Citizen Developer
Citizen Developer
What is a citizen developer?
- Non-developers build their own tools
- No-code, AI, and vibe coding sharply lower the barrier to entry
- Shadow IT and security need guardrails
What changes in an organization with citizen developers is the order of work. Before, business teams had to write a requirements document, submit it to IT, wait for prioritization review, and get a development slot, and half of all ideas fizzled out along the way. Now the order is reversed: business teams build first, and take only what proves useful to IT for review and handover. Because the cost of failure is small, the biggest change is that “try it for two hours, and drop it if it doesn’t work” experiments become possible.
There is a line, though, around what business teams should touch. The common rule of thumb in practice is: internal to one department with a few dozen users at most, read-only access to ERP and accounting ledgers rather than writing to them, and no handling of personal or payment data. Tools also come in layers, each demanding different skills: no-code for assembling forms and workflows, low-code with some formulas and scripts, and AI coding tools that generate scripts from natural-language instructions. What separates a citizen developer from an Excel power user is 'whether you build something other people use and deploy it'. The moment you deploy, incident response and data accountability come with it, so mature organizations set up a dedicated team within IT and put the approved tool list, user caps, and data classification in writing.
The most common misconception is “you can do anything without knowing how to code.” Building it takes half a day, but fixing it when it breaks three months later is a completely different problem. In practice, three kinds of incidents usually occur. First, when the builder leaves or transfers, an automation tied to a personal account and personal API key stops, becoming an “orphan app” that nobody can touch. Second, customer lists or HR data are pasted straight into an external AI tool, leading to a data leak. Third, if an unverified calculation quietly goes wrong and ends up in an executive report, that single episode gets the whole citizen developer effort banned. Shared accounts, validation against real data, and a one-page A4 handover document are conditions for deployment, not options.
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ lectures, who gets non-specialists using AI right away
John KimJohn Kim, CEO of Nanum Consulting and author of “B2B Marketing Design”Gartner, the IT research firm, popularized the term 'citizen developer' to describe the spread of no-code and low-code platforms. It refers to people in business units, outside the IT department, who build applications themselves. With generative AI and vibe coding, the practice has recently expanded considerably.
Let's look at a hypothetical case: the Sales Operations team at Company A, an industrial parts manufacturer with about 320 employees. Every Friday, one assistant manager spent 4 hours merging by hand the weekly sales spreadsheets sent in by 7 branches nationwide. Each branch used a different format, so two or three times a quarter the numbers were wrong and a corrected report had to go out. The IT team had only 3 people, all tied up with an ERP upgrade, and the request came back with 'we won't get to it until the first half of next year.'
- Assistant Manager Kim of the Sales Operations team gave up waiting, applied for an account on a company-approved no-code automation tool, and put the scope in writing: 'consolidating results from the 7 branches, and nothing more'.
- The first attempt failed. Each branch used a different name and column order for 'client name,' so the matching broke. Kim first sent the branch managers a standard template with 12 fixed input fields.
- Kim told an AI coding tool, 'read the 7 files, add totals by branch and product, and show the week-over-week change,' and got a working script. Then Kim ran it three times on the last 4 weeks of real data and checked it against the manual tallies.
- Park, the IT manager handling the review, said 'I can't approve this on a personal laptop with a personal account,' so Kim moved it to a shared team account and a shared company folder and switched to client codes instead of real customer names.
- Assistant Manager Kim registered the automation in the company’s automation register and left a two-page A4 handover document covering how to run it and what to do on errors, so a successor can run it as is.
- As a result, a consolidation that took 4 hours a week dropped to 15 minutes, saving about 200 hours a year. In the 6 months after rollout there were 0 corrected reports due to number errors, and the weekly sales report went out at 9 a.m. instead of Monday afternoon.