Learning pathsStart here if you run IT or security
Govern AI-built apps.
What to decide before the next app ships: why policy alone loses, the three layers every app runs through, credentials, tiers and owners, evidence, and your first ninety days.
Start the course- 01Why policy is not enoughWhy an acceptable-use policy can't govern AI-built apps, and how to measure whether your sanctioned path beats the workaround.
- 02Surface, control, foundation: the three layersMap your own stack onto the three layers every AI-built app passes through, and find the one that's usually missing.
- 03Builders never hold a credentialDesign a credential path with no secret in the app, the assistant or the builder's hands, and test any vendor against it with one question.
- 04Risk tiers, identity, owners and the promotion pathMake the four decisions every AI-built app inherits: its risk tier, its sign-in, its named owner, and how it moves from personal to enterprise use.
- 05Keep evidence as it happensDefine one record per action that answers four questions, so security, your auditor and your AI council read the same evidence.
- 06Your first ninety daysPlan a staged ninety-day rollout for governing AI-built apps, and choose the four signals that tell you whether it's working.
When you’ve finished
Test your knowledge
Ten questions on deploying and running vibe-coded apps.
Take the quizShare inside your company
Vibe-coding guidelines
Twelve guidelines for builders and twelve for IT and security, with a free kit to adopt them.
Read the guidelines