Five must-haves for governing AI-built apps

Someone on your team built a useful app in Claude Code last month. It runs on a laptop or a personal cloud account, with an API key pasted into the code, and nobody in IT knows it exists. Could you list every app like that in your company?

The organizations getting this right don’t write a longer policy. They build the controls into the systems their teams ship on, so governance happens whether or not anyone remembers it. In this session, Paul Turner lays out the five controls every AI-built app needs and what each one looks like in practice. Then Luke Smith takes an app his team built and puts it in production, with all five attached.

What you’ll learn

• Inventory. How to get every app on one list with a named owner, without a review board slowing anyone down.
• Identity. Why every request should run as the person who made it, never as a shared service account.
• Credentials. How to keep secrets out of the code, where neither the builder nor the model ever sees them.
• Scoped access. How to limit each app to the systems it needs, so a compromised app reaches very little.
• A record. What ran, as whom, against which system, and what it cost: the evidence your auditor, insurer and AI council will ask for.
• The two problems nobody has solved yet, and how the five controls limit the damage in the meantime.

You’ll also get a one-page scorecard to rate your own program on each control, and leave knowing which one to fix first.

Who should attend

• CIOs, CISOs and IT leaders who own, or should own, the apps their teams build with AI
• Security and risk teams who review those apps one at a time today
• Platform and enterprise architecture teams deciding where AI-built apps should run
• AI councils and governance offices who need evidence, not policy documents