A finance director built a useful internal application with AI assistance and now wants the rest of his team to use it. What process should it go through before we approve access or put it into production? I'm especially unsure about security, compliance, authentication, maintenance, ownership, and deployment.
5 Answers
Have the creator work with the internal development or applications team instead of handing the tool directly to IT operations. They can review the code, write down the requirements, check for an existing product that already solves the problem, and decide whether to harden the prototype, rebuild it, or retire it.
For anything involving financial or confidential information, require a proper security review and penetration test. Check for exposed credentials, unsafe dependencies, excessive permissions, weak authorization, missing audit logs, and poor handling of secrets. A software bill of materials and a plan for patching vulnerabilities would also be useful.
If it’s only a small, self-contained utility, consider whether it can run as static HTML and JavaScript without a backend, database, or new infrastructure. That can reduce the attack surface and operational burden. But if it handles sensitive data or needs shared access, it still needs to go through the organization’s normal approval and production process.
Set some technical guardrails before approving it: use a company-managed repository, approved languages and frameworks, centralized authentication such as SAML or OIDC, CI/CD, controlled hosting, and documented deployment procedures. The department that requested the tool should provide an owner, budget, and support plan so the help desk or sysadmins don’t unexpectedly inherit it.
Treat it like any other line-of-business application, regardless of how it was written. Start with an intake and review: identify what data it accesses, where it runs, who owns it, how users authenticate, what permissions it needs, and how activity is audited. Then apply the normal security, governance, testing, and change-control requirements before wider deployment.
It’s also worth documenting the risks of AI-generated code up front. If the application fails later, there should be a clear record that security and maintenance concerns were identified and addressed.
A code review alone isn’t enough. You also need to know which versions and services it depends on, how vulnerabilities will be tracked, and who is responsible for fixing issues after launch.