I'm a sysadmin who also builds and maintains internal tools, usually with Python and Flask. I care about security, documentation, predictable dependencies, and having a clear support model. Our COO, who has no real programming background, recently used an AI tool to generate a complete dashboard as one enormous HTML file. It contains thousands of lines of difficult-to-read JavaScript, unpinned libraries loaded from external CDNs, unclear data connections, and no obvious architecture or deployment plan. He now wants me to review it and may want to expand it significantly.
I'm concerned about security, licensing, data exposure, correctness, maintainability, and being held responsible for a system I didn't design or approve. I also have existing work and don't want this to become an unsupported production application by default. At the same time, I need to handle the situation professionally because he is a senior executive. How would you frame the conversation, assess the prototype, and set boundaries without damaging the relationship or inheriting a maintenance nightmare?
4 Answers
Treat it as a prototype and requirements document, not a production application. Start by asking what business problem it solves, which data it uses, who needs access, and what “finished” means. Then explain that turning the prototype into a supported system requires authentication, approved data sources, dependency management, testing, documentation, backups, monitoring, and an ownership model.
Give him options instead of just rejecting it: rebuild it using an approved dashboard platform, create a properly structured application, or keep it as a sandbox experiment with no sensitive data and no production support. Include the estimated effort and what existing work would have to be delayed.
You can also offer a constrained sandbox: synthetic or non-sensitive data, isolated hosting, no write access to business systems, and no promise of production support. Let the COO experiment there if he wants to learn, while making the boundary explicit. If the project grows beyond that, it must go through the normal technology and security process.
The important thing is to avoid silently accepting ownership. Agree on who maintains it, who responds when it breaks, what availability is expected, and what other work gets deprioritized. If those questions have no answer, it is not ready to be an operational system.
Be direct, but speak in terms of risk and prioritization rather than insulting the code. Document specific findings such as external scripts with unpinned versions, unknown API calls, possible credential exposure, lack of access controls, untested calculations, and the absence of a recovery or support plan. Ask the COO to approve the risks in writing if he wants the prototype deployed as-is, and involve your manager, security, or compliance team as appropriate.
Also make it clear that reviewing a file is not the same as accepting responsibility for maintaining it. If the company wants a real dashboard, request a formal project, schedule, budget, and either dedicated development time or outside help.
Instead of saying “I can’t do this,” say “Here is the investment and risk required to do this responsibly.” That makes the conversation about a business decision rather than a personal refusal.
Use the existing code only as a visual mockup. If the dashboard is valuable, rebuild it on an approved platform or in a normal repository with a backend, read-only service credentials, pinned dependencies, code review, automated tests, and a deployment process. A business intelligence tool may already provide most of what he needs without creating a custom application.
An AI-assisted review can help produce an objective checklist, but don’t treat another model’s approval as a security audit. Validate the findings yourself and keep company data and credentials out of unapproved AI services.
That approach also preserves the useful part: he has already shown you the metrics and layout he wants. You can reuse the concept without inheriting the generated implementation.