Your first ninety days

Time to put the last five lessons on a calendar. You can start next week, and you don’t have to buy anything first.

A staged rollout

Gartner’s research on scaling vibe coding lays out a staged rollout. In paraphrase:¹

Most organizations are in the first stage without the inventory done. Start there, before any platform decision. The list tells you which tiers you need, which systems apps already reach, and how many have no owner.

Here’s one way to fit the stages into ninety days:

• Days 1 to 30, baseline. Run the inventory. Time your governed path against the workaround (lesson 1). Map your stack onto the three layers (lesson 2). Ask where the credential is for every app on the list (lesson 3).
• Days 31 to 60, tier it. Write the tiers and their re-review triggers, the identity model, the ownership rule and the promotion path, each with a named owner (lesson 4).
• Days 61 to 90, pilot. Put two or three low-risk internal apps through the governed path end to end. Check that the evidence for each one answers the four questions with no stitching (lesson 5).

Scale comes after the pilot, and only for what the pilot proved.

The signals to watch

Gartner notes that counts of apps and users hide rising rework and security exposure.¹ Watch these four:

• Governed adoption rate. The share of what got built that went through the governed path. Put this one in front of an executive.
• Time to safe delivery. How long the governed path takes from a working build to a live app with identity, an owner and a record. If the workaround is faster, you’ve built a gate and called it a road.
• Prototype-to-production conversion. How much of what gets built reaches the people it was built for.
• Reuse rate. How often a new need is met by an existing app or component, with no near-duplicate built beside it.

Name who reviews them, and hold the review on a fixed schedule.

The parts software can’t supply

Controls in the systems apps run on are where most programs lag furthest, and they’re one part of three. Gartner’s AI governance checklists also call for AI literacy programs, a named executive accountable for AI governance, and clear escalation paths for decisions the rules don’t cover.²

Policy sets the tiers. People own the decisions and the exceptions. Software enforces the tiers on every request. Miss any of the three and the program has a hole in it.

Build it or buy it

You can build the governed path yourself. If you already run an internal developer platform with engineers to look after it, or your residency or audit rules require apps to run in your own environment, building may be the better call. Helix runs on Tray’s managed cloud, in US, EU and APAC regions. We set out the trade in Helix vs building it yourself.

If you pilot on Helix, the path is one request from the builder’s assistant. Sign-in, access control, managed credentials, logs and an activity trail attach on the way to a live URL. The control layer page shows what IT sees for each app.

Do this week

Start the inventory. Send one message to the heads of finance, RevOps, support and marketing asking for every app their teams built with an AI assistant in the last six months: what it does, who uses it, what it connects to, and where it runs. Put the answers in one list. That list is day 1.

What you have now

A ninety-day plan, four signals with an owner for each, and the human pieces software can’t supply. Keep the day 1 list current, and rerun the timing test from lesson 1 at day 90. If the governed path is now the faster one, it’s working.