Citizen developers: governance is the missing link

The population of software creators has shifted: per Gartner (late 2022), low-code tool users outside IT departments were set to grow from 60% in 2021 to at least 80% by 2026. The citizen developer, the business employee who builds their own applications, has become the majority.

Our thesis is falsifiable: when such a program goes off the rails, the platform is rarely the cause — almost always it is the absence of a framework: inventory, ownership, access control, an organized handover when an application outgrows its team.

A point of honesty: no public, verifiable "failure rate" for these programs exists. The evidence is indirect, but it comes from the vendors and regulators themselves.

Gartner's 2021 survey of 2,820 "business technologists" (business employees who build technology capabilities) measures the gain: organizations equipping them accelerate their digital outcomes 2.6 times more often. Half of these creators already produce capabilities used beyond their own department — this is no longer personal productivity, it is an application estate.

The liability is measured too. Zenity (a security vendor commissioning its own research, September 2024) counts close to 80,000 applications and AI assistants outside the development lifecycle in the average large enterprise; 62% of the items analyzed contain vulnerabilities. Kissflow (a low-code vendor, sample size not published, same period) completes the picture: 83% of technology leaders run a citizen developer program, 44% rank data security as their top concern.

Both sets are true at the same time; governance decides which way the program tips.

"Citizen development governance diverges from conventional software governance." — MIS Quarterly Executive, September 2024 (Viljoen et al., TU Munich / Fraunhofer)

That study, built on 30 interviews, identifies three risks: software quality, shadow IT — applications deployed without IT department approval — and technical debt, the deferred cost of shortcuts. Copying classic IT is not enough: each platform requires dedicated experts. A 2021 MSR academic study confirms it: 75.9% of Stack Overflow questions on dynamic event handling never receive an accepted answer — "no code" runs into real engineering problems fast.

The sector's largest vendor documents the case itself. Microsoft Learn (updated June 2026) describes it plainly: every employee has default access to Power Platform's "default" environment, and when a maker leaves the company, their applications become orphaned. The recommended response is organizational — sharing limits, data loss prevention (DLP), managed environments — with a graduated grid that is directly reusable:

The lesson goes beyond that one vendor. Forrester's July 2024 study of Power Platform — commissioned by Microsoft, and to be read as such — attributes the reduction in shadow IT to the combination of employee autonomy and built-in governance. The missing link is organizational, not technical. It is the principle behind how we build: autonomy first, never without a handover framework.

Two legal texts change the equation. The nFADP (revised Federal Act on Data Protection, in force since September 1, 2023) mandates protection by design, a register of processing activities, and prompt breach notification. A business-built application processing personal data falls under these obligations — without governance, nobody checks that they are met.

For regulated industries, FINMA Circular 2023/1 (January 1, 2024) requires a software inventory that is "regularly reviewed and updated" and makes executive management responsible for overseeing ICT strategy: an uninventoried portfolio is, for a Swiss bank, a direct regulatory gap.

That leaves the objection: governance kills autonomy. The NCSC, the UK's national cyber security centre, answers in its July 2023 guidance: shadow IT rarely stems from malice, but from approval processes that are too slow. Good governance is enabling — this is the core of autonomy-first transformation: give business teams autonomy first, with the framework that makes it durable. Our method starts from that principle.

The critical moment is not creation: it is the handover — the passage from a team prototype to an asset the organization stands behind. OWASP, an independent software security foundation, provides the reference taxonomy; here is the checklist we derive from it.

Points 1 through 9 protect the organization, point 10 protects autonomy. They work together, or the program fails.

Three limits, stated plainly. Direct statistical proof is missing: our thesis rests on converging evidence — figures from interested vendors, official documentation, regulatory texts. This checklist targets organizations where citizen development has grown beyond personal use; three users on non-sensitive data do not require ten controls. Finally, governance copied wholesale from classic IT can smother a nascent program: it must be designed for these platforms, not transposed.