Vibe coding has democratized software development, but what about governance?

This article is part of our Opinions section, where we invite industry professionals to share their views on the most pressing technology questions of our time.

Here, Jeff Kuo, CEO and Founder of Ragic, explores how vibe coding is making software development accessible to non-technical employees while creating new governance challenges.

Thanks to artificial intelligence (AI), anyone can create software using vibe coding without learning a programming language or waiting for the development team. Users describe what they want in plain language, and AI builds the application, with this trend becoming popular in the workplace- for businesses of all sizes.

For small businesses, that changes who can automate operations. While no-code platforms have been around for over two decades to help non-technical teams create applications, today AI is making that process easier and enhancing those capabilities. For example, today a business owner can create an inventory tracker; an operations manager can automate approvals; a sales team can build an application to manage leads and generate reports. For larger enterprises, this enables teams in various departments to tailor applications and leave the IT team to deal with larger projects.

But all of this democratizing software development has created another challenge: governance. AI can now generate applications faster than many people can manage them. The result is now what some call “vibe slop” or applications that solve an immediate problem but lack the architecture, documentation, and controls needed to become sustainable business systems.

As organisations rapidly adopt these tools, the gap between productivity and security is widening. The “nightmare scenarios” are no longer hypothetical, as they’re playing out in documented, real-world incidents.

The issues with vibe coding

Using AI for software development is attractive because it allows business users to focus on outcomes rather than implementation. All the user has to do is describe what they want to accomplish and keep refining the request until they get a working application.

The challenge is that business software must do more than just run. It must operate within the larger business IT infrastructure.

According to an article in CIO, “…traditional governance models assume enterprise technology evolves slowly enough for architecture reviews, security assessments and compliance oversight to keep pace with implementation. AI breaks that assumption. Capabilities evolve faster. Integrations happen faster. Workflows change faster. Employees adopt tools faster. Shadow AI spreads faster.”

AI-generated code may contain poorly normalised data models, inconsistent schemas, hard-coded business logic, weak authentication, inadequate error handling, or unvalidated database queries. Other employees may be looking to solve similar problems, which could lead to multiple applications with redundant functions and duplicate datasets.

Maintaining the integrity of the underlying infrastructure can be an even bigger issue. AI-generated applications may create inappropriate data types, improper relationships between primary and foreign keys, missing indexes, duplicate records, or databases that lack adequate referential integrity.

These types of problems may not be immediately detected. The application may seem to run perfectly with 50 records and five users, but it starts to break with 50,000 records and 50 employees, or when it’s connected to other business systems. By then, troubleshooting is harder than building the original application.

Then there is the question of who owns the application. Who understands the application and is responsible for the data? Who has access? If there is no documentation, what happens when the employee who created the application leaves?

Without documentation and clear ownership, a business may discover six months later that nobody understands how an AI-generated application works.

Governance needs to be embedded

As AI use becomes common in the workplace, companies are adopting governance policies that tell employees which tools they can use, what information shouldn’t be used in public platforms, and when AI-generated work needs human review. These policies are important, but they don’t work with AI-generated applications that have direct access to business data and workflows.

With vibe coding, governance must be embedded in the application and the data layer.

Controls must be built in to determine what information users can see and modify. Audit trails must be created to see what has changed and who made the changes. Integrations must be managed. Workflows must be consistent, including approvals and business processes. 

No-code and low-code platforms can complement vibe coding by offering a foundation for governance.

AI makes application development easier and faster. A structured no-code or low-code environment can provide controls over how the applications are implemented, including permissions, integrations, and workflows. With a no-code/low-code foundation, applications created through AI experimentation can be deployed as sustainable business software.

Eight guardrails for vibe coding

An enterprise-scale governance program isn’t required to experiment with AI-generated business applications safely. A few practical safeguards can reduce risk while still allowing users to experiment with writing software using AI.

1. Start with low-risk use cases.

Choose low-risk applications for AI experimentation, such as internal workflows, scheduling, reporting, and data organisation. Customer-facing systems and financial transaction processing pose a much higher risk. The consequences of failure should determine the level of governance required.

2. Know what data the application can access.

Before deploying any AI-built tool, determine what information it can read, modify, and share. Limit access to what the application and users actually need, and be careful about granting access to financial, customer, and proprietary business information.

3. Keep a human in the loop.

While AI can create an application, someone should still oversee how it operates, especially if the software makes decisions, changes records, communicates with customers, or triggers business actions.

4. Document what gets built.

How well AI performs ultimately depends on the quality of the documentation and context it has access to. One of the most common reasons AI will not perform as expected is simply that it lacks enough context. If AI doesn’t know how a business process has been handled in the past, it will rely on general knowledge and common sense, producing a generic answer rather than following the company’s established practices.

This matters because humans naturally absorb context simply by being in the office. They know how things were done before, who is responsible for what, which exceptions exist, and why decisions were made. AI doesn’t automatically have that knowledge.

Documentation is how organisations give AI that missing context—and it may be one of the most important steps they can take to make AI more effective. 

Documentation has also never been easier to make work. In the past, nobody had time to write it well, and nobody had time to read it once it existed, which is why most documentation failed. That problem doesn’t exist for AI. Given proper instructions, it will faithfully write the documentation it’s asked to produce, and reliably read whatever it’s pointed to.

5. Don’t build applications in isolation.

To prevent shadow IT, businesses must record what applications employees create and, where appropriate, review them before deployment. The goal is to prevent building different applications to solve the same problem.

6. Use platforms with built-in controls.

A quick AI-generated prototype can solve an immediate problem, but it still requires governance. A structured no-code or low-code foundation provides the necessary controls over permissions, audit trails, integrations, and workflows while still allowing users to build custom applications.

7. Review applications as the business changes.

A workflow built for a five-person team may prove inadequate as the company grows. Adding more users, data, and integrations can expose weaknesses. Governance should evolve along with the business to prevent problems.

8. Focus on business outcomes, not the number of applications.

Even though vibe coding makes creating software easy, application creation should not be an end in itself. The objective is to eliminate unnecessary work and make the business operate more efficiently.

Democratizing governance

Vibe coding makes it easier for businesses to automate operations, placing software creation in the hands of those who need it. However, small businesses shouldn’t have to choose between adopting AI-generated software and abandoning software development controls.

The future of business software will be less about whether the applications were created by software engineers, citizen developers, or AI, and more about whether those applications can be understood, governed, and trusted. 

Vibe coding has democratized software development. The next challenge is democratizing governance, so those empowered to build applications have the structure needed to build them responsibly. The goal isn’t simply to create more software faster. It’s to create software that improves the business and is worth keeping.

Related articles

• Vibe coding is the new shadow IT
• Vibe coding won’t kill SaaS… but it will kill weak SaaS
• IBM Bob is out… so what do users and experts think?