Prohibit, ignore or enable?
This places nearly every modern organization at a fork in the road, whether it has noticed or not. While the upsides of widespread citizen development might seem obvious, most companies have policies in place that will not mix well with the realities that follow.
“Shadow IT” taught us this lesson a decade ago: prohibit, and the usage or building goes underground. A majority of employees already conceal at least some of their AI use at work. Banning Dropbox never actually stopped the file sharing, it just moved it out of sight of the IT department. However, we learned that the organizations that had the presence of mind to recognize the unsanctioned behavior as the demand signal it was and acted accordingly, came out ahead of the ones that wrote memos.
Ignore it, and the building expands in secrecy and with it a host of risks: AI-generated code carries measurably more security vulnerabilities than human-written code and most of it is never reviewed. But even leaving security issues aside, tools built and maintained by no one in particular tend to age poorly — the owner moves on, and the tool quietly breaks.
Both outcomes are cultural. And both are governed by policy. Including the policy of having none. Which means the inverse is also true: the right “building culture” can be designed.
