Distributing power is not the same as separating it.

Jo Hasenau
10/06/2026

My last article about the topic asked who is supposed to do all the work created by TYPO3’s new governance. The review improved the proposal. It also makes the next question harder to avoid: Who limits the power that comes with that responsibility?

Estimated reading time: 7 min

From capacity to power

Scarcity does not only create workload. It concentrates authority.

My previous article about TYPO3’s proposed governance asked a fairly simple question: Who is supposed to do all this work? Six Units, Councils, Coordinators, Deputies, a Cooperation Panel, meetings, reports and elections require people. TYPO3 does not have an unlimited supply of them. If the structure needs more capacity than the community can provide, responsibility will concentrate among the few willing and able to take it on.

The public review did not make that problem disappear, but it improved the proposal in several important places. Councils gained stronger rights, Coordinators can now be recalled directly, and representation on the Cooperation Panel became clearer. That is what a public review should achieve. It also leads to the next question: Once responsibility has concentrated, what limits the authority that comes with it?

In the first article I described a possible bureaucratic death spiral. The reliable people collect several roles, their workload increases, somebody drops out, and the remaining pool becomes even smaller. Nobody needs to be malicious for that to happen. Somebody still has to keep the structure running.

The revised proposal merely provides that Coordinator, Deputy, and Unit Member roles should not be combined across more than two Units. A genuine and, above all, company-wide limit was explicitly considered as well, but ultimately rejected. So one company can still occupy several seats across the new governance structure. Conflict rules may address particular financial or hierarchical relationships, but they do not prevent concentration of influence. A governance model can be conflict-free on paper and still concentrate power in practice.

And this is not just administration. Units receive authority, Councils define long-term policy and strategy, and the Cooperation Panel becomes the Product Owner for TYPO3 CMS. Scarcity therefore helps decide who gets to make decisions.

Distribution is not separation

More boxes on an org chart do not create checks and balances.

The proposal distributes authority across several bodies. That looks decentralized, but distributing power is not the same as separating power. For developers, the distinction should be familiar. Governance needs separation of powers in the same way software architecture needs separation of concerns. Moving responsibilities into different classes does not create a clean architecture if those classes remain coupled in ways that defeat the separation.

Power must not only be distributed. It must be separated.

The revised Unit Council rules are a good example. The Council is responsible for long-term policy and strategy and can now remove a Coordinator or Deputy with a two-thirds majority. Special quorum rules prevent those positions from blocking their own replacement or removal simply by staying away.

Ordinary Council decisions are different. For those, a quorum still requires either the Coordinator or Deputy Coordinator to be present. So the body responsible for long-term policy and strategy cannot normally exercise that authority unless at least one of its executive leaders attends. There are ways out because a Council can ultimately remove one of them, but that turns an ordinary disagreement into a potential argument about removing somebody from office before the Council can govern again.

A Council that cannot make an ordinary decision without the presence of its executive is not an independent Council. If the intended safeguard is that nobody would abuse this, that is not a safeguard. Intent alone is never a safeguard. The rules are.

Who governs the rules?

Governing within the rules and changing the rules are different powers.

The more important problem appears at the Cooperation Panel level. The Panel is not just a coordination meeting. It creates and prioritizes the Product Roadmap and acts as TYPO3 CMS Product Owner. Its rules can be changed by the General Assembly, which is exactly where fundamental governance changes belong.

Unless the Association bylaws say otherwise, however, the same rules can also be changed by a joint decision of the Association Board and the Cooperation Panel itself. The explanation is that this is already more restrictive than allowing the Board to change policy on its own. That may be true, but it does not answer the underlying question. Adding another approval step is not automatically separation of powers.

The Board needs room to govern, and so does the Panel. But governing within the rules and governing the rules themselves are two fundamentally different powers. Nobody wants every operational detail brought before the General Assembly. The problem starts when the same amendment power reaches rules that define who holds authority, how it can be exercised and what limits apply.

At that point we are no longer talking about administration. We are talking about governance of governance. The Board works for the Association and its members. The members do not work for the Board. The same principle applies to every body whose authority ultimately comes from them.

A constitution without a court

Good governance lets us trust people without requiring us to trust them.

TYPO3 is not a state, but the comparison is useful because these rules do things constitutions also do. They create institutions, distribute authority, define procedures and establish limits. In that functional sense, TYPO3 is building a small constitution for its governance.

There are existing checks. The General Assembly is the Association’s supreme governing body. It elects central bodies, changes statutes and can deal with complaints against executive bodies. Members also have legal rights to challenge decisions that violate law or statutes.

What I cannot find in that architecture is the equivalent of constitutional review. There is no standing, institutionally independent internal body that can answer a much narrower question before a dispute has to become a political fight at a General Assembly or an external legal case: Was this governing body actually allowed to do what it just did?

That is what I mean by a Constitutional Court. Its mandate should be deliberately boring. It should not decide roadmap priorities, technologies or which Unit has the better idea. It should decide whether a body had jurisdiction, whether mandatory procedures were followed and whether delegated authority was exceeded. If not, it must be able to invalidate the decision or send it back.

A constitution is not a description of who currently has power. It is a set of rules for what happens when that power is contested. Such a body only works if it is independent of the institutions it reviews. Its legitimacy should come from the membership, and the Board, Units or Cooperation Panel should not be able to remove its members because they dislike a ruling. This does not require another administrative empire. It requires a clear boundary.

TYPO3 already has an Ombudsperson function and external support for complaints, conflicts and Code of Conduct matters. That solves a different problem. Ombuds protects people and helps resolve conflicts. Constitutional review determines whether governing institutions are acting within their mandate. The Business Control Committee comes closer because it already has an oversight role. But then again, extending its mandate would give one body too much control.

Oversight should not become another concentration of power. Constitutional review needs to remain a separate function.

Precision is part of governance

Ambiguity is manageable in documentation. It is dangerous in a constitution.

Some of the conclusions above can be disputed by pointing to an exception, the bylaws or an explanation in the FAQ. Fair enough. But that is not a reason to be less concerned about precision. It is a reason to demand more of it. Governance rules should not require readers to reconstruct their actual limits from several documents or depend on everyone agreeing on what the authors probably meant.

A constitution should remain clear even when somebody reads it adversarially, not only when everybody approaches it in good faith. That does not mean turning every Unit rule into a hundred-page legal code. It means that wherever power is granted, limited, delegated or withdrawn, the wording needs to make those boundaries clear.

If a safeguard exists only in an explanation, it does not yet exist in the architecture. The public review has already shown why that matters. Several provisions were changed precisely because reviewers compared the authors’ intentions with what the text actually allowed. That is the level of precision governance needs before authority is handed out, not after a conflict forces everyone to argue about what was supposedly meant.

The review worked. Now finish the job.

Structural safeguards are easiest to add before somebody needs them.

The public review made this proposal better. That is the strongest argument for continuing the same process until the remaining structural questions are resolved. Operational imperfections can be fixed later.

Reporting intervals and meeting procedures can change when practical experience shows that they should. Limits on institutional power deserve a different standard because changing them later means asking people already inside the structure to restrict the authority they have received. Community culture can run on trust. Governance cannot depend on it. Good governance lets us trust people without requiring us to trust them. The question is not whether we trust the people who will run this system today. The question is whether the system still works when we no longer do.

That is why I would vote against the proposal in its current form and give the Governance Working Group a clear mandate to fix the remaining structural defects before bringing it back to the General Assembly. That is not a vote against Units or against a governance reform. The review has already proved that the proposal can improve when concrete weaknesses are identified and repaired. I would finish that job before handing over the keys.

TYPO3 has been through a major governance and product split before. The lesson should not be that we need to trust the right people next time. The lesson should be that the rules must survive the wrong ones.

The review fixed real problems, but the proposed structure still distributes authority more clearly than it separates it. Councils remain dependent on their executive for ordinary decisions, company-wide concentration remains possible, and Board plus Cooperation Panel can jointly change the Panel’s own rules without further confirmation. TYPO3 needs an independent internal mechanism to review whether governing bodies stay within their mandate.
Jo Hasenau