Skip to content

Start here: paths by role and situation

Pick your role or your situation below. Each path is two to four pages, in the order to read them, and every page it lists is finished. If nobody at your business owns worker-built apps yet, read the starter for when nobody owns this today first; that page is still being written, so until it's published, begin with risk tiers and the app registry.

Who this is for

Anyone arriving with a question about apps, automations or agents that staff build with AI. You'll get the pages to read first for your role or situation. Reading time: about 4 minutes.

Which pages should you read first for your role?

Your role The question you probably have Read these, in order
Executive Should we let staff build apps with AI, and on what terms? 1. What vibe coding means for a business 2. The eight principles 3. Roles and decision rights
IT manager How do we know what exists, who owns it and what each app needs? 1. Risk tiers 2. App registry 3. Intake and approval 4. Support model
Security lead What goes wrong with AI-built apps, and what do we check? 1. Why vibe-coded apps expose data 2. The security review checklist 3. MCP and agent security 4. Securing AI features
Platform, DevOps or SRE What should we provide so the safe way is the easy way? 1. The paved road 2. Guardrails 3. Approve AI tools and app builders
Builder (not a developer) What can I build today, and how do I get it approved? 1. Write a build spec 2. Get your app approved 3. Make it production ready
Builder (developer) What's expected of my side project or agent once others use it? 1. Risk tiers, especially the actions question 2. MCP and agent security 3. The security review checklist 4. Evals for AI features
App owner I'm accountable for an app someone else built. What do I do? 1. App ownership 2. When the builder leaves 3. Support model
Data or privacy owner Which apps hold personal or confidential data, and how is it protected? 1. The data question in the tier model 2. Why vibe-coded apps expose data 3. Apps that make decisions about people
Legal or compliance lead Which laws apply to apps staff build with AI? 1. US and Canadian laws 2. Apps that make decisions about people 3. The EU AI Act

The builder handbook start page and the program strategy pages are being written. Until they're published, builders should start with the build spec, and leaders with the principles.

Where should you start in your situation?

We already have worker-built apps that nobody tracks. Find them, record them, then tier them. The page on finding existing apps is still being written. Until it's published, the app registry page covers where to look and what to record, the risk tier workshop tiers a batch of existing apps in one session, and intake handles each new one from then on.

We're about to allow AI app builders. Decide which tools are approved for which data, set the tier rules, then give builders a default place to build. Read approve an AI tool or app builder, then risk tiers, then the paved road and its guardrails.

An app is about to be shared or go live. Check its tier, then run the go-live checklist and the security checklist at the depth the tier sets. Read the go-live checklist and the security review checklist.

A builder just left, or is about to. Trigger the handover from the HR leaver event. The app owner names a new maintainer or starts retirement, and moves credentials, secrets and agent grants to the successor before the builder's account is disabled. Read when the builder leaves.

Someone wants to add an AI feature to an app. An app that calls an AI model at runtime has its own risks, such as prompt injection and wrong answers presented as fact. Read securing AI features, then evals for AI features.

Someone built an agent or an automation. Agents and automations are worker-built apps. Tier them by every permission they hold, then apply the agent controls. Read the actions question and MCP and agent security.

The app helps decide things about people (hiring, pay, credit, access to services). Legal triggers can set the tier on their own, and some decisions need meaningful human review. Read apps that make decisions about people.

We banned AI tools, and people use them anyway. Bans hide use; they don't stop it. Offer an approved tool and a private sandbox, then restrict what's genuinely too risky. Read enable, don't ban and approve an AI tool or app builder. A page on policy for unsanctioned AI use is being written.

Don't: start with a ban (AP12)

A ban without an approved alternative pushes building into personal accounts and unapproved tools, out of sight. One widely reported 2023 ban on staff use of generative AI was later followed by a broad rollout of a sanctioned tool, according to the vendor's announcement.2 Approve something first.

Why start now?

Most would-be builders already use AI at work, and many use tools their employer hasn't approved: as of mid-2026, vendor surveys put unapproved use at between about half and two-thirds of office workers.1 So the apps usually exist before the policy does, and finding and tiering them belongs near the start.

How is this site organized?

Assumptions and evidence

  • A-003 (High): we expect most would-be builders at a typical business to already use AI tools at work, often unapproved ones; test this by checking identity or network logs for traffic to AI services during a pilot.

Evidence: vendor surveys and a vendor announcement; no controlled study. Facts on this page are as of October 2026.

  1. PagerDuty, survey release on unauthorized AI tool use, 11 Jun 2026 [vendor], https://s206.q4cdn.com/635206389/files/doc_news/PagerDuty-Report-Finds-Two-Thirds-66-of-Office-Professionals-Have-Used-Unauthorized-AI-Tools-at-Work-2026.pdf, accessed 2026-10-21; and The Register on an Okta survey, 27 May 2026 [news], https://www.theregister.com/ai-ml/2026/05/27/bosses-blinded-by-confidence-about-shadow-ai-use-by-workers/5247275, accessed 2026-10-21. ↩

  2. Bloomberg, "Samsung bans ChatGPT and other generative AI use by staff after leak", 2 May 2023 [news], https://www.bloomberg.com/news/articles/2023-05-02/samsung-bans-chatgpt-and-other-generative-ai-use-by-staff-after-leak; and OpenAI, Samsung Electronics deployment announcement, Jun 2026 [vendor], https://openai.com/index/samsung-electronics-chatgpt-codex-deployment, accessed 2026-10-21. ↩