This course is for the people who answer for what runs in production.
Building left engineering
In Stack Overflow’s 2025 developer survey, 84% of respondents said they use or plan to use AI coding tools, and 51% of professional developers use them every day.1 For IT, the bigger number came from OpenAI in June 2026: one in five Codex users works outside development, as an analyst, marketer or operator.2
So your next internal app may come out of finance or RevOps. It works on the builder’s laptop. To work for anyone else, it needs four things the builder can’t supply:
- Infrastructure. Hosting, a database, a domain, someone on call.
- Credentials. Granted access to real systems, like the CRM or the warehouse.
- Identity. SSO in front of it and roles behind it.
- An owner. A named person who answers for it at 3am.
All four belong to IT. The analyst can’t grant themselves production access to Salesforce, and they aren’t the one who gets paged.
Policy is opt-in for the person you want to control
Most organizations reach for policy first: an approved-tools list, a review board, an acceptable-use document.
| What changes | The policy answer | The architecture answer |
|---|---|---|
| What it offers | An approved-tools list and a review board | One path to production that’s faster than the workaround |
| Identity and secrets | Training, and a policy signed once | Attached by the platform to every app it runs |
| How you find apps | Discovery after the fact | Every app runs through you, so you see every app |
| What it depends on | The builder choosing to comply, every time | Nothing: it holds whether or not anyone read the policy |
The tools list works if the builder checks it. The review board works if the builder submits to it. Discovery works after the app has shipped. Every control on the left depends on the person you’re trying to control.
On the right, the controls attach because the app runs on the platform. Policy still sets the tiers: what’s allowed, what needs review, what’s off-limits. Architecture enforces them. A policy with nothing underneath it is a request.
Blocking moves it out of sight
The other instinct is to block the assistants until governance catches up. Gartner’s research on local AI agents says that fails: adoption carries on out of sight, and you lose the visibility you’d need to manage the risk.3
You can already measure that lost visibility. In a Cloud Security Alliance survey of 418 IT and security professionals, 82% had found at least one AI agent built without security, IT or governance knowing, while 68% of the same group rated their visibility into agents as strong.4
Make the safe path the fast one
Gartner’s guidance on scaling vibe coding says it plainly, in paraphrase: make the safe path the easy one, with approved templates, reusable components, secure integration patterns and deployment guardrails, and stop relying on users to interpret enterprise standards themselves.5
Say a builder wants their app live today, and the review board meets every two weeks. The app ships anyway, on a personal cloud account. All the board decided was whether you have a record of it.
Now give the same builder one governed path that’s faster than going around it. The app reaches production with identity, an audit trail and an owner attached, because the path attached them. That only works if the path really is faster.
Do this week
Builders take the fastest route to a working app. Friction in your path just moves the app somewhere you can’t see.
What you have now
The case for an architecture under your policy, and one number: how much faster the workaround is today. Next, the three layers every AI-built app passes through.
Footnotes
-
Stack Overflow Developer Survey 2025, n=49,009. Back
-
OpenAI product telemetry, 2 June 2026. Back
-
Gartner, G00854706, 29 July 2026. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Back
-
Cloud Security Alliance, survey of 418 IT and security professionals, January 2026. The survey was funded and co-written by Token Security, which sells agent identity security. The 82% figure is the share that found at least one agent unknown to security, IT or governance; it is not an estimate of how many such agents exist. Back
-
Gartner, “How to Scale Vibe Coding Using Low-Code Engineering Principles,” G00857758, 11 August 2026. Back