AI Pulse · Under the Radar

A thread making the rounds this week puts a name to something a lot of owners are already wrestling with, whether to let people at the company use AI tools to write and ship code on their own. The person behind it calls this “vibe-coding” and lays out two ways companies get it wrong.

The first way is blind-enable. You let anyone prompt their way into building tools, dashboards, or automations, and nobody’s watching what gets connected to what. That’s how you end up with a security problem you don’t find until something breaks. The second way is blind-deny. You lock it all down, route every request through IT, and kill the exact thing that made AI coding tools worth using in the first place, speed.

The proposed middle path is what the thread calls a scaffold. IT sets up the guardrails once. That means the repo, the sign in process, the deploy identity, a private environment to work in, and a database that’s defined as code rather than something anyone can edit by hand. Once that’s built, employees can prompt inside it, build what they need, and open a pull request for review before anything goes live. Nobody’s blocked, but nothing skips a check either.

This is close to plain-English language for what we’ve already been building for clients. Setting up that scaffold, the identity, the environment, the review step, so people can move fast without IT losing the ability to see what’s happening, is the kind of thing we build into an AI command centre. If your team is already experimenting with AI coding tools without a structure like this in place, it’s worth treating as a near-term priority rather than a someday project.