Somewhere in most organisations an application development project sits at ninety percent. A small team built it quickly with AI writing much of the code, a demo went well six months ago, and nothing has moved since. What remains is everything that must be reviewed and confirmed before anyone lets it near production.

The list runs long: which identity provider and who administers it, how secrets are rotated, who approves a release, whether log retention meets the requirement, how role-based access is audited, whether the interface meets WCAG 2.2 AA, and who signs the security assessment. Each question has an answer. Answering and resolving all of them with a team at capacity and a change board that meets fortnightly is what drives the paralysis, and eventually the sponsor gives up.

AI raises the stakes at both ends of that queue. Ageing systems are harder to defer, because the models that write code are also very good at finding vulnerabilities. Code generation speeds the build and adds to the review burden at once, since every line it produces is new and unproven, so a person reads all of it before sign-off.

Human review fatigue is real. Attention falls away, and the reviewer who approved thirty-nine correct files reads the fortieth expecting the same, which is where a subtly wrong authentication check gets through. Assurance teams know this, which is part of why the queue before release keeps growing.

A platform environment settles most of that list once, for everything inside it. The pipeline, environment promotion and rollback already exist. Access control, audit logging and secrets handling are platform features rather than something each team builds again slightly differently, and accessibility is handled at component level. Assurance reviews the environment once, then what each application does inside it.

Low-code platforms faced a real question when code generation arrived, since a product whose pitch was that you did not have to write code looks redundant beside a model that writes it for you. The ones that came through that period did so by turning their own architecture to account. Their applications are assembled from pre-built objects, meaning screens and UI components, workflow steps, authentication and data access, each already tested and run in production by hundreds of organisations. Where a platform’s AI is trained on that object library rather than on public internet code, what it produces is assembled only from components that are already proven and validated.

That platform environment works as a ‘harness’, so controls an assurance team would spend months establishing arrive already tested and in service elsewhere, and the remaining review covers what your application does with data and who may see it. Software then reaches production, and the ROI has a chance of being met, instead of the project being stuck at the ninety percent stage indefinitely.