For a long time, IT departments were gatekeepers and some of them seemed to really enjoy the role, that power. They knew how to code. They held the keys to anything that got built. That gave them control over the timelines, the budgets, the requirements, and the results, with very little anyone could do about it. You wanted a change to a system. It would cost real money and real time, and what came back was rarely what you asked for. It was the smallest version of done that closed the ticket, and you learned to live with it, because there was no other option.
That was the point. There was no other option.
Generative AI changed that. The door that stayed locked for decades is now open.
A subject matter expert can build. I can build. So can a lot of people who never could before. All the demand that piled up over the years, the tools, the interfaces, and the small systems that business people wanted and could never get to the top of the queue, is now within reach of the person who actually needs it. You do not file a request and wait two quarters. You do not explain what you want to someone who has never done your job. You can now make a working version yourself.
I am not going to pretend that it is not satisfying. For a lot of people it is a correction that was overdue.
Now for the part that spoils the mood, because the celebration is skipping a step.
When you build something this way, you are not just making a feature. You are making decisions about security and data privacy whether you know it or not. Most people building this way are not thinking about that at all, because they are focused on the output. Is the answer right? Is the tone right? Is it fast enough? Does it look good in the demo?
Those are the wrong things to worry about first, or at least they are only half the job.
Picture a shopkeeper who spends all day on the sidewalk, waving people in, pleased that the crowd keeps growing, so focused on the front door that they never consider the person who came to steal, or the one who came to break something. They built a fine storefront and left the back wide open.
That describes a lot of what is being built right now. A fine storefront. No thought given to what data the app quietly hands to a model, what it exposes to whoever uses it, or who might arrive with bad intent. The builder was so intent on getting the message out that they never asked who else was listening.
The front end got democratized. The foundation did not.
You can build an interface this way. You cannot build a sound data structure, a real security posture, or governance that holds up when something goes wrong. Those still take people who have done it before and know where the risks hide. The gatekeeping is over – and from the bottom of my heart, good riddance to the worst of it! But the discipline the gate was supposed to protect didn’t vanish when the gate came down. It just stopped being handled by default, and became something you have to, you must, account for on purpose.
This is not an argument for going back to a two-quarter wait for a ticket. It is an argument for building fast, and then bringing in the people who can tell you what you left exposed, before someone else finds it first.
So if you are building things now – like you should be – one question is worth asking before you ship it:
You put all that energy into getting people through the front door. Did anyone check the back?
