AI is reshaping IT jobs around code-first workflows

At a glance

What this is: This is Fleet's analysis of how AI is changing IT work, with the key finding that experience and code-first workflows now determine who benefits most.

Why it matters: It matters because identity, device, and infrastructure teams are being pushed toward auditable, structured operations that AI can accelerate, while manual console-driven work falls behind.

By the numbers:

• Workers aged 22 to 25 in AI-exposed roles saw a 13% relative employment decline since late 2022.
• PwC's 2025 Global AI Jobs Barometer found a 56% wage premium for roles requiring AI skills.
• A Stanford study found software developer employment in the 22 to 25 cohort fell nearly 20% from its 2022 peak.
• Fleet says it is trusted by over 1,300 organizations.

Context

AI is changing the operating model for IT and platform work, not just the headcount mix. The underlying governance gap is that many teams still depend on manual, GUI-driven workflows that are hard for AI to assist, hard to review, and hard to reproduce consistently. In identity and device operations, that creates a divide between legible systems that can be governed as code and opaque processes that cannot.

The article's core claim is that AI rewards structure, context, and judgment. That has direct implications for IAM, endpoint governance, and NHI-adjacent operational controls because the same pattern applies wherever configuration, access, and policy decisions need to be inspected, versioned, and repeated. Teams that cannot express their controls as code will find AI assistance uneven at best and governance weaker at scale.

The article also shows that the issue is not simply AI replacing people. It is redistributing leverage toward roles and teams that already have strong systems knowledge, which makes the governance quality of the underlying environment more important than the novelty of the tool.

Key questions

Q: How should teams use AI safely in code-first IT workflows?

A: Use AI for drafting, querying, and repetitive configuration work, but require version-controlled review before anything reaches production. The safe pattern is declarative input, human validation of intent, and automated enforcement of policy. That keeps AI useful without letting it bypass the controls that make the environment auditable and reversible.

Q: Why do code-first environments benefit more from AI than GUI-based ones?

A: AI needs structure it can read and reproduce. Code-first environments provide schemas, diffs, and durable state, while GUI workflows hide intent behind clicks and manual translation. That means AI can accelerate one operating model, but only partially assist the other, which widens the governance and productivity gap.

Q: What breaks when operational policy is managed through ClickOps?

A: ClickOps makes control changes harder to review, harder to repeat, and harder to audit. It also removes the machine-readable context that AI tools need to help safely. The result is a workflow that scales human effort instead of scaling governance.

Q: Should organisations re-skill IT teams for AI-assisted operations now?

A: Yes, because the article shows that experience and judgment are becoming more valuable while routine execution is easier to automate. Teams should re-skill toward policy design, exception handling, and reviewable automation rather than only toward faster execution of manual tasks.

Technical breakdown

Why code-first configuration is easier for AI to operate on

AI tools work best when they can infer structure from consistent inputs. A GitOps repository gives the model a stable schema, repeatable patterns, and a safe place to land output such as policy changes, device scope updates, or compliance checks. A GUI workflow hides that structure behind clicks, so the model has less context and no durable artifact to edit. The difference is not just convenience. It changes whether AI can reliably assist with configuration, review, and change control.

Practical implication: move high-volume operational policies into version-controlled configuration so AI assistance is reviewable and reproducible.

Why AI widens the gap between syntax and judgment

The article makes a useful distinction between generating technically correct output and producing operationally correct output. AI is strong at syntax, boilerplate, and pattern matching, but weak at organizational context, local risk tolerance, and exception handling. That means the human skill that retains value is not just tool use, but judgment about what matters in a specific environment. In IAM and device governance, that judgment determines whether automation enforces policy or simply accelerates the wrong one.

Practical implication: pair AI-generated changes with human review focused on policy fit, risk tolerance, and exception handling.

Why manual console workflows create a governance bottleneck

ClickOps slows AI down because there is no machine-readable representation of the intended state. Without declarative policy, AI cannot easily inspect drift, propose safe changes, or validate outcomes against control objectives. The result is a governance bottleneck where people must translate intent into clicks and then translate the result back into evidence. That friction matters in device management, IAM administration, and any environment where auditability depends on repeatable state.

Practical implication: reduce reliance on console-only operations for controls that need audit trails, repeatability, or automated review.

NHI Mgmt Group analysis

AI is exposing the governance value of structured operations, not eliminating it. The article shows that code-first environments gain disproportionate leverage because they are already legible to machines, while GUI-led environments remain dependent on human translation. That is a governance story as much as a productivity story, because AI can only accelerate what the operating model already makes inspectable. The practitioner conclusion is clear: structure is now a control surface, not just an engineering preference.

The real dividing line is judgment, not role title. The evidence in the article points to experience as the differentiator, with accumulated context and risk awareness separating AI collaborators from AI substitutes. That matters for IAM and device governance because policy administration without judgment becomes brittle when automation scales. The practitioner conclusion is to treat contextual decision-making as a privileged capability in its own right.

Code-first workflows are becoming a prerequisite for controllable AI assistance. If a change cannot be expressed cleanly in configuration, policy, or version control, AI will struggle to help without increasing operational risk. That creates a named concept worth tracking: AI governance surface area, meaning the part of the environment that AI can safely inspect, modify, and verify. The practitioner conclusion is to reduce reliance on opaque workflows wherever changes must remain auditable.

Productivity gains will continue to accrue unevenly unless governance keeps pace. The article frames a distributional shift where organizations capture the upside while individuals absorb the transition cost. In identity and endpoint operations, that means teams with repeatable controls, clear evidence paths, and reviewable automation will move faster than teams still depending on console memory. The practitioner conclusion is to align operating model redesign with workforce change, not treat them as separate projects.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs

What this signals

AI governance surface area: the more of an operating model that can be expressed as code, the more safely AI can assist with it. That is becoming a practical differentiator for identity, device, and infrastructure teams because machine-readable controls are easier to review, test, and evidence than console-only work.

Fleet's analysis suggests the next programme question is not whether to use AI, but which operational surfaces are ready for it. Organisations with strong declarative policy and version control will absorb AI faster, while teams still relying on manual administration will see less benefit and more control drift. Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.

For practitioners

• Adopt declarative policy for repeatable controls Express device, access, and compliance changes in version-controlled configuration so they can be reviewed, tested, and reused instead of recreated in a GUI.
• Design AI-assisted workflows around reviewable artifacts Use pull requests, diffs, and policy checks as the approval path for AI-generated changes so humans validate intent before execution.
• Separate syntax work from judgment work Let AI handle boilerplate, query generation, and routine policy drafting, but keep risk acceptance, exception handling, and control scoping with experienced operators.
• Reduce GUI-only control paths Identify high-frequency operational tasks that still require manual console work and move them into code-first workflows where automation can safely assist.

Key takeaways

• AI is amplifying the value of structured, reviewable operations rather than replacing the need for governance.
• The main divide is between teams that can express controls as code and teams that still depend on manual console work.
• Experience and judgment remain the differentiators that determine whether AI becomes a collaborator or a substitute.

Key terms

• Code-First Workflow: An operational model where configuration, policy, and change control are expressed in code or declarative files rather than manual console actions. This creates a machine-readable record that supports review, automation, rollback, and more consistent governance across teams.
• Declarative Policy: A declarative policy states the conditions under which access is allowed instead of embedding decision logic inside each application path. It keeps authorization rules in one place, which makes them easier to audit, test, and change without creating hidden differences between endpoints.
• Operational Judgement: Operational judgement is the ability to distinguish a plausible answer from the right answer when the environment is incomplete, unusual, or failing. In support teams, it is what prevents automation from overriding context, evidence, and escalation discipline.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle fundamentals. It is designed for practitioners who need to connect identity control design to broader operational security.