Business-led low-code agent governance

Research Question

Under what conditions does business-led low-code Artificial Intelligence (AI) agent creation produce durable organisational value versus technical debt and governance fragmentation, and what foundational capabilities must exist before business-led agent creation is safe to scale in a regulated environment?

Findings

(Populated from section 6 Synthesis above.)

Executive Summary

• Business-led low-code agent creation produces durable value only when it is layered on top of a centrally governed platform with risk-based intake, enforceable data and channel controls, environment separation, shared lifecycle ownership, and suitable low-risk use-case selection; without that foundation it predictably produces local wins alongside enterprise fragmentation.
• The RPA citizen-development analogue shows that decentralised automation works when governance is defined first and fails when repository discipline, role clarity, review, and production promotion are left to local teams.
• DORA strengthens that conclusion by showing that AI amplifies the quality of the surrounding platform and workflow system and that internal platforms are now the main scaling mechanism for enterprise AI value.
• In a regulated environment, the minimum safe foundation is a central governance function, a NIST-style risk-classification intake, controlled environments, enforceable data policies, and central oversight for higher-risk or cross-boundary agents.

Key Findings

1. High confidence: Business-led low-code agent creation creates durable value only when citizen builders operate inside a defined governance model and are limited to process-suitable, bounded tasks with central repositories, review paths, support structures, and separate promotion environments rather than publishing directly from local teams.
2. Medium confidence: DORA's 2025 evidence shows that AI amplifies existing organisational conditions, so platform quality, workflow clarity, safety nets, and dedicated platform ownership are prerequisites for scaled value rather than optional improvements after rollout.
3. Medium confidence: NIST Map requires organisations to document intended purpose, users, laws and norms, business value, risk tolerance, knowledge limits, human oversight, third-party dependencies, and likely impacts before they can make a credible go or no-go decision on an AI use case.
4. Medium confidence: Microsoft's own at-scale model for Power Platform and Copilot Studio is a Centre of Excellence with managed environments, analytics, and admin controls, which means Microsoft prescribes central governance capability before broad maker enablement.
5. Medium confidence: Copilot Studio can centrally restrict authentication modes, knowledge sources, connectors, publication channels, Hypertext Transfer Protocol (HTTP) access, skills, and triggers, and Power Platform policies can suspend or quarantine violating assets at runtime as well as design time.
6. High confidence: Safe business-led agent programs should initially permit only bounded, low-risk, process-suitable use cases with authenticated users, approved knowledge domains, approved connectors, and explicit human escalation, while routing higher-risk, external-action, or cross-boundary agents into central review.
7. High confidence: Fragmentation emerges when local makers can create or publish agents without ownership clarity, environment strategy, suitable process selection, or connector and channel guardrails, because the resulting estate becomes hard to review, support, and stabilise.
8. High confidence: The minimum viable foundation before scaling is a central governance team, a risk-based intake workflow, controlled environments, enforceable data and channel policies, auditability, maker training, and a professional team that owns exceptions and lifecycle governance.

Assumptions

• Assumption: The organisational lessons from RPA citizen development transfer materially to low-code AI agents. Justification: Both patterns decentralise automation authoring to business users while relying on central platform controls for safe promotion and support.

Analysis

• The strongest evidence suggests that scaled AI value depends on platform quality, explicit governance, and documented use-case context.
• The RPA analogue adds operating-model texture rather than direct proof, but it is persuasive because its recurring prescriptions, central repositories, environment separation, role clarity, and support, match the exact controls Microsoft now exposes for low-code agents.
• Governance is therefore necessary but not sufficient: durable value also depends on selecting process-suitable use cases and keeping autonomy within the bounds that the platform and operating model can actually support.

Risks, Gaps, and Uncertainties

• Several seeded analyst sources were inaccessible, so this item relies on public standards, public-sector guidance, vendor documentation, and accessible peer-reviewed literature instead of analyst synthesis.
• The seeded IEEE search did not yield an accessible pinpoint paper in this runtime, so the academic RPA evidence base is narrower than ideal.
• The analogue from RPA to generative agents is strong on governance shape but weaker on model-specific failure modes such as hallucination, which would need a follow-on item if the question shifted toward model assurance rather than operating-model design.

Open Questions

• What concrete risk tiers should a regulated enterprise use to separate low-risk business-led agents from centrally engineered medium-risk and high-risk agents?
• Which specific telemetry, approval, and recertification controls produce the best ongoing assurance for agents that remain business-owned after first publication?
• How should platform-team capacity be sized so that escalation paths for higher-risk agents do not become the next delivery bottleneck?

sources

Starting points - papers, articles, videos, repos, docs.

• [x] DORA 2025 report overview — - primary overview of the AI-as-amplifier finding and platform-quality prerequisite.
• [x] DORA AI capabilities model report landing page — - seven foundational capabilities, 90% platform adoption, and 76% dedicated platform teams.
• [x] Faros AI: Engineering Excellence Under AI Acceleration (2026) — - returned 404 in this environment and was not used for downstream claims.
• [x] National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF) 1.0 — - primary framework source for govern-map-measure-manage structure.
• [x] NIST AI RMF overview — - current NIST landing page linking the framework and playbook.
• [x] NIST AI RMF Playbook — - replacement for the seeded airc.nist.gov/Docs/2 URL, which returned 404 in this environment.
• [x] NIST AI RMF Playbook landing page — - confirms the playbook is voluntary, contextual, and organised by Govern, Map, Measure, and Manage.
• [x] NIST AI RMF Core — - authoritative Map subcategories for context establishment, categorisation, and impact documentation.
• [x] NIST AI RMF Playbook Map page — - practitioner references aligned to Map activities.
• [x] Microsoft Power Platform Centre of Excellence (CoE) Starter Kit overview — - Microsoft's reference implementation for governance, monitoring, and adoption.
• [x] Microsoft Copilot Studio security and governance — - current replacement for the seeded admin-overview URL, which returned 404 in this environment.
• [x] Microsoft Copilot Studio data loss prevention — - concrete controls over authentication, knowledge sources, channels, skills, triggers, and endpoints.
• [x] Power Platform data policies — - design-time and runtime enforcement model for connectors and chatbots.
• [x] Power Platform Managed Environments — - Microsoft's at-scale environment management capability.
• [x] Digital.gov: 5 tips for implementing citizen development in your RPA program — - government guidance on governance, repositories, separate environments, and leadership support.
• [x] A framework for implementing robotic process automation projects — - peer-reviewed synthesis on RPA implementation failure and the need for structured, socio-technical governance.
• [x] UiPath: Successful citizen developer programs — - vendor evidence that scaled programs define the governance model first and provide support structures.
• [x] Deloitte intelligent automation survey results (2022) — - definition and adoption signal for citizen-led development in low-code automation.
• [x] Gartner citizen developer glossary — - returned 403 in this environment and was not used for downstream claims.
• [x] Forrester RPA research hub — - returned 404 in this environment and was not used for downstream claims.
• [x] IEEE Xplore seed search — - checked via search query site:ieeexplore.ieee.org "RPA" "citizen development" governance; no accessible pinpoint paper from the seeded search was used, so the RPA evidence base relies on the accessible Springer, Digital.gov, UiPath, and Deloitte sources above.