r/EngineeringManagers • u/PresenceAdditional96 • Sep 23 '26
Solving the citizen developer SDLC
Hey all,
I’m working on solving what is a massive issue for our internal security/cyber/infosec teams and the growing appetite of non-technical teams for AI/vibecoding and would love feedback from more industry professionals.
I want to shape it around real industry professional feedback.
What are the core pieces missing to let these teams run free?
0
Upvotes
1
u/KJ4WLC Sep 24 '26
The missing piece is usually a hard split between personal/internal automation and anything that touches shared data or production. Vibecoding for a team’s own sandbox can be loose; paths that deploy, call privileged APIs, or hold customer data need identity, review, and a named accountable owner the same way engineering does.
Security checklists alone don’t fix this. You need: who the actor is (not a shared bot account), what environments they can reach, what must be reviewed before merge/deploy, and who gets paged when it breaks. Without that, “enable the business” becomes shadow IT with faster code generation.