AI tools are making it easy for business and product teams to create applications quickly, but the people building them often do not understand the code, security requirements, or operational work involved. Engineering and DevOps then end up maintaining, securing, and hosting systems they did not design, while the original authors are still considered the owners. How are companies handling this? Does Engineering or DevOps become the default owner, or do the original teams remain responsible? Are these applications deployed in production cloud accounts, isolated environments, or through a hosted platform?
5 Answers
Separate prototypes from real services as aggressively as possible. A prototype can run in a sandbox with no production data, limited network access, a short expiration time, and a clearly named owner. Once it becomes a service, it needs the normal requirements: a repository, authentication, dependency tracking, security review, logging, monitoring, a runbook, an on-call owner, and a rollback plan. If the business cannot fund that work, the application should remain a prototype.
The team that creates the application should own its pipeline and be responsible for fixing anything the security and quality checks find. Engineering can provide the platform, templates, and guardrails, but should not quietly take over the application. If a team wants to deploy it, they also need to be prepared to handle production alerts and follow the same policies as everyone else.
Exactly. If someone wants to build an application and expects another team to operate it, it still has to meet the organization’s infrastructure and security requirements first.
Treat successful prototypes as candidates for adoption, not finished products. Engineering should evaluate the business value, operational cost, security risk, and maintenance effort before taking one on. In many cases the useful prototype is heavily refactored or rewritten before it becomes a supported service. The cost of running and supporting the application is usually much greater than the cost of generating the initial code, so ownership and funding need to be agreed on up front.
AI-generated applications should not get a special exemption from the normal delivery process. Require linting, dependency and security scanning, smoke tests, regression coverage where appropriate, secret management, and an approval gate before production. A platform team can make this easier with approved templates and a paved deployment path, but the application team remains accountable for the code and its behavior.
A good model is to give teams isolated cloud accounts or projects with restricted permissions and strong guardrails. Sensitive data and internal network access should be blocked by default. Automated scanning, policy checks, logging, and security alerts can catch problems without giving teams unrestricted access to the rest of the environment. Promotion to production should be an explicit step, not something that happens automatically because a prototype became popular.
The biggest problem is when a demo quietly becomes a production system because people start relying on it. By then it has real users and real risk, but none of the design, testing, or operational budget.