How can organizations govern low-code development to balance business innovation with IT security and control?

Host: Welcome to A.I.S. Insights — powered by Living Knowledge. I am your host, Anna Ivy Summers, and today we are tackling a challenge that almost every modern enterprise is wrestling with: how to embrace cutting-edge decentralized tech without spiraling into digital chaos. We are diving into a fascinating new study titled "Lost in decentralization? Governing emerging technologies within enterprise architecture." Joining me to break it down is our analyst, Alex Ian Sutherland. Alex, it is great to have you here.

Expert: Thanks, Anna. It is wonderful to be here. This study tackles a really urgent topic: how organizations can integrate low-code development platforms into their enterprise architecture management without losing control.

Host: Exactly. Low-code platforms promise that anyone in marketing, HR, or finance can become a "citizen developer" and whip up an application in an afternoon. But as business leaders know, that can create massive headaches. Alex, what is the core problem the researchers set out to explore?

Expert: Well, Anna, it comes down to a fundamental clash of cultures. On one hand, you have business units adopting low-code platforms to solve immediate operational bottlenecks quickly. On the other hand, you have traditional, centralized IT and enterprise architecture teams whose primary mandate is security, compliance, stability, and long-term maintainability.

Host: And when those two collide, sparks fly.

Expert: Exactly. If IT steps in with heavy-handed corporate bureaucracy, you crush business agility, and people just build underground solutions anyway. But if IT is completely hands-off, you end up with rampant shadow IT, severe security vulnerabilities, compliance breaches, and what enterprise architects call "architectural drift," where the company’s tech stack becomes a tangled, unmanageable mess.

Host: So how did the authors investigate this dilemma? What was their approach?

Expert: The authors conducted an interpretive multiple-case study across three distinct, highly regulated sectors: financial services, healthcare, and manufacturing. By looking deeply into these three diverse enterprise environments, they were able to observe firsthand the real-world tensions between central IT architects and decentralized business developers, as well as the governance tactics that actually worked.

Host: Let's get into the meat of what they discovered. What were the key findings of the study?

Expert: First, the study maps out the governance challenge across three core dimensions: what is governed, meaning things like security risks and architectural drift; who is governed, which highlights role ambiguity between business users and professional developers; and how governance is enacted, balancing control versus enablement.

Host: That last part—control versus enablement—feels like the million-dollar question. How do successful organizations resolve that tension?

Expert: That is the central finding of the study. The researchers found that successful organizations abandon purely restrictive, one-size-fits-all policies. Instead, they design balanced governance portfolios that blend formal and informal instruments.

Host: What does that blend look like in practice?

Expert: On the formal side, you have automated guardrails, enterprise application registries, and risk-tiered review processes. If you are building a simple survey for lunch orders, the oversight is lightweight. But if your app touches customer financial data, rigorous architectural checks trigger automatically.

Host: And on the informal side?

Expert: That is where enablement shines. They establish communities of practice, peer coaching, and internal low-code centers of excellence. Central IT shifts from acting as an obstructive gatekeeper to acting as an internal consultant or coach who empowers business users to build safely.

Host: The study also outlines five causal mechanisms that make this dual approach work, right?

Expert: Yes. When you combine formal and informal instruments, you activate five key dynamics: you create information symmetry so IT actually knows what apps exist; you build perceived legitimacy so business users do not view governance as a barrier; you raise developer capability through coaching; you align decision rights; and you create "secure-by-default" conditions inside the platform itself.

Host: That makes total sense. Another term in the study that really jumped out at me is "knowledge debt." Can you unpack that?

Expert: Knowledge debt is a massive hidden risk. Imagine a citizen developer in logistics builds a brilliant custom low-code app that the entire warehouse depends on. Two years later, that employee leaves the company. There is no technical documentation, no code review trail, and central IT had no hand in building it. Suddenly, a mission-critical tool is orphaned, and nobody knows how to fix or maintain it. That is knowledge debt, and it can paralyze operations.

Host: That brings us to why this matters so much for business leaders. What are the practical takeaways here?

Expert: The main takeaway is that decentralization cannot be governed by 50-page policy manuals anymore. If you want speed and security, you have to build platforms where the safe path is the easiest path. Business leaders and CIOs need to partner. IT must provide pre-approved components, identity management, and coaching, while business units must accept accountability and register their solutions.

Host: It is about moving from enforcement to enablement, without abandoning responsibility.

Expert: Spot on.

Host: What a fantastic blueprint for navigating the future of decentralized tech. Alex, thank you so much for sharing your insights today.

Expert: My pleasure, Anna.

Host: And thank you to all our listeners for tuning into A.I.S. Insights — powered by Living Knowledge. Join us next time as we continue unpacking the latest research shaping the future of business and technology. Until then, stay curious.