of governance for your program. 

Use existing organizational standards to help shape how and when IT should have a stronger hold on governance. Having IT step in to manage and optimize app performance, set security configurations, plan for scalability, handle access to sensitive data or integrations, and own the governance process itself will help ensure crucial processes are controlled. Have a takeover process in mind as you encounter situations, such as deployment, that have to be managed by your IT team. 


Our governance had to be streamlined enough to encourage adoption, while still effectively ensuring each app conforms to regulations.

Hear David's Story

David Neely, Senior Manager of Technology

You should also consider the overall level of governance that will best serve the organization’s needs. There are three basic governance approaches: minimal, shared, and complete. Let’s take a look at each one.

Minimal Governance
  • Applications are used within a single department

  • Data is limited to a single department (no enterprise data sharing)

  • The number of users is small (1–5)

  • Citizen developers have a strong understanding of their low-code environment and require little IT support
  • Citizen developers use existing, familiar tools to build and deploy the application
  • No back-end or third-party data integration is used
Shared Governance
  • IT sets up and deploys a low-code platform for the citizen developers

  • Citizen developers require training to use the low-code platform

  • IT provides a sandbox environment and creates a testing process
; sandboxes (testing environments that are isolated from your company’s production environment) are ideal for experimentation so citizen developers can build and test low-code applications without risking any impact to the larger organization
  • IT creates secure components when access to enterprise data is needed

  • IT provides support for custom code and advanced functionality
Complete Governance
  • IT sets standards for app hierarchy

  • Business users and citizen developers place requests for apps 

  • IT reviews all submitted app ideas and brings in a citizen developer to build those that fall under set criteria

  • IT builds custom components as needed

  • IT leads the development of more complex apps, and brings in business users to test and optimize

  • IT creates a sandbox environment to test low-code apps

Use these models as a guide and feel free to mix and match various components.

How They Did It

  • A large financial services company wanted to create a highly structured citizen development program that accounted for the experience levels of professional developers as well as brand new citizen developers. 
  • In the past, citizen development had less formalized governance and citizen developers were able to modify field displays in their apps that affected fields in all of the other applications built on that platform. They wanted to prevent this.
  • The company created two separate dev environments: a low-code, “lightweight” environment for citizen developers and a highly-controlled “enterprise” instance for IT. 
  • Each instance followed a different governance model: shared governance for the citizen developers and complete governance for the enterprise system. 
  • With this setup, IT could still review and assign to citizen developer and business app requests, review sandbox testing, and control when they moved to production. 
  • For higher risk apps, or those that would affect others within the enterprise, they retained complete control.
  • The result? An empowered citizen development workforce, a clean app library, and a confident IT team.
Read the White Paper

Here’s why low-code development needs high-level security.

Although your citizen developers will be aware of the concept of security, they may not understand what it means for your organization. And it’s unlikely they’ll understand all the regulations you must adhere to. Communicating your compliance needs early on in the training process will help citizen developers take the appropriate steps to protect your data and internal orgs — and to reach out when they need assistance. They’ll become more aware of the impact of their actions on your organization, and you won’t have to trade security for efficiency. 

Also take into account roles and access. Some low-code development tools like the Salesforce Platform provide infrastructure, network- and application-level security controls to address issues around security and firewall permissions. 

Depending on your release model, you can use features like the audit log in the Salesforce Platform setup to manage security and compliance. At the application level, IT gets to control who sees and does what. Once these guidelines are established by IT, your citizen developers can deploy the apps without additional intervention from the IT team. 

Compliance is one of the areas where you have the opportunity to get business users to understand the constraints of the technology team and the hurdles they face every day. Keep in mind that not everyone is familiar with the terminology, so try to use everyday examples like highlighting a high-profile security breach at a retailer they might be familiar with to communicate the importance of security protocols. 

If your citizen developers are building on a platform that meets all the relevant industry standards — such as HIPAA, GLBA, or PCI DSS — then a general overview on maintaining application security and industry compliance will suffice. 


It’s about extending out rule sets — which helps us because now there’s more folks at Citrix worried about things like technology security and how we work with an organization.

Hear Trenton's Story

Trenton Cycholl, VP of Business Technology


Empower and train new IT innovators.

Once your app development process and governance are nailed down, you will want to ensure your citizen developers and the IT team are provided with strong and comprehensive enablement infrastructure which includes sufficient training. A well-trained team has the knowledge and empowerment that enables a strong and prosperous citizen development program. 

Your training program will mostly likely be two-pronged as it will include process training and platform training, but you first have to build out an enablement infrastructure where all of the training tools and guidelines will live.  

Make training a breeze with the right infrastructure.

A well-defined infrastructure is essential to keeping your team well-trained, supported, and working easily together. The following enablement channels will ensure that your program runs smoothly and can scale well by providing ways to learn, communicate, and innovate within the program.

1 Gartner (2019) recommends committing 4–16 hours per week, or the equivalent of 10% to 20% of one to two IT FTEs’ availability.

Enablement has been shown to be an important factor in the adoption of citizen development. If sufficient enablement is not provided, it’s possible your program could suffer as a result of confusion, duplication of effort, miscommunication, and/or lack of engagement. Providing clear direction on your process and platform ensures everyone is on the same page and empowered to succeed.


If you have that infrastructure in place for citizen developers, you can really open up your candidate pool rather than hiring for specific advanced skills. When you hire for potential instead, it’s a much bigger candidate pool.

Hear Anna's Story

Anna Rodriguez, Solution Principal

Enablement also acts as a catalyst to program recruitment by drawing interested individuals into expanding their IT skills through accredited training and under close guidance from experienced guides (for example, the citizen developer initiative can also provide an initial stepping stone for a career in the IT department at a later point). It also becomes the means for building stronger relationships across departmental silos — often an unexpected benefit of citizen development.

Dedicating the time and effort to build out a structured enablement program means even bigger returns down the line. By providing comprehensive and readily accessible enablement channels for their team, USAA was able to ensure program success and now has 75% of its apps being built by citizen developers. And those apps are being built in a quarter of the time. 

Get your team up to speed on process and platform. 

It’s time to share the process structure and governance standards that you’ve outlined with your pilot team. Review the governance model, process expectations, and standards you’ve set with both your IT and business teams. Set up a cadence or rulebook for team interactions, like weekly check-ins and and IT support channel, as well as documentation for handoffs.

Citizen developers tend to get very excited about the program, so it’s important to provide them with enough documentation to maintain your standards but not so much as to overwhelm them or require constant updating.

Training for Citizen Developers
  • Creating a set of modules that are tailored to the citizen developer and cover frequently requested application types will provide the proper education while eliminating any confusion around roles and responsibilities. Although there will be some crossover, creating a customized mix of self-directed training will help accelerate the learning process.
  • On top of learning your organization’s app development processes and requirements, your citizen developers will need training on how to build and test apps. With Salesforce, they will have a wealth of resources regardless of whether they aspire to become a basic or advanced user. For starters, you can use Salesforce’s Citizen Developer trailmix or create a custom trailmix that meets the needs of your organization.
Training for IT Roles


Let’s get technical: environments, testing, and deployment.

Once your low-code developers complete the right training on governance, platforms, and standards — and you’ve identified a backlog of app ideas — they are ready to start developing. They will need environments where they can confidently build, test, and maintain applications. 

Let your citizen developers play in the sand. Sandbox, that is.

By having your development team create sandboxes, you provide your citizen developers with a safe space to experiment with their ideas while also self-training on the platform. Eighty-nine percent of IT leaders say that application security and management capabilities are important when evaluating low-code tools. By providing a sandbox you remove the risk that a citizen developer will impact enterprise data or applications, and, in doing so, alleviate the fear and hesitation that keeps citizen developers from getting involved. As their skill sets and development speed will vary, sandboxes allow low-code developers to build at their own pace. In this manner, your citizen developers will have no access to your production environment, and your developers will maintain control over what gets pushed out and what doesn’t. 

Someone on the sales ops team who had access to our development sandbox put together a process — and they were able to take their pilot to market. It exploded, and it was a huge success for the company. And because of that, they decided to put a lot of development cycle into no-code solutions. It turned into a 200-plus-person team and then a full-blown product.

company logo

Anna Rodriguez

Solution Principal, Slalom Consulting

Because citizen developers tend to be working on apps between other responsibilities, development cycles may be longer and may cannibalize use of your limited number of sandboxes.

Make sure you have requirements in place around sandbox best practices, detailing:

  • A sandbox request process for citizen developers
  • Provisioning standards
  • Sandbox usage guidelines—Access should be limited to only users who have an active development role on the app
  • Protocols for versioning and source control
  • Release of access mechanisms

With a platform like Salesforce in place, setting up sandboxes and testing environments is simple. Aside from traditional sandboxes, with Salesforce DX you can set up scratch orgs, which are source-driven, fully configurable, and disposable environments that can be used for development and automated testing. Salesforce DX allows developers to build with open and standard tools including Git, Selenium, VS Code, Eclipse; and use the Salesforce CLI by integrating into your existing developer workflow. You can read more about it here.  

To learn more about how Salesforce recommends managing sandboxes for your citizen developers, check out the “Release Management: From Sandbox to Production Overview” video and read Salesforce’s best practices around sandbox governance.

Go live: Seven deployment steps for a smooth release.

Getting apps out of the sandbox and into production can be a bit challenging for those who aren’t accustomed to it. Give your citizen developers a set of simple steps to help them feel more comfortable. 

  1. All citizen developers have a dedicated sandbox
  2. IT imports changes or the new app from the sandbox to QA
  3. IT conducts security and compliance tests
  4. Once cleared, IT migrates the app/updates to UAT environment
  5. Citizen developers execute a test plan and remediation until the app is approved for release
  6. IT migrates the app to production and performs a smoke-screen test
  7. IT announces the app release

Recommended release cycle flow from Sandbox to Automated Testing to UAT Environment to Production

Put your apps to the test: requirements, impact, and performance.

How do you know if something’s working? You test it. As we outlined in prepare, identifying KPIs early on helps you ensure that what your citizen developers have built meets the goals it was set out to satisfy and solves problems identified in its initial request. Whether you create and test against user stories, or test against a list of requirements, you tests should answer these questions:

  • Does the application represent the level of quality our organization demands?
  • Does it meet all requirements?
  • Does it perform as expected?
  • Does it meet the needs of users and stakeholders?
  • Does it negatively affect any existing or legacy systems?
  • Does it have a solid active user base?

You can choose to use static tests, perform a full review (including code) early in the process before release, or run dynamic tests either manually or automatically to find and record bugs as the software is in use.

To browse a library of testing tools and learn more about Salesforce testing best practices, read the Testing Strategy White Paper. You can also learn how to automate your testing practices in the scale phase.

Whichever method you choose, provide testing methodology and supporting resources for all developers. Have a test plan in place and involve IT to migrate the app from the developer sandbox through performance and quality assessment and and eventually a security test before migrating it to production. 

Let’s take a look at the plan Anna Rodriguez has helped shape with her team.

How They Did It

  • A strong governance platform was defined to establish architecture and development standards, assign responsibilities to roles, and implement development and maintenance processes that ensured adherence to standards.
  • A workflow was established in the ticketing system where citizen developers can request a build to be pushed through.
  • These requests flow into the normal pathways that their developers use with the right code review checks in place and the right testing at each space.
  • Apps move through feature sandboxes, integration environments where necessary, into QA/UAT, and finally into production.
  • Depending on risk assessment of the change, each app will pass through all environments in the pipeline, but only require certain tests to ensure that development can still move quickly without compromising quality.
  • Citizen developers and IT are on the same page due to process alignment, and each app undergoes the same review cycle.
Watch The Video

The core to building a strong citizen development program that allows your citizen developers to move quickly without causing roadblocks is having a really strong software development lifecycle built out already.

company logo

Anna Rodriguez

Solution Principal, Slalom Consulting


Measure. Celebrate. Share. Your success is worth promoting.

After the initial rollout of your pilot program, review those metrics established in the prepare stage, and communicate the impact back to your project stakeholders, citizen development team, and broader organization. Then, look at how the process can be improved and set up new metrics to drive continued success as you grow your program. It’s recommended you do this at least once per quarter.

Consider ways to recognize and reward your team’s accomplishments such as social recognition through kudos program, paid lunches, awards/certificates, or new opportunities to name a few.

For some, like David Neely, Senior Manager of Technology at Transamerica, it is the little things that matter when rewarding citizen developers. When Transamerica rolled out a Salesforce app at the expo hall of a huge annual conference in Las Vegas, two citizen developers who developed the app manned the booth so they could show off their work to some of the 40,000 attendees. These citizen developers were extremely excited that they were afforded the opportunity to make the trip to a conference they otherwise would not have been able to attend.

Additionally, it’s important to celebrate the success of the program overall. Consider doing a company event which recognizes the contributions of both your citizen developers and your IT team and broadcast it throughout the organization. You can also use this event to announce your next hackathon which will open up the opportunity for your next group of citizen developers to engage with the program. 


What’s great is just the general high-fives across and around the room when a deployment happens and everyone’s contributed to it. It drives a lot of just feel-good moments for us

Hear Trenton's Story

Trenton Cycholl, VP of Business Technology

Reflect back on what was only made possible by your citizen development program and what other potential lies ahead as you scale

Next Up: Scale

Evangelize, inspire growth, and scale citizen development.

We use cookies to make interactions with our websites and services easy and meaningful, to better understand how they are used and to tailor advertising. You can read more and make your cookie choices here. By continuing to use this site you are giving us your consent to do this.