In May 2023, Samsung banned generative AI on company devices after engineers pasted proprietary source code into ChatGPT (Bloomberg). JPMorgan, Bank of America, and Citigroup had restricted access months earlier. Each decision was defensible on its own terms. Sensitive data was leaving the building through a chat window, and the lever available to security teams on short notice was the off switch.
A year later, Microsoft and LinkedIn’s 2024 Work Trend Index found that 75% of knowledge workers were using generative AI at work, and 78% of those users were bringing their own tools rather than anything provided by their company. The industry even coined an acronym for it, BYOAI (Bring your own AI).
A hundred-person engineering org in 2026 typically runs coding agents like Cursor or Claude Code on personal licenses, unofficial MCP servers (the connectors that give AI agents access to tools and data) installed from GitHub, and at least one internal bot built on a service account that no one in security has ever heard of. Bans haven’t reduced AI use in the workplace, they’ve simply moved it to personal accounts, and personal devices. Companies haven’t slowed down AI, they’ve just traded away visibility for no gain.
Unlike the shadow IT of a decade ago, with shadow AI, there’s almost nothing to detect. A Dropbox account has an installer and a monthly charge; an MCP server is a few lines of JSON in someone’s home directory, and the traffic it produces looks like ordinary API calls. The stakes are higher too, because agents can take actions at a speed and scale that an individual employee cannot: opening pull requests, querying databases, running shell commands.
It’s tempting to read all this as a security failure, and most of the writing on shadow AI does. At Speakeasy, we think that’s the wrong diagnosis. Security is the last line of defense, when something becomes a security issue it’s usually because of upstream failures that have been festering for months. In the case of Shadow AI, employees aren’t trying to surreptitiously use AI for nefarious purposes, it's usually just that the company hasn’t built an enablement program that makes it easy to use AI in a sanctioned, effective manner.
Governance and Enablement Are Two Sides of the Same Coin
Companies don’t say no to AI because they don’t want their employees to use the latest tools. Many of them operate under legally binding reporting and record-keeping requirements that make it very hard to say yes. Financial companies need to retain and produce their business communications, hospitals have to account for who accessed patient records and why, European enterprises have to document how personal data is processed. It’s no accident that early AI bans: JPMorgan, Bank of America, Citigroup, are heavily regulated financial firms.
Absent a governance program, approving an AI tool today means trusting every employee with access to use it well, with no way to watch, meter, or revoke, and no records to hand regulators. For a regulated firm, that’s frankly a terrible idea. The way out is a governance layer: one that sits between every AI agent in the company and every system those agents are allowed to
reach, carrying identity, policy, observability, and audit in a single place. The industry has started calling this an AI control plane.
When people hear “governance”, I think they picture someone wearing a suit sternly saying no, but as already discussed, we know that saying no doesn’t work. Governance has to be delivered through a golden path: a sanctioned route that is also the easiest route, where the approved agent comes pre-configured, pre-connected, and better than the personal-account alternative. This is what marked every successful platform engineering effort of the last decade. Devops and platform engineering teams that were effective, dedicated just as much time towards creating a system that helped engineers as they did towards building controls.
What does this look like in practice? We think most successful governance programs share a few common properties.
They’re accessible. None of the controls matter if the sanctioned path is empty. Employees turn to shadow AI to get primitives they can’t get through official channels, so the governance layer has to double as a distribution channel: company licenses for the popular tools people actually want to use, and a registry of approved MCP servers and skills, scoped by team, that anyone can adopt without filing a ticket. An engineer who needs a database connector should be able to find an approved one in the registry faster than they could install a random one from GitHub. Stock the shelves and most of the reason to go around the program disappears.
They’re governed. Every agent in the company should be attributable to an employee, so that when a prompt or tool call runs, it runs as someone. Attribution solves the hardest question in agent security, which is what an agent should be allowed to do. The employee’s existing permissions become the starting point: an agent can never do anything its owner couldn’t do themselves, and from that ceiling access gets trimmed further to what the task actually needs, so an agent triaging support tickets doesn’t inherit its owner’s ability to delete customer records. Attribution also makes incidents queryable. Instead of forensic guesswork across fifty personal accounts, an investigation becomes: which sessions touched this customer record, which agent called this API, who approved that connector. Attribution is sometimes heard as surveillance, but it’s better understood as the precondition for permission. Organizations that can answer those questions can afford to grant broad access. Organizations that can’t are stuck choosing between blanket bans and blind trust, and both lose.
They’re secure. When the sanctioned path is the one people actually use, most of the security problems dissolve on their own: credentials stop living in dotfiles because the approved connector never needed them pasted anywhere, traffic stops being invisible because it all flows through one place, and the fifty personal accounts that made incident response impossible simply stop existing. Agents are still dangerous, they can still act at machine speed, but that risk can be handled architecturally: the agent’s reach can be bounded by scoped permissions before it runs. The strongest control is safe defaults, a paved road that is secure by construction.
They’re sustainable. Whatever policy you write this quarter is aimed at this quarter’s tools. A new model ships, a new agent framework catches on, a new protocol wins, and the static
approach starts over: re-litigate, re-ban, re-document. A governance layer absorbs that churn instead, because new tools plug into the same identity, the same policies, and the same audit trail that governed the old ones. Sustainability also means respecting a rule that security teams learn the hard way: controls have to fail open. If the governance layer goes down and takes every AI tool in the company with it, it gets ripped out within the month. The layer can’t be the thing employees route around; then you’ve just built a more expensive version of the ban.
What a Real Enablement Program Ships
Concretely, the paved road for AI looks like a short list of defaults rather than a long list of rules. New laptops arrive with approved AI agents already configured, wired to company identity, with observability on from the first session. Model access through the sanctioned path is at least as
good as what a personal account offers, because if it isn’t, the personal account wins and you’re back where you started.
And there’s an amnesty. Somewhere in your org right now is a team running an agent you don’t know about. We have yet to look inside an organization where that wasn’t true, and the unregistered agent is usually doing something genuinely useful. A restriction-first posture guarantees you never hear about it. An enablement posture invites them to bring it onto the paved road, keep what works, and inherit identity and audit for free. Either way, you learn about that agent eventually. The amnesty just means you learn about it now instead of during an incident.
The companies getting this right aren’t the ones with the strictest AI controls, and they aren’t the ones that gave up on controls entirely. They’re the ones where the official way is the easy way, so the shadow versions quietly stopped being worth the trouble. Shadow AI shrinks when working in the light is faster, and no ban has ever managed that.
