Make on shadow AI: govern what each AI automation is allowed to decide, not only which tools are approved
Sebastian Mertens, Principal AI Product Manager at Make, writes that the bigger shadow AI risk is not only employees using unapproved tools but automation that gradually gains authority over business processes without anyone approving it. His example: an assistant that summarizes customer requests gets connected to the knowledge base, starts drafting replies, sends them on its own and ends up updating customer records. He argues that an approved model connected to an approved database can still produce an unapproved decision through MCP or an API. Instead of banning experiments, he recommends setting the AI's access and authority per process according to risk, triggering a review when the model is swapped, a tool is added or data access changes, assigning a business owner and a maintenance owner with a way to pause the process, and keeping factual logs of what data the AI accessed, what action it executed and what approval authorized it.
Otomatzia editorial · Published
Source published: · Make
