How to manage a staff member wanting to implement multiple Claude written applications?

[AB_IT]

Hey All,

 

Long time no speak but I've got a bit of a dilemma and it's currently keeping me up at night.

 

We have a member of staff here who has spoken with their son who is a developer and has advised her that she can utilise Claude to code applications from scratch, host this application on our SharePoint and use it in production.

 

I'm no developer however I know a small amount of fundamentals to get me by. The issue is the first app that's been created Claude wants us to register it as an app in Entra so that it can use our Office 365 logins as authentication to who can access the application. This member of staff to my knowledge has no past experience in development and so I raised concerns mainly around security and integrity of the app as though it's been developed, I'm uncomfortable giving it access to services without knowing if the app is secure, an example off the top of my head is Claude could potentially hallucinate or similar due to the long conversations and prompts and as a result mess up the code sending data to who knows where or what it's doing with it so I wanted to get it checked by a developer which we're in the process of doing. It also needs a Database which it wants to use Power Automate and SharePoint lists to log the data. It's basically a HTML form which is filled out by members of staff and then that information is sent to a dashboard. It uses .json files and HTML files hosted on SharePoint.

 

That first app is still undergoing checks and is yet to be put in production, I've had to get an external IT support company to check it over and help support their implementation of the app, however this weekend I recently received another email saying this same member of staff has created another application. It wants similar; where an app registration in Entra would need to be created and then it would utilise our O365 logins in order to allow certain staff members to authorise a request for certain kit and then also recording an invoice.

 

This seems like real serious stuff and the member of staff is speaking about having an audit trail. The additional problem I seem to have is that the CEO is working alongside this member of staff and wants these things to go into production. I just feel quite uncomfortable around the fact the software developed by Claude has no support attached to it, requires permissions from our current systems and users, I don't have the expertise or questioning ability in order to support these applications if something goes wrong or to ensure Claude is doing the right thing and is doing what it says. 

 

It all just seems a bit hard to navigate and is worrying me as more and more of these apps are being developed. I don't want to be the IT Manager who just says no for the sake of it or pushes back, I want to enable users to use this new technology but I'm concerned about quite a lot here.

 

The external IT support company said they are getting requests from other companies with the same kind of thing and where positive about it, so I presume it's more common than I think? What are your guys suggestions, should I be more open and happy to approve these apps or am I right in pushing back a bit here? Also what are you guys doing in this scenario?

 

Any help would be most appreciated, thanks all

[Rob_D]

I think you're right to be cautious, but if it's hosted on your SharePoint and the code analysis you're getting doesn't show any signs of it sending data externally, then I don't see a problem with trying it, although I'd definitely be making the staff member who made it be the one to support it and fix it when it inevitably breaks.

 

If you didn't want to or couldn't use it for whatever reason, then maybe you could redirect that staff member's efforts into power automate. As you've described it, the first app doesn't sound it like it does anything that couldn't be done with forms and automate. 

[Norphy]

I think the phrase "Stay in your lane" applies here. I would expect that person would be a bit annoyed if a dev started taking over her job. The same applies here, especially if she doesn't know what the code is actually doing.

 

We use Claude in my company. I particularly use it to help me with coding PowerShell scripts in regards to Intune and MECM stuff. However, I wouldn't dream of using it to create a SharePoint app because that's not my area of responsibility.

 

Claude Code is great, but in my opinion you should still have at least a basic knowledge of the language you're coding in before you start pushing stuff into production, especially if it's asking for permissions like that.

[sigma]

I wouldn't accept anything like this into "production" without:

 

a) Adequate documentation.

b) Some definition of accountability around the app and its data governance.

c) Some GDPR sign off (if appropriate).

d) Evidence it has been "properly tested".

 

I hope somebody costed this/had a budget before they started. 

 

[2ilent8cho]

We have many apps written with Claude now used in production (mostly mine) from Pupil Passports to full blown SMS/Whatsapp messaging systems, video walls, on-call/behaviour/remove management with CCTV integration  it's amazing, but they were all made by IT, we have it documented, we know how it interacts , we know what it does and what it has access to as we made it. We also have the code should we need to make changes. So its more who will maintain these apps and over see them?

 

We had 1 member the SEN staff try to do the same, i pushed back and said we would build what they wanted as what they made worked, but it was a HTML web app and they said can you make this accessible to everyone. They had no concept of the server side for storing the data and authentication/ security and that would be my worry in letting people just make apps.  So I re-made it as a native macOS app, SQL back and with Office 365 authentication and reverse proxy'd it through cloud flare for external access.

[dhicks]

14 hours ago, AB_IT said:

Also what are you guys doing in this scenario?

 

We don't use Sharepoint, so this might not be directly relevant to your setup, but I use an authenticating reverse proxy (Pangolin, also Cloudflare Tunnel) that passes the authenticated username through to the application as a simple HTTP header, saving the developer from having to (re)implement OAuth. The Sharepoint setup you describe sounds rather like it might be Microsoft's implementation of a similar process, it does sound reasonable enough. A trick / tip for agentic code development would seem to be to have a clearly-specified AGENTS.md file that gets fed to the model you are using, and to pick a model with what I think people are now calling good "prompt adherence". I've recently tried out OpenCode's "Big Pickle" model (which is, I think, GLM-5.2) which seems to work very well in that aspect.

[psydii]

Quote

I actually caught someone recreating the role/resource group concept  in SharePoint the other day. They'd used Claude to solve a collaboration issue, and Claude basically had them re-implement resource groups inside a SharePoint site they managed. I only found out when I declined a request to allow Claude access to our 365 tenant, and as I did so the user appeared at my door and said "Claude told me you'd say no. Don't worry about it, we used PowerShell to get it done, its pretty cool, but could you just help troubleshoot the last bit?"

Reader, the user was the Head Teacher's PA.

 

[sigma]

21 hours ago, psydii said:

Reader, the user was the Head Teacher's PA.

 

 

"Shadow IT" is well and truly in ascendance again!

[dmj]

We are struggling with the same issues, and have a number of these applications deployed (through Google Cloudrun).

 

The fundamental problem is that people without development experience vastly underestimate how time consuming it is to maintain their applications. At the start the applications start as a 'nice to have' and that the owner will look after. Slowly they become business critical, and parts of the business genuinely cannot function without them.

 

At this point you need to add in SLO's and metrics to make sure the app is behaving and has a good uptime - but the 'developer' didn't understand this requirement.

 

Then a library that the application is using has a critical vulnerability, but the 'developer' didn't add any build pipelines so there's no way of knowing, because the school doesn't have the infrastructure in place to manage automated builds and scanning. 

 

Once the library has been updated, the application starts behaving weirdly, or stops working entirely- the schools didn't have any regression testing in place and the 'developer' didn't think to add it or maintain it. 

 

Then the 'developer' leaves and the rest of the IT department are lost. 

 

IMO don't block this - instead insist on:

1) using a git repository

2) Docker builds

3) automated builds with a) linting b) container scanning

4) automated deployments

5) dependabot/renovatebot to automate code updates

6) unit testing

7) regression testing before deployment

 

Once the PA has figured all this out, deploy the application then ask why s/he's not earning £80k as a devops engineer. 

[psydii]

She's come a long way. Ten years ago she was still using  pen and paper, and her monitor was just a stand. (actual photo, but cropped/ai gen-filled to remove PII)

 

[dhicks]

2 hours ago, dmj said:

We are struggling with the same issues, and have a number of these applications deployed (through Google Cloudrun).

 

We do seem to be heading quite nicely to a situation where the people who understand the business process part of things (secretaries, PAs, etc) now have a suitable tool (AI coding agents) to allow them to create solutions that fit their problems, we (the IT support end of things) need to figure out how to support and manage that process and, as you point out, try and maintain security, usability, maintainability, etc. Also, to keep a careful eye on the AI credit spend. Some of the cheaper models now available are a couple of orders of magnitude cheaper than the top-performance ones, and for the kind of things I'm guessing our staff (and pupils!) will be doing I suspect the cheaper models might be the better option.

 

Has anyone tried their own on-site AI server yet? I keep seeing various projects to cram versions of the latest models onto the kinds of machines we might be able to afford to run locally, has anyone tried using one of these with a coding agent yet?

[dmj]

5 minutes ago, dhicks said:

 

We do seem to be heading quite nicely to a situation where the people who understand the business process part of things (secretaries, PAs, etc) now have a suitable tool (AI coding agents) to allow them to create solutions that fit their problems, we (the IT support end of things) need to figure out how to support and manage that process and, as you point out, try and maintain security, usability, maintainability, etc. Also, to keep a careful eye on the AI credit spend. Some of the cheaper models now available are a couple of orders of magnitude cheaper than the top-performance ones, and for the kind of things I'm guessing our staff (and pupils!) will be doing I suspect the cheaper models might be the better option.

 

A good analogy is spreadsheets. In the olden days departments would build their own dashboards, perhaps with a Javascript/VBScript. The spreadsheet application, along with the IT team,  would take care of all the deployment/security etc. So IMO its as much a question about how to handle the ops side of it (the apps that serve / deploy the AI apps) as it is the apps themselves. 

[dhicks]

39 minutes ago, dmj said:

A good analogy is spreadsheets.

 

Good point. And, as with spreadsheets, it's great that end users have the tools to handle their data how they want, but it would be good to have some kind of (auditable) controls on access, correctness, etc. Also, I tend to find the issue with spreadsheets is that they're a bit too easy for people to create a new one, so you wind up with data duplicated in multiple places.

[Chris_Cook]

Theres some great ideas above. I think having a checklist, risk assessment and/or policy is key going forward. All our software and systems need to be built and tested by competent persons (someone with training, skills and experience). We need to ensure we have taken all reasonable steps to ensure safety of end users from data release and system compromise. We should be aiming for best practice, rather than good enough, and also testing/verifying rather than just assuming or thinking that all hackers are limited by our knowledge or levels of patience/available time.

 

You wouldn't let someone untrained fix the plumbing, electrics or gas boilers using AI. I'd argue they are all much simpler that coding an app, especially if its not using a no-code solution. At the end of the day, its not AI who's going to get sued, or have to defend themselves to lawyers, judges and the press.

 

You should have the backing of the head, the governors and the schools insurers. You should probably also consult lawyers and cyber security/GDPR experts for advice.

 

We should also make sure as schools that we aren't re-inventing the wheel and wasting tax payers money when pre-built solutions exist. Obviously bespoke software can be amazing when customised to the organisations needs, but the cost of ensuring the above best practice probably outweighs the cost of buying something in.

[dhicks]

14 minutes ago, Chris_Cook said:

Obviously bespoke software can be amazing when customised to the organisations needs, but the cost of ensuring the above best practice probably outweighs the cost of buying something in.

 

I'm starting to lean slightly towards the opposite view - the education sector (probably similar to other specialised sectors) has some poor software options, some of which it should be quite easy to re-implement quite rapidly with a coding agent. That's still probably a job for a small team rather than individuals in schools, just to keep continuity of development and keep projects / products maintained. A separate company, maybe, or for the larger company / school authority a team of in-house developers.

[dmj]

17 hours ago, dhicks said:

 

I'm starting to lean slightly towards the opposite view - the education sector (probably similar to other specialised sectors) has some poor software options, some of which it should be quite easy to re-implement quite rapidly with a coding agent. 

 

It could cut either way I think: Teachers rapidly creating applications and selling them on the open market without any real understanding of software development will end up with the same poor quality no matter how good the agent is if the infra, QA, secops etc isn't behind it. I dread a vibe coded SIMS replacement.

Or more optimistically: some high quality OSS projects that leverage people who do have those experiences and governance to produce something good for schools to use. Supported by companies that spring up around that software. Sadly I expect the former. 

 

[Norphy]

I mean, that’s not a million miles from how SIMS came to life. It was originally written by a teacher in a school in Luton to produce school reports then got built on and built on. Bedfordshire County Council then formed a commercial company to develop it further and sell it to other schools.