Vibe coding: you describe what you want to an AI in plain language, it writes the code, and you keep adjusting by feel — “make the button bigger,” “now it should email me the results” — without ever reading the code itself. The term comes from AI researcher Andrej Karpathy, who described fully giving in to the vibes: accepting code you don’t understand because it seems to work.
Why people love it. Real power here. A non-programmer can build a working tool in an afternoon — a data-entry form, a report formatter, a small dashboard. Ideas that used to die in the “we’d need a developer” stage now get built before lunch. For a five-person firm, that unlocks a lot.
Why it needs guardrails. The catch is in the definition: you don’t understand what was built. The code might work and still be a hazard — security holes, data leaking somewhere unexpected, fragile logic that breaks next month and nobody can fix. “It worked in the demo” is not the same as “we can rely on it.” Vibe coding also has a silent cost: code nobody in the firm can read is code the firm doesn’t own, even if it runs on the firm’s machine.
A workable policy. Treat vibe-coded tools like found objects — useful, unverified.
Prototype freely: sandbox, non-sensitive data, let ideas flow. That’s where vibe coding shines.
Review before production: anything that touches client data, community data, or real workflows gets a code review before it enters service. Use a cloud AI assistant as the reviewer, and if the tool matters, a human with some technical judgment. The same assistants that helped build it can audit it.
Document what exists: every tool, what it does, what data it touches. Your shadow AI inventory should capture these too.
Retire bravely: when a vibe-coded tool breaks and nobody can fix it, let it go. It’s a prototype, not infrastructure.
A workable approach: enthusiasm, yes — your staff building tools is exactly the AI literacy we want. Just route the output through the same discipline as everything else in the firm: sandbox, review, document. Prototypes need review before they are used with client information.
