The new bottleneck shows up later
AI tools handle the building, and increasingly the maintenance too. The old "nobody can maintain this after the author leaves" argument is weaker today than it used to be, and we'd be lying if we pretended otherwise.
The cost has moved to a different place. Once a tool ships, you still have to host it, monitor it, patch it, govern its permissions, rotate its credentials, and deprovision its access when people move on. That's where portfolios of AI-generated apps quietly fall apart.
A single AI-built tool is usually fine. Trouble shows up as the portfolio grows. Each new tool brings its own hosting setup, its own deployment pipeline, its own copy of role-based permissions, its own dependency tree. When a database connection string changes, you change it everywhere it was declared. When a security advisory drops, you patch every codebase that pulled in the affected library, each one shaped by whoever was prompting that day. When someone changes teams, their access rules need to be updated in every tool they ever touched.
This is the same governance work engineering teams have always done. The difference is the volume. What used to be a handful of core internal apps becomes a portfolio that grows whenever someone has a spare afternoon, because creation got cheap and nothing else did. Code review, security checks, and deployment gates were all built for human pace. They don't scale to AI pace.
Where a governed platform fits
The fix is to move the operational concerns underneath the apps. One shared hosting setup carrying every app. Permissions defined against the data and the resources, where they belong. Patching at the platform level, so a single security update covers your whole portfolio. Environment management that applies across the portfolio in one place.
With that layer in place, anyone can build, and what they build inherits the guardrails by default. New tools become cheap to create and cheap to maintain, which is the hard part. Platforms like Retool work this way: the governance sits underneath the apps, so what your builders generate is safe to run in production.
Borrowed time
AI-generated internal tools aren't a bad idea. They're a good idea with an unpaid bill. Every fast build borrows time from your future self, with interest. The interest is paid every time a credential rotates, a library publishes a CVE, or a team changes shape.
Internal tools need to be functional and maintainable. Getting this right means building somewhere that keeps working after the build is done.
