AI Can Write the Code. Leaders Still Own the Consequences
AI coding tools will turn more employees into builders. The winners will not ban them; they will create safe lanes for speed, security, testing, and accountability.
📌 THE POINT IS: Vibe coding does not just make software development faster. It turns more people into builders, which means leaders need to treat product judgment, testing, security, and governance as everyday business skills. The companies that win will not be the ones that ban citizen-built apps; they will be the ones that create safe lanes for speed and train even their junior associates to be product managers.
App sprawl is the new BI sprawl
Vibe coding is not just a developer productivity story: it’s the beginning of app sprawl.
For the last 20 years, companies have dealt with BI sprawl: too many dashboards, inconsistent definitions, and competing versions of the truth. That was messy, but most dashboards were read-only.
AI-built apps are different. They can move data, trigger workflows, encode business logic, expose permissions, and create security risk. And now the ability to build them is moving from software teams to almost anyone who can describe a problem clearly.
That is exciting! But, it’s also an executive governance problem.
Testing the waters hands-on
Over the weekend, I tested this myself. I used Codex to build a web app for cataloging my dad’s collection of 160+ vintage vinyl records. I expected to have a rough prototype after a few afternoons. Instead, I had a usable app quickly, iterated on features as I entered the records, and finished the cataloging workflow far faster than expected.
That experience changed how I think about citizen development in an AI world. The bottleneck was not writing code. The bottleneck was knowing what I wanted, testing whether it worked, and deciding what risks mattered.
The skill shift
At a recent Executive Roundtable event in Charlotte, I was asked to be on a panel of speakers about data, AI, and the future. I was asked what college students should be studying today and I replied, “good product manager skills.” The ability to describe the problem in terms of outcomes and value; identify killer features and how to prioritize them; and being able to do the user testing that will ferret out any gotchas or misses in functionality are going to be the most valuable skills. Simon Sinek in his book, “Start with WHY,” speaks about a world where the “what” is a detail, but the “WHY” is what gets people excited about the work you’re doing. As good product managers, that’s where we should be upskilling and preparing ourselves.
Aleks Bass, Chief Product and Technology Officer at Typeform, told TechTarget: “GenAI has lowered the fluency bar…” from coding to reasoning about the problem. What we can do best is give it meaningful problems, then, that drive value and outcomes for ourselves, our associates and our customers.
Enterprise risks are increasing at exponential speed
This does come with some risk though for organizations. A cyber architect colleague and I were recently chatting and the reality is that while dashboards are mostly low-risk, apps that aren’t inventoried or governed, and that proliferate but don’t necessarily ever get shutdown, exponentially expand your company’s attack surface without anyone knowing. Even when many people create similar dashboards with slight differences, the primary risk is usually making the wrong decision from inconsistent information. App sprawl will give us executable business logic, data movement, permissions, and security exposure. That’s a much bigger deal.
Without skilled operators making sure those apps are coded with “industrial grade” protections, your customers’ data will be shared, copied, used in insecure databases, and be exposed to constant cyber threats. This will (yes: will) create vast opportunities for offensive AI systems used by threat actors to exploit. It almost seems inevitable, so CEOs and technology leaders need to be thinking about the trade-off between self-service and speed vs. their company being hacked, attacked, ransomed, or worse.
Speed needs guardrails
All is not lost: the better move is to learn from the BI example. With the right guardrails, company agreements, and cultural expectations, leaders can steer their teams to doing the right thing while still taking advantage of speed. One example is ensuring that you have enterprise-grade AI protection infrastructure in place. The next is making sure that your company uses a harness that has your guardrails built in. This is what we mean when we say governance as code: your build environment needs to automatically guard against vulnerabilities. With coding tools as sophisticated as they are, companies will need AI agents driving more of the development and maintenance lifecycle. The winners will be the companies that allow those agents to automatically inspect code, fix vulnerabilities, run security checks, update related issues, execute regression tests, and prepare releases for human review in record-breaking time. The human being will still own the decision, but AI agents will accelerate the cycle.
5 Things To Do Today
Create an AI-built app inventory now.
Ask teams what they have already built with AI, low-code, spreadsheets, scripts, or workflow tools.Classify apps by business risk.
Personal productivity tools, team workflow tools, and business-critical/customer/data-sensitive apps should not have the same review process.Give citizen builders an approved sandbox.
Make the safe path easier than the rogue path.Require an owner, data classification, and review date.
Every small app should have a named human, known data sources, and a review point. Even small apps need to have a lifecycle including retirement.Teach product management as a core AI skill.
Train people to write requirements, test outputs, document decisions, and know when to call IT, data, cyber, legal, or compliance.
If you are leading data, AI, technology, or operations work, this is the new operating layer to watch: not just what AI can build, but how companies govern what gets built.
Vibe coding is here, and it is not just for software developers. It is for anyone who can see a problem, describe a better outcome, test what gets built, and keep improving it. That should excite leaders, but it should also sober them up. App sprawl is coming, and it will move faster than BI sprawl ever did. The answer is not to slow everyone down. The answer is to teach people how to build responsibly and give them the guardrails to do it safely.
Subscribe to dAItaPoints for practical operating memos on AI-ready data, agentic AI, governance, and the leadership work behind production AI.
The BI sprawl analogy is perfect — and you've nailed the key distinction: dashboards inform decisions, but apps execute them. That's a fundamentally different risk profile.
Reframing the skill shift as "product judgment" rather than "everyone needs to code" is both more honest and more actionable. Define outcomes, prioritize, test — that's where the value is.
The security point deserves to be louder: inconsistent data gave us wrong decisions; ungoverned apps give us exploitable attack surfaces. The stakes aren't comparable.
"Governance as code" is exactly the right frame — make the safe path the fast path, and you win on both dimensions.