Access

Access is the question of who in your organization can build with AI, through what identity, and how long it takes them to start. It is the least glamorous part of Build and the one that most reliably determines whether anything else happens.

Day one is the metric

The honest measure of the Build surface is how long it takes a new person to ship something small and real. Not to get a login. To ship.

In organizations that have not built the enablement layer, that number is usually measured in weeks and is composed almost entirely of waiting: waiting for a tool license, waiting for an API key, waiting for access to a dataset, waiting for someone to explain which of the three internal wikis is current. None of that is work. It is queue.

The DORA program made lead time for changes a standard metric because it correlates with almost everything else that matters. Lead time from idea to running is the same metric pointed at a different population, and the AI version is worse than the software version in most organizations because the paths are newer and less paved.

Role-based grants, not per-person heroics

The pattern that scales is boring: define a small number of builder profiles, attach tool and data grants to the profile, and assign people to profiles through the same group membership that governs everything else.

Three profiles cover most organizations to start:

• Engineer. Full agent tooling, sandboxed execution, access to non-production data by default, production data by exception and with approval.
• Analyst or business builder. A supported low-code or notebook path, access to the data domains their role already covers, no ability to grant themselves more.
• Reviewer. Read access to what others have built, plus the ability to approve the exceptions.

The point of profiles is not the taxonomy. It is that adding the fourth profile is a decision someone makes deliberately, rather than the natural result of forty individual exceptions nobody can reconstruct.

The exception path is the real policy

Every organization has a rule that says production data requires approval. What distinguishes the ones where the rule holds is that the approved path is fast enough to use. If approval takes four days and the workaround takes four minutes, you have not implemented a control, you have implemented a measurement of how much people care.

Make the exception path short, logged, and time-bound. An approval that grants access for a week and then expires is worth more than one that grants access forever and gets reviewed annually.

What happens when access is missing

People do the work anyway. They sign up for a personal account, paste in what they need, and get on with their job. This is usually described as a discipline problem. It is better understood as a routing problem: demand exists, the sanctioned path does not, so the demand finds another path.

Cisco’s 2024 Data Privacy Benchmark Study, a survey of 2,600 privacy and security professionals, found that 48 percent of organizations admitted entering non-public company information into generative AI tools, while 27 percent had banned the tools at least temporarily. Both numbers describe the same gap from different sides.

The practical consequence is that Access is not only a Build concern. Every month the sanctioned path is missing is a month of accumulating shadow AI, and that is a Secure problem you will inherit later at a worse exchange rate.