How to secure and support internal AI apps built by non-technical employees
Non-technical employees are building internal business applications using AI tools that bypass standard IT reviews, creating a massive queue for production sign-off and a wave of shadow IT. Because standard deployment processes like CI/CD are impossible for non-developers to follow, IT managers are left with no way to establish proper governance or security standards without breaking the speed of business.
What the numbers show
Counted from the threads quoted below. How we count
- The most recent one is from October 2026.
- This comes up 101.7× more often in r/ITManagers than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Treating AI-built internal apps as ephemeral and securing the environment perimeter (paved road / managed infrastructure) rather than auditing every line of generated codeDid this help you?
- 2Routing around IT or creating shadow IT when approval processes have too many technical hurdlesDid this help you?
- 3Refusing to approve or run any AI-built applications due to safety and maintenance risksDid this help you?
- 4Educating clients on risks, granting the lowest permissions possible, and having them sign a waiverDid this help you?
- 5Deploying internal web apps securely to Azure App Service behind authenticationDid this help you?
- 6Running the requested code through AI to find better existing alternatives like Microsoft 365 features and offering paid consulting hours to clean it upDid this help you?
- 7Buying off-the-shelf SaaS solutions like HubSpot or SalesforceDid this help you?
- 8Using open-source templates from GitHubDid this help you?
- 9Using third-party aggregation or integration servicesDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“We have now received two client requests to install their Claude code built app with Claude instructions on what to do.”source ↗
“The friction i get is that pushback alone: "claude said you need me to enable IIS on your DC to host this" or "i need IIS on my workstation to host this"”source ↗
“I hate these requests because the app they make is always the worst way to do whatever it is and it's always a script that needs python or something instead of a finished, executable product or functioning service.”source ↗
“How we ended up in a timeline where non tech people think they can shit out an app and have it actually operate in a serious business? No idea”source ↗
“Lol, this "paved road" is impossible to follow for someone not technical. I guarantee you have a boat load of shadow IT happening because Mike from accounting doesn't know what CI/CD is”source ↗
“I have a growing queue of employee-built internal tools waiting for IT approval, and I need to establish a formal sign-off standard before granting production access.”source ↗
“The ongoing maintenance, bug fixes, edge cases, security updates, and the fact that you become the unpaid IT department forever — that’s where it gets expensive in time if not money.”source ↗
“Building your own works great until it doesn’t.”source ↗
“Maintenance and integrations has still been a struggle even with app builders out there”source ↗
Where this came up
People with this problem also raised
- 2Why won't Claude connect to Salesforce?
- 3How to decide who gets access to workplace AI tools
- 8How to audit employee AI tools and browser extensions
- 7How to let AI update CRM data without breaking hidden workflows
- 16How to push back against forced AI tools at work
- 10Is it safe to use AI for business financial data?