This blog is a preview of our session at Sirus Connects on October 9, 2026, where we share a concrete blueprint for turning citizen development from shadow IT into guided, well-governed building.
Citizen development needs direction, not a brake.
Something we’ve been hearing remarkably often from clients lately sounds like this: “There are flows and apps running here that IT knows nothing about. One or two of them touch customer data. Shouldn’t we just ban citizen development?”
Our answer is, as always, no. Not because the risk isn’t real, but because banning simply doesn’t work. Lock it down from the top and you don’t get order, you get invisibility. The flows don’t disappear, they go underground. And that is exactly how a productivity gain turns into a data breach.
Why this can no longer be stopped
Citizen development — the idea that business users build their own apps, automations and AI agents with accessible tools like Power Platform, n8n, Copilot Studio or Airtable — is no longer a hype. It’s a response to a simple reality: there are more ideas than IT capacity.
A controller wants a report that refreshes daily. An HR business partner wants an onboarding flow that runs without intervention. A salesperson wants a quick price simulation. If IT needs four months to get each of those things on the roadmap, the business finds another way. And today, those other ways exist — free to download, in every browser.
What keeps surprising us in practice is the speed. We regularly see how a single employee builds an internal assistant with Copilot Studio in two weeks, one that helps colleagues with leave requests or supplier lookups. No ticket, no project, no RFP. Two weeks.
That speed is exactly why you don’t want to slow it down. But that same speed is also why governance matters more than ever today. A Power App built on Friday and running in production on Monday can be a blessing or a disaster. The difference rarely lies in the app itself. It lies in a few simple questions: does it access the right data, is it classified according to the right risk level, is there an owner who maintains it, and can IT see when it suddenly becomes business-critical?
The downside is real
Shadow IT. Duplicate solutions. Unmanaged dependencies. Compliance questions under GDPR and the EU AI Act.
An internal dashboard app has a completely different risk profile than an AI agent that talks to customers, and yet they are often built in the same tool by the same person. The difference between “handy” and “irresponsible” isn’t in the technology, but in the framework around it.
What does work
Governance that is baked into the platform itself, not buried in thick documents nobody reads. Concretely:
- Naming conventions enforced through templates
- Metadata assigned automatically at creation
- Lifecycle policies that flag unused sites or apps
- Connector policies that prevent data from leaking without review
- A risk classification that distinguishes between a team dashboard and a customer-facing AI agent
And on top of that: a Center of Enablement instead of a Center of Excellence.
A Center of Excellence says: “Show me the business case first, then I’ll decide whether you’re allowed to build.” A Center of Enablement says: “We’ve set up the platforms, written the guidelines, agreed on the risk classification. Build. And if your solution gains impact, let’s mature it together.” The ban is replaced by a graduation path.
What we'll show at Sirus Connects
At Sirus Connects, we’ll show what that blueprint looks like in practice:
- Which platform choices to make for which type of use case
- How to set up risk classification without it becoming an Excel monster
- How to manage connectors and data access centrally without locking the business out
- How to set up a lightweight review process that lets a bottom-up flow graduate into a professionally managed solution
Join us on October 9 and let’s explore together how your organisation can evolve from shadow IT to guided building.
Want to follow this live?
Join this session at Sirus Connects on October 9, 2026, from 10h35 to 11h20. Register and secure your spot.
Can’t make it? Reach out to us, we are happy to share our experience and discuss how to give citizen development direction in your organisation.
