Almost every company I talk to is pushing people to use AI. Good. Here's what happens next.
Picture Jen in HR. She's made up. You've met her anyway. Jen builds a little onboarding tracker in an afternoon with an AI coding tool. It's great. Her team uses it. Then the team next door asks for a copy. Then someone hooks it up to the HR system so it stops needing manual updates. Now there's an app touching employee data that IT has never seen, security never reviewed, and nobody will own when Jen changes roles.
Multiply Jen by every motivated person in the building with a browser and a subscription. I think that's the shadow IT wave coming at most companies over the next eighteen months.
Think about a college quad. The architects laid out neat sidewalks at right angles. The students walk diagonally, because diagonal is faster, and within a semester there are brown paths worn through the grass. The groundskeeper has a choice to make. It's the same choice your IT team is about to face.
The two bad answers
Ban it. Put up a fence. Nothing ships without engineering review. The builders go underground, or they stop trying. Either way you've killed the thing you told everyone to do, and the people who climb the fence anyway are now doing it where nobody can see them.
Ignore it. Let the grass go to mud. Sooner or later one of those tools leaks customer data, and then you ban it anyway, with worse feelings all around and a pile of apps nobody can find to shut off.
Both answers treat the dirt paths as the problem. They're the most useful information you have. They show you exactly where people need to go.
Pave where people walk
Platform engineering already solved a version of this. You don't review every service by hand. You define paved roads, and if you stay on them, you ship fast. Step off and you get more scrutiny, which is fair, because you picked the harder route.
Same idea, pointed at internal apps built by people who aren't engineers.
A manifest at the source. When someone builds a tool, it carries a short declaration: who built it, what it does, what data it touches, what could go wrong. Five lines. Written when the app is born, not pieced together during an audit.
Paths by risk. IT sets up bundles ahead of time: allowed connections, data access, audience, how often it gets reviewed. A team-only tool with no sensitive data gets the fast lane. Something touching the CRM or payroll gets a different one. Jen's tracker starts in the fast lane and moves to a slower one the day it connects to employee records, and everybody knows that in advance.
Connect systems once. Core systems hook into the governed environment one time. Apps ask for access under the rules instead of everyone wiring up their own credentials. Security cares about this part most. Builders end up liking it too, because nobody enjoys chasing an API key.
Trust that's earned. Tools move up tiers based on review, usage and ratings. Popular, well-behaved tools get more reach. A tool twelve teams depend on gets an owner and a review whether its builder asked for one or not.
A catalog. Half the problem is discovery. If there's one place to look, people find the onboarding tracker that already exists instead of building the fourth one. Four trackers means four copies of employee data in four places, three of them forgotten.
None of this is exotic. It's what a good groundskeeper does: watch where the grass wears out, then pour concrete there.
The paved road has to be the better road
Here's the part governance teams miss. Nobody is required to love your paved path. If it's slower, uglier or more annoying than the dirt one, people will keep walking on the grass, and they'll be right to.
So the fast lane has to actually be fast. Pre-approved patterns, connections that already work, a review that takes a day instead of a quarter. Leave "follow the rules" out of the pitch to a builder. Try something closer to: "This way, your thing works on Monday and nobody shuts it off on Thursday."
That's also the real argument for doing this at all. Paved paths don't trade speed for safety. The fast lane is fast because it's safe, and it's safe because someone decided in advance what it allows.
There's a second trap waiting on the other side of this. Once a homemade tool works well, someone will want to sell it, or spin it into a product. That's a different decision with a different cost, and it usually pulls a company away from the work it exists to do. ("The AI trap" is about that one.)
I think the companies that get this right will capture the upside of a whole workforce that can build. The ones that don't will spend 2028 cleaning up.
The dirt paths tell you where people need to go.
Where the metaphor breaks
A dirt path is harmless. Mud on your shoes is the worst it does. A homemade app wired to payroll can do real damage before anyone knows it exists, so you can't wait a semester to see where the paths form. Some of the paving has to happen before the walking starts, especially around the systems that hold customer and employee data.
Paths also stay put. Apps don't. Jen's tracker changes every time someone asks for a feature, and a tool that was team-only in March can be company-wide by June. The tiers have to be re-checked, which means somebody owns re-checking them.
And some people will still cut across the grass. A few of the most useful tools will start off the paved road, built by someone who never read the rules. Treat that as a signal for where to pave next. If you punish the first person who finds a better route, nobody shows you the next one.
Try this
- Ask five teams to list every tool they've built or copied with AI in the last six months. Make it clear nobody's in trouble. You want the real list.
- For each one, write the five-line manifest: who built it, what it does, what data it touches, who uses it, and who owns it if the builder leaves.
- Sort them into three piles: touches no sensitive data, touches internal data, touches customer or employee records.
- Count how many in the third pile have an owner other than the person who built them. That number is your exposure.
- Pick the most common connection on the list (the CRM, a shared spreadsheet, the HR system) and make it the first system you connect once, under rules, for everyone.
Where do you land?
