Someone in procurement builds a useful thing in an afternoon. It watches the contracts folder for renewal dates inside ninety days, pulls the agreement, extracts the clause set, drafts the renewal note and emails it to the category manager. It works. Within a couple of months three people plan their month around it.
It also reads supplier correspondence, which suppliers write. It has write access to the contracts folder, because that was easiest on the day. It authenticates as the person who built it, who left in June. And when the folder was reorganised in July, the retrieval rule kept matching, and it has been drafting notes from last year's agreements ever since.
Every note arrived on time. Every one looked exactly as it always had.
Somewhere in that sequence, without any announcement, the person who built it stopped having a way of working and started having infrastructure. The two need different care. A way of working lives in you, and it adapts every time you use it because you are there. A built workflow has a configuration, dependencies, permissions, failure modes and a change history, whether or not anybody wrote them down.
The instinct at this point is to reach for governance, and that instinct is mostly wrong. Less continuous human involvement does not automatically call for more formal control. It almost always calls for more deliberate engineering. Confusing the two is how personal tooling ends up strangled by process, or worse, trusted like a product.
Two questions do most of the work.
The first is what the thing can actually do. Not what it is for: what it reads, writes, sends, deletes and triggers, and why it holds any permission beyond what the job needs. The permissions define the blast radius, not the description in the prompt. A builder's personal credential, used because it was easiest, is how a note-drafting tool ends up holding the keys to the filing system, and it keeps holding them after the builder has gone. If it does not need to delete anything, it must not be able to.
The second question is harder, and the renewal workflow is the reason. How would anybody know it had failed?
The easy answers are the trap. An alert that fires when the workflow crashes tells you the workflow ran. It tells you nothing about whether the output was right, and the workflow above never crashed once. Quiet failure needs different instruments. A small set of reference cases, real inputs where you already know what good looks like, including one or two awkward ones, rerun whenever anything underneath changes. Occasional sampled re-checking against sources. And the signal that costs nothing, the one from downstream: the category manager who has quietly started opening the contracts again.
Two disciplines follow from that. Past performance is only informative while the conditions that produced it hold; a model update, a prompt change or a reorganised folder means the fiftieth run has stopped being evidence about the fifty-first. And checking less over time is legitimate, it is the trajectory you want, but it has to be earned by evidence. It is not earned by an absence of complaints, by six months of running, or by people liking it. The renewal workflow had all three.
None of this requires the technology to be sophisticated. In October 2020, Public Health England was moving COVID test results between systems in the 1987 XLS spreadsheet format, which stops at about sixty-five thousand rows. Given the layout in use, each file filled at around fourteen hundred cases, and when it filled, the remaining cases were silently dropped. Close to sixteen thousand positive cases went unreported over eight days. Patients got their results. Contact tracers never got the cases, so exposed contacts went untraced while admissions were rising. A spreadsheet had quietly become national infrastructure, the format was chosen because it was easiest on the day, and every file that arrived looked complete.
That failure was not a wrong number on a page. It was rows that never arrived. With the amplification now available to anybody with an afternoon and a folder, a mistake of that shape multiplies long before anyone spots it.
The renewal workflow here is composite, assembled from patterns I have seen rather than from one incident, and I offer the questions as engineering hygiene rather than as anything measured. The part I would not soften is the diagnosis: the tools that hurt organisations are not the ones that break loudly. They are the ones that keep producing something plausible after the world underneath them moved.
Something to try this week. Name one thing you have built that other people now depend on. Write down what it authenticates as, what it can write to or send, and who would notice first if it stopped being right. Fifteen minutes, one workflow, three answers. If the answer to the third is nobody, you have found this week's actual job.
The uncomfortable version. Take last month's output from that workflow, pick three at random, and check them against the sources the way you would check a colleague's work rather than your own. Then tell the people who rely on it what you found, including the case where you found nothing wrong. They are relying on it either way. The only question is whether they are doing so with evidence.