IT does not disappear: it becomes the platform for democratizing AI

When a business area can produce an agent, an automation or an interface in hours, the first bottleneck seems to have disappeared. The first version went cheap. The difficult work only changed place: identity, data, integration, observability, support, cost and withdrawal continue to exist.

This Evidence Brief describes a minimal architecture to transform distributed experiments into an organizational capacity. The goal is not to recentralize all creation. It is to make the way governed faster than the deviation.

Technical summary

Sustainable democratisation requires two simultaneous layers:

1. one creation experience accessible to areas, with approved models, components and environments;
2. one control platform that imposes identity, authorization, data, evidence and operation outside the prompt and outside the tool that generated the software.

DORA 2025 describes AI as an amplifier of strengths and weaknesses in the delivery system. AWS documents an enterprise GenAI portal for standardized access, security, and reuse. Itaú reports an internal platform for shared models and components while initiatives advanced across multiple areas. These cases do not prove a universal design, but they converge on one pattern: scale depends on a platform, not only on licenses.

The new input flow

The company needs to accept four distinct states:

The common mistake is to treat everyone as production or everyone as laboratory. The platform needs to allow for explicit progression. Each state change increases evidence, authorities and responsibilities.

Minimum control plan

A corporate fast track can start with a few blocks:

• catalogue of models and tools with purpose, restrictions and cost;
• federated identity for persons, services and agents;
• approved connectors limiting scope, data and actions;
• sandbox with synthetic data and automatic expiration;
• templates for APIs, interfaces, agents, evals and telemetry;
• asset registration connecting solution, owner, purpose, repository and environment;
• promotion gates proportional to the risk;
• kill switch and withdrawal to interrupt or expire what is no longer valid.

Real permissions must be imposed by mechanisms external to the model and tested in the environment in which the software operates. [HARNESS31-C2]

Identity and authorization are not finishing details

Login proves who started a session. He doesn't prove that this person can read a line, trigger an action or use a credential. Each connector needs to apply authorization to the server and preserve the context of who asked for the action.

The minimum set of negative tests shall include:

• anonymous person does not access the asset;
• user A does not read or change user data B;
• agent does not extend the scope received;
• denied change does not change state;
• administrative secrecy does not reach the customer;
• logs record decision and result without copying sensitive content.

Safe Autonomy combines isolation, revising changes and external verification to generation. A worktree or a second session helps to separate execution, but it is neither security border nor independence by itself. [R1-C2]

The contract between area and IT

The business area remains accountable for the problem, the process, and the expected outcome. The technology platform provides reusable paths and shares responsibility for the transition into operation. The contract must identify:

• business owner and technical owner;
• permitted data and purpose;
• users and authorised actions;
• baseline and sign of success;
• validity of the experiment;
• conditions of promotion, interruption and withdrawal.

Implementation, verification and acceptance papers may use AI, provided that authority, context and evidence do not collapse in the same circuit. [R1-C3]

Evidence gate proportional to risk

There's no reason to submit a prototype with synthetic data to the same process as a money-moving system. Gate can grow by level:

Level 1 — reversible

• hypothesis, owner and deadline;
• isolated environment;
• synthetic data;
• Automatic disposal.

Level 2 — recurrent internal

• SSO and authorisation;
• classification and minimization of data;
• functional and negative tests;
• logs, cost and support;
• dependencies and artifacts identified.

Level 3 — critical or external

• threat model;
• evals and acceptance criteria;
• security and privacy review;
• SLO, alerts, backup and restoration;
• release receipt, rollback, and acceptance authority.

The goal of the gate is to reduce time to a reliable decision. Checklist without link to risk, verifier and authority re-creates the queue that the platform should delete.

Metrics that prevent the illusion of speed

Count code lines or prototypes only as signs of activity. To evaluate organizational capacity, follow:

• time of the idea to the first user test;
• prototype time to reliable result;
• percentage of assets with owner and validity;
• reuse of components and connectors;
• rework, authorisation failures and incidents;
• cost per flow and per result;
• time of withdrawal from an unsafe or unused asset.

An organization can generate more software and deliver less value. Gain appears when the platform reduces waiting, repetition and risk at the same time.

What this brief proves — and what does not prove

Sources show standardized public access strategies, shared components, and governance to expand the business use of AI. They do not demonstrate that every organization should copy a specific platform or that vibe coding produces net gain in any context.

The presented design combines these sources with FORGE mechanisms. It is a technical model for decision and adaptation. It is not evidence that a specific implementation already operates or satisfies the gates.

Direct sources

• DORA — State of AI-assisted Software Development 2025
• AWS — Democratizing GenAI through the Global Enterprise Portal
• Itaú Unibanco — Annual Integrated Report 2025
• NIST — AI Risk Management Framework
• NIST — Secure Software Development Framework

Conclusion

Vibe coding reduces the distance between intention and prototype. The platform reduces the distance between prototype and responsibility.

When identity, connectors, environments, evidence, and retirement paths are reusable, IT stops being a queue for every request. It becomes the infrastructure that lets more people build quickly and remain accountable for what they put into operation.