Each step in that path binds something, and only once.
Okta binds authentication to a directory at creation time. DNS binds a name to a service, once. The automatic security review binds a verdict to the state of the code on the day it shipped [7]. That is real work and it removes real toil; Baba, who describes the internal path at JFrog, says it replaced what used to cost three tickets and a fortnight [6]. None of the three steps writes a field whose value is a team, and none of them is scheduled to run again.
The offboarding checklist has the same single-shot shape from the other end. It operates on the human principal: accounts deprovisioned, laptop returned, SSO revoked, HR ticket closed [10]. In Baba's scenario the app holds a live database credential of its own [9]. A credential issued to a service has no opinion about whether the person who requested it still badges in. So the checklist completes correctly, every box ticked, and the tool keeps serving four people who depend on it [9][10]. The credential does not know the person who requested it is gone.
What actually fails six weeks later is the routing of the ticket. There is no repo anyone recognises, no runbook, and no team name attached anywhere in the systems [9]. Baba's framing is that Day 1 is close to solved because deployment is a product now, while Day 2 has nobody's name on it, since every other class of software in the company arrived with a support team already attached [12]. He is explicit that none of this is an argument for slowing the building down [13].
The two numbers here are carrying more weight than they can. Gartner's figure is that 41% of employees are business technologists, building technology capability while reporting outside IT, measured in 2022 [1]; Baba tells you to read it as a floor because it predates AI making the building part trivial [5]. For that share to describe your org, you would need a comparable proportion of non-IT staff with an actual sanctioned path to production, not just a spreadsheet habit. If you have no such path, the same people are still building, and the artifacts are somewhere you cannot enumerate.
The second number is a CISO self-report: 75% say they have already found unsanctioned AI tools running in production, and 16% are not sure [2][3]. Add them and 91% of respondents cannot say their production estate is free of unsanctioned AI tooling [4]. That is a claim about a wider category than the one in the scenario. Shadow SaaS signed up on a corporate card and an internal app wired into your own Okta tenant with a database credential are different exposures with different fixes, and the survey as reported does not separate them.
The mechanism for the fix already exists in the same path. It fails a deploy on a scanner finding [7]. Pointing that gate at a required owning-team field, with an expiry, is the same interlock aimed at a different column.
