When AI ships the app, IT’s job is to shepherd

A line manager can open a chat, describe a workflow, and have a working prototype before lunch. A finance analyst can wire a dashboard without waiting on a ticket queue. A plant supervisor can ask for a form that “just texts the shift lead” and get something that looks like software.

That is not a future slide. That is this quarter.

The old IT model assumed scarce builders. Scarce builders meant scarce apps. Scarce apps meant IT could keep a mental map of everything that touched production data. That map is gone. AI did not remove the need for IT. It changed what “good” looks like.

At PelicanSoft we still build. We also spend more time than we used to on the other half of the job: shepherding what the business is already trying to stand up — so Monday still works when the owner is on a job site.

What changed

Speed moved to the edge. The people closest to the problem can now draft solutions. That is good. Waiting six months for a reporting tweak was never a virtue.

Adoption outruns architecture. A tool that solves a real pain gets shared in Slack on Thursday. By Friday it has a dozen users and a spreadsheet export that nobody owns. Governance that shows up after adoption isn’t control — it’s theater you pay for late.

“IT builds everything” no longer scales. If your shop’s answer to every request is “put it on the backlog,” the business will route around you with AI and a credit card. You will still own the outage when the card expires or the data leaves the building.

What shepherding actually means

Shepherding is not saying no for sport. It is keeping the flock pointed the same direction.

1. Be the system map, not the ticket wall

Someone has to know how CRM, payroll, the plant system, and the new AI-built form share a customer ID. That someone is still IT — or a partner who acts like it.

Write the map down. Keep it in the repo or the wiki. Update it when a new tool lands. If the map only lives in one person’s head, you do not have a map. You have a single point of failure with a vacation schedule.

2. Set the rails before the stampede

Identity, environments, secrets, logging, backups, and “where production data may live” are not optional polish. They are the fence posts.

• One identity provider. No shadow logins for “just this pilot.”
• Clear lanes: sandbox vs production. AI prototypes start in sandboxes with fake or scrubbed data.
• Secrets managers and rotate-on-leak habits. Models paste tokens into chats like it’s helpful.
• A short list of approved platforms for anything that will hold real customer or financial data.

You can move fast inside the rails. Outside them you are borrowing risk from next quarter.

3. Review what ships — including what the business built

Human review is not a luxury when the author is a model or a power user with a weekend.

Ask the same questions you would ask a vendor:

• What data does it touch?
• Who can see it next month when the builder changes roles?
• How do we turn it off?
• How do we restore it?
• Does it invent a second version of “revenue,” “headcount,” or “active well”?

If you cannot answer those, you do not have a tool. You have a demo with users.

4. Connect, don’t compete, with citizen development

The win is not “IT builds a better clone of what sales already likes.” The win is wiring that tool into the company’s numbers, identity, and support path — or replacing it on purpose with something that can.

Meet the adopters halfway. Offer templates, approved stacks, and a fast path to production for things that pass the review. When someone is parking payroll CSVs in a personal Drive, get involved — help them land the same job on an approved stack instead of pretending the workaround is fine. Be useful enough that routing around you feels slower, not smarter.

5. Measure what matters after the demo

AI demos look finished. Operations are not.

Shepherding includes:

• Who gets paged when it breaks?
• What is the RTO if the AI vendor hiccups?
• Are there tests, or only a happy-path recording?
• Does finance trust the output enough to close the month on it?

If nobody owns those answers, IT still owns the blast radius. Act like it early.

What this is not

It is not “ban AI.” That ban will not hold, and it trains people to hide work.

It is not “IT becomes a help desk for prompts.” Prompt help is fine. Architecture, security, integration, and truth in the numbers are the job.

It is not a reason to abandon deep engineering. Models draft. People still design systems that have to survive audits, outages, and a bad deploy on Friday afternoon. We wrote separately about repository hygiene when AI writes the code — shepherding the org and shepherding the git history are the same muscle at two altitudes.

A practical starting posture

If you are an IT lead staring at a week of shadow tools:

1. Inventory what is already in use — honestly, without a witch hunt. 2. Rank by data sensitivity and number of users. 3. Put rails under the top tier this month: identity, environment, backup, owner. 4. Publish a one-page “how to stand up a pilot here” so the next AI build starts on your path. 5. Kill or contain anything that duplicates a core metric without a single source of truth.

Do that, and AI stops being a threat to IT’s relevance. It becomes leverage — with a shepherd who still knows where the fence is.

Closing

Users will keep adopting fast. That is the point of useful tools.

IT’s role is to make sure the company still has one operating picture when they do: identities that match, data that reconciles, systems that can be reversed, and a human who can explain what changed.

Builders still matter. Shepherds matter more than they used to — because the flock got a lot bigger overnight.

---

PelicanSoft helps small and mid-size companies put AI and custom software into production without losing the operating cadence. If your shop is drowning in promising prototypes and thin governance, tell us where it hurts.