A low-code development platform lets non-developers build applications and automations with minimal hand coding. These platforms accelerate business delivery, but they also expand the number of people creating logic that can touch data, integrate systems, and trigger actions, which makes access control and governance essential.
Expanded Definition
A low-code development platform is an application-building environment that replaces much of the hand-written code with visual workflows, reusable components, and configuration-driven logic. In NHI and IAM settings, the key question is not whether code is written, but who can assemble integrations, permissions, and automations that affect data and systems.
Definitions vary across vendors, especially when platforms expand from simple app builders into orchestration, integration, and AI-assisted automation. For governance purposes, NHI Management Group treats the term as any platform that allows business users or citizen developers to create executable logic with meaningful access to APIs, secrets, or privileged workflows. That means it must be evaluated like a production delivery surface, not just a productivity tool. Controls from the NIST Cybersecurity Framework 2.0 apply when the platform is used to create business-critical automations, because change control, identity assurance, and access management all become part of the security model.
The most common misapplication is treating low-code work as harmless “shadow IT,” which occurs when teams allow users to connect production data and credentials without review, testing, or owner accountability.
Examples and Use Cases
Implementing low-code development rigorously often introduces governance overhead, requiring organisations to weigh faster delivery against tighter review of connectors, permissions, and deployment paths.
- A finance team builds an approval app that writes to a core system. The platform needs role-based publishing, environment separation, and restricted connector scopes.
- An operations analyst creates an automation that triggers ticket creation and sends notifications using API keys stored in the platform. Secret handling must follow the same discipline discussed in the Ultimate Guide to NHIs — The NHI Market.
- A customer service group uses a form builder to orchestrate record updates across CRM and ERP systems. The platform becomes an identity-bearing integration layer, not just a UI tool.
- A security team allows only approved templates and controlled deployment pipelines for citizen developers, limiting the chance that sensitive logic is hard-coded into unmanaged projects.
- An AI-assisted workflow generates actions based on business rules. Policy review is needed because the platform can amplify access decisions at machine speed, as reflected in NHI Mgmt Group research on how broadly NHIs are distributed across enterprise environments.
Where the platform is used to connect external services, practitioners should also align the operational model with the access and lifecycle expectations of the NIST Cybersecurity Framework 2.0.
Why It Matters in NHI Security
Low-code platforms often introduce NHIs indirectly through service accounts, delegated OAuth grants, webhook tokens, and embedded API keys. That matters because NHI Mgmt Group reports that 97% of NHIs carry excessive privileges and only 5.7% of organisations have full visibility into their service accounts, making low-code environments a frequent blind spot. When governance is weak, the platform can become a shortcut into production systems for users who never intended to manage credentials or access lifecycles.
The risk is not limited to accidental exposure. Low-code projects often outlive their original owners, and hidden integrations can continue to run with stale permissions long after a business process changes. That creates a persistence layer for compromise, especially when secrets are copied into workflows instead of being centrally managed. For identity-aware security programmes, low-code governance belongs alongside Ultimate Guide to NHIs — The NHI Market controls for lifecycle oversight and the broader guidance of the NIST Cybersecurity Framework 2.0.
Organisations typically encounter the full impact only after a workflow breach, unauthorized data change, or leaked credential reveals that a “simple” app had become an unmanaged production dependency.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Low-code platforms often store or invoke secrets through user-built automations. |
| NIST CSF 2.0 | PR.AA | Identity and access governance apply when citizen-built logic reaches production data. |
| NIST Zero Trust (SP 800-207) | SC-7 | Low-code integrations should be treated as controlled trust boundaries, not implicit trust. |
| NIST SP 800-63 | AAL2 | Admin and publisher access to low-code tools needs strong authenticator assurance. |
| OWASP Agentic AI Top 10 | Low-code and agentic workflows share risks around unreviewed tool execution and delegated action. |
Require phishing-resistant or equivalent strong authentication for platform administrators and approvers.
Related resources from NHI Mgmt Group
- Why do AI features in low-code and no-code platforms change the risk profile for application development?
- What do organisations get wrong when they assume low-code and AI automatically make development safer?
- What is the difference between AI-assisted low-code development and traditional low-code development from a security perspective?
- Why do AI code assistants create more risk than ordinary development plugins?
