Low-Code Platforms Hit the Enterprise Governance Wall
Citizen-developer apps are multiplying faster than IT can review them, prompting new guardrails.
Low-code platforms promised to let business teams build their own applications without waiting for IT. In many enterprises, that promise has been kept — perhaps too well. Citizen-developer apps are multiplying faster than technology teams can review them, and a new wave of governance is arriving.
The success that created a problem
Business users have built thousands of apps to automate approvals, track requests and replace spreadsheets. Many deliver real value quickly. But some now handle sensitive data, connect to core systems or support critical processes — without the testing, security review or support model those uses would normally require.
“We discovered a citizen-built app processing customer refunds. It worked well. It also had no owner, no backups and no audit trail.”
Guardrails, not gates
Organisations getting the balance right are avoiding outright bans, which simply push work back into unmanaged spreadsheets. Instead, they are introducing proportionate controls.
- Environments separated by risk, with stricter rules where sensitive data is involved
- Approved connectors to core systems, with restricted access to everything else
- Mandatory ownership and review for apps above a usage or data threshold
- A clear path for successful apps to graduate to professional support
A partnership model
The most effective programmes treat citizen developers as partners. IT provides platforms, templates, training and a fusion team that can step in when an app outgrows its origins.
Low-code is not going away. The goal is to keep its speed while making sure the enterprise can trust what gets built.