Citizen development is the practice of allowing non-traditional developers to build applications, automations, or workflows using accessible tools. It can improve speed and productivity, but it also introduces governance, access, and data protection risks unless security teams define clear boundaries and review points.
Expanded Definition
Citizen development is not simply “low-code for everyone.” It is a delivery model where business users outside traditional software teams create apps, automations, and workflow logic with platform tools that intentionally reduce coding complexity. The term usually covers forms, approvals, data routing, integrations, and lightweight business logic, but it does not mean unrestricted production development.
The security boundary matters. A citizen-built solution may be perfectly valid for departmental work while still being unsuitable for sensitive data, regulated processes, or high-availability services. The distinction is often misunderstood: the issue is not whether the builder is technical enough, but whether the platform, the data, and the control model are governed well enough for the intended use. Guidance versus consensus is still uneven across organisations, especially on where business ownership ends and central security or engineering oversight begins.
Examples and Use Cases
Citizen development appears in everyday operational workflows where speed matters more than bespoke engineering:
- A finance team builds an approval workflow to route purchase requests through budget owners.
- HR creates a self-service intake form that updates records and notifies managers.
- Operations connects a ticketing tool to a spreadsheet or database to automate status updates.
- A regional team prototypes a dashboard that combines internal data sources for local reporting.
- A business unit automates reminders, escalations, or document collection without writing a full application.
The tradeoff is that ease of assembly can hide dependency on shared credentials, weak data scoping, or unmanaged integrations. In practice, the first version often works because it solves a narrow problem, but the governance challenge emerges when it becomes business critical without being reclassified as a production system.
Security Implications
The main security concern is that fast local delivery can outpace the controls normally applied to enterprise software. When citizen development is unmanaged, teams may over-share data, create duplicate records, expose sensitive fields, or build automations that act on stale assumptions. That can lead to integrity failures, privacy exposure, and operational drift.
Another common failure mode is shadow lifecycle growth. A small workflow can quietly accumulate integrations, conditional logic, and exceptions until nobody clearly owns testing, change approval, or retirement. When the original builder leaves, the organisation may inherit an application that still moves data and makes decisions, but without the documentation or support model needed to manage it safely.
In security terms, the observable symptoms are usually weak segmentation between test and production, unclear access ownership, and inconsistent review of embedded logic. The risk is not that citizen builders are inherently unsafe, but that the platform lowers the barrier to creating systems whose impact exceeds the level of governance applied to them.
Domain and Governance Relevance
Citizen development sits at the intersection of business agility, application governance, and identity control. In NHI-adjacent environments, the issue becomes sharper because citizen-built automations often rely on service accounts, API tokens, connectors, or delegated permissions to move data and trigger actions. Those non-human identities can outlive the person who created the workflow, and their access scope may not match the real business need.
This is where governance becomes more than policy. Organisations need a clear line between experimentation and operational use, because the same tool can support a low-risk departmental prototype or a data-moving process with production consequences. The practical question is not whether citizen development should exist, but which use cases are allowed, who owns them, and what review point turns a convenient workflow into a managed enterprise asset.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack surface, CIS Controls v8 and NIST CSF 2.0 set the technical controls, and ISO/IEC 42001:2023 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Inventory and Ownership | Citizen-built automations often depend on unmanaged service accounts and tokens. |
| Recommendation — Inventory workflow identities and assign an owner before any citizen-built app moves production data. | ||
| CIS Controls v8 | 5 — Account Management | Citizen development expands the number of accounts, connectors, and delegated permissions to govern. |
| Recommendation — Restrict, review, and remove accounts used by citizen development platforms and automations. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Citizen development creates access-boundary and data-sharing decisions that require control enforcement. |
| Recommendation — Enforce least-privilege access boundaries for makers, data sources, and published workflows. | ||
| ISO/IEC 42001:2023 | A.2 — AI policy | Relevant where citizen development includes AI-assisted or AI-built workflows needing organisational governance. |
| Recommendation — Define approval and oversight rules for citizen-built AI use before it enters business operations. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Citizen-developed automations can rely on persistent delegated access that attackers may abuse if compromised. |
| Recommendation — Monitor and revoke overly persistent delegated access used by low-code workflows. | ||
Related resources from NHI Mgmt Group
- Why do enterprise copilots and citizen development tools create new governance risks for identity and data security?
- What breaks when organisations scale app security without a clear model for citizen development?
- How should security teams govern citizen development in generative AI and low-code environments?
- Why does citizen development change the security risk profile for application development?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
