Should employees build their own AI agents?

10 min readSimon BudziakBy Simon Budziak

On this page9 sections
Title card reading Should employees build their own AI agents, with a gold-outlined builder window on navy assembling a small agent card, three more small agent cards queued behind a dashed gold gate at its side.

Somebody in your company built an AI agent last month. It was not IT, and nobody filed a ticket. KPMG and Melbourne Business School put numbers on exactly this in 2025, and Microsoft’s own telemetry points the same way: the building has started, with or without a program. Let employees build their own agents, and spend the governance budget on the one line that matters: what each agent is allowed to touch, under whose identity, with what blast radius. This post walks through the numbers on unsanctioned building, what a citizen developer program actually is, where the employee build ends and the IT build begins, and how Walmart and Microsoft drew that line.

Your employees are already building, just not where you can see it

The study to read first is Trust, attitudes and use of AI, run by Melbourne Business School with KPMG, which surveyed over 48,000 people across 47 countries between November 2024 and January 2025. Its finding on policy is blunt: “Almost half of employees admit to using AI in ways that contravene company policies, including uploading sensitive company information into free public AI tools like ChatGPT.” Worse for governance, 57% say they “hide their use of AI and present AI-generated work as their own”. Only 40% report their workplace even has an AI usage policy or guidance for generative AI, and only 47% have received any training.

Microsoft measured the same current a year earlier. The 2024 Work Trend Index, surveying 31,000 people across 31 countries, found 75% of knowledge workers already using AI at work and 78% of those users bringing their own tools in, a pattern Microsoft labeled BYOAI and reported as even more common at small and mid-sized companies. That is shadow AI at population scale, before agents entered the picture. The legal profession shows the same split in one pair of numbers, 79 percent of legal professionals using AI against 40 percent using a tool built for legal work, which we unpack in the legal AI vendors law firms pay for in 2026.

The trap: a ban does not stop the building. It moves the building onto personal accounts and free tiers, which is precisely where the KPMG numbers say your sensitive data is going now. The hiding is the expensive part, because hidden work can never be reviewed.

What is a citizen developer program?

Mendix, the Siemens-owned low-code vendor, defines the role in one sentence: “Citizen developers are business users with little to no coding experience who build applications with IT-approved technology.” The same page credits Gartner with coining the term. The load-bearing words are “IT-approved technology”: a citizen developer program means a sanctioned no-code builder, named owners for what gets built, and training for the people building.

The approved-builder market is already mainstream. Microsoft’s Copilot Studio product page states that 90% of the Fortune 500 has used Copilot Studio, and Microsoft had counted more than 50,000 organizations using it by September 2024. The analyst Josh Bersin told HR leaders in January 2026 that business and HR people will be building apps and agents at work as a normal part of the job, and that they will not necessarily need vibe coding tools to do it. Which builder to sanction is its own decision, and we walked its trade-offs in Copilot Studio or a custom agent.

Sprawl is the real fear, and it has numbers now

The objection every CIO raises has data behind it. OutSystems’ State of AI Development 2026 research, published in April 2026 from a survey of 1,900 global IT leaders, found 96% of organizations already using AI agents, while 94% are concerned that AI sprawl is increasing complexity, technical debt and security risk, and only 12% have a centralized platform to manage it. That gap between usage and governance is agent sprawl in the making.

The volume behind the worry is measurable too. Microsoft’s 2026 Work Trend Index, built on trillions of Microsoft 365 productivity signals and a survey of 20,000 AI-using workers in 10 countries, reports the number of active agents in its ecosystem grew 15x year over year, rising to 18x in large enterprises. Both sides of the argument are right at once: the building is valuable, and ungoverned it compounds into risk. The open question is where the gate goes.

The line is not who builds, it is what the agent can reach

Draw the line through permissions, not through job titles. A sales coordinator’s agent that reads the team calendar and drafts follow-up emails for approval is a different object from an agent that writes to the ERP, whatever badge its builder wears. Draw the build line through what the agent can reach, and the who-builds question answers itself.

Microsoft’s guidance to IT leaders in the same 2026 report says the quiet part plainly: it means “treating agents as managed entities with identities, permissions, policy enforcement, and lifecycle management. IT becomes the control plane for agent operations”. In practice that is three controls. Every agent gets an identity of its own, so its actions are attributable and revocable. Every agent gets least privilege: the connectors and scopes its job needs, nothing more. And every agent has a known blast radius: what is the worst it can do before a human notices, and is that worst case reversible? The tooling for this exists off the shelf. Microsoft’s admin center can enable, disable or block agents for specific users or groups, and its Power Platform adoption guidance calls the whole approach “digital guardrails”. Who answers for an agent that crosses the line anyway is a governance question of its own, and we mapped it in Who is accountable when an AI agent gets it wrong.

Matrix placing agent builds on two axes, what the agent can touch against who feels a failure, with employee self-service in the read-only low-stakes quadrant, platform guardrails and named owners in the middle quadrants, and IT-built and operated agents where actions reach customers or money
Permissions decide the builder. The job title never appears on the map.

What Walmart did when its agents multiplied

Walmart hit the sprawl wall early and in public. In July 2025 it announced a consolidation of its AI tools into four “super agents”, one access point each for customers, employees, partners and developers. The employee-facing associate agent lets staff do things like schedule parental leave, and lets store managers pull specific sales data with minimal input. The reasoning from Suresh Kumar, Walmart’s global chief technology officer, is the whole argument in one line: agents were essential, but multiple agents, each useful on its own, “can quickly become overwhelming and confusing”.

Read that as a mid-sized company and take the shape, since the scale is out of reach anyway. Walmart did not respond to agent proliferation by banning builds or pulling everything back into engineering. It consolidated the doors: a small number of sanctioned entry points, with the building continuing behind them. You do not need four super agents. You need one sanctioned place where an employee’s agent can be built, found, reviewed and switched off.

How should employees think about an AI agent-enhanced workplace?

The same 2026 Work Trend Index gives employees their answer in numbers: 66% of surveyed AI users say AI lets them spend more time on high-value work, and 58% say they are producing work they could not have produced a year ago. The report’s most advanced cohort, the 16% it calls Frontier Professionals, stands out for exactly the skill this post is about: using agents for multi-step workflows and for building multi-agent systems. A year earlier the 2025 edition had already named the role this is heading toward, the agent boss, someone who builds, delegates to and manages agents to amplify their own impact.

So the employee-side rule is simple: build in the sanctioned place, under your own name. The KPMG study’s most corrosive numbers are the hiding ones, the 57% presenting AI work as their own and the 66% who rely on AI output without evaluating accuracy. Unreviewed output passed along as finished work is workslop, and it erodes exactly the trust a builder needs to be given more scope. AI fluency is becoming a promotable skill precisely because the people who review what their agents produce are the ones organizations can afford to let build more.

The rule we run this site on

We eat this cooking. The posts and pages on this site are produced AI-natively, by agents working on a schedule with humans at the edge, and the governance line is the one this post recommends. Every change an agent makes ships as a pull request. A gate runs the test suite, a structure audit and an SEO audit against it, and the merge happens only when every check is green. The writing agent cannot merge its own work, quoted claims are matched as literal strings against fetched copies of their sources before anything ships, and a human can read, edit or kill any of it at the review boundary. That is a citizen developer program at the scale of a consultancy: the agents build freely, and the things they build cannot reach the public site except through a gate they do not control.

The takeaway

The build-or-ban question is already answered by your employees’ behavior: almost half are using AI against policy, and the ones hiding it are the risk, not the ones asking. Say yes to employee-built agents, and put the engineering effort into the gate: one sanctioned builder, an identity per agent, least privilege by default, and a blast radius somebody has signed off on. IT’s job shifts from building every agent to operating the control plane the agents run on. The heavyweight systems, the ones that write to customers and money, stay built by professionals, and whether those professionals are yours or a vendor’s is the separate decision we covered in Forward-deployed engineers or your own team.

Sources

See this working in a system we built