AI Hub · Security & Governance
AI Security and Underwriting: Who is Responsible When AI Writes Your Code?
AI models can write functional code at remarkable speed. The speed advantage is real and substantial. But speed without governance creates risk — and the risks in AI-generated code are specific, consequential, and frequently invisible to anyone who did not write or review the code manually.
The Risk No One is Talking About
In our work, we use Claude to produce Zoho Deluge scripts, API integrations, and custom application logic in a fraction of the time it once took. But that speed creates a specific vulnerability that most AI deployment guides skip over entirely.
A common example: an AI model generating a Zoho Creator integration with a third-party API will, unless explicitly instructed otherwise, embed API keys directly in the script as plain text. That key is now readable by anyone with access to the Zoho Creator application, any system logs that capture the script, and any future developer who opens the code — and it may be inadvertently included in exports or backups.
This is not a theoretical vulnerability. It is one of the most common security failures in rapidly-deployed AI-generated code, and it is entirely preventable with proper security review.
What "Underwriting" Means in Practice
When we say we underwrite the AI-generated solutions we build, we mean that every piece of code produced with AI assistance is subject to the same security and quality review as code written entirely by a human developer.
01
Secure credential storage
All API credentials and secrets are stored in secure variable stores — never hardcoded in scripts.
02
Minimal permission scopes
Permission scopes are reviewed and minimised. An integration that only needs to read data should not have write access.
03
Output validation
AI agents that produce content or trigger actions must have clearly defined constraints built into every workflow.
04
Audit logging
Implemented for any agent or automation that touches sensitive data or financial records.
All deployed solutions are also documented in plain language, so future developers and administrators understand what they are maintaining — not just that it works.
The Human Expertise That AI Cannot Replace
AI models do not carry liability. They do not understand your organisation's regulatory environment, data residency obligations, or the specific security policies your IT team or legal advisers have put in place. They also do not know the history of decisions that led to your current Zoho configuration, and why certain things are set up the way they are.
Replacing human expertise with AI-generated speed — without retaining the governance layer — is a risk transfer, not a risk reduction. You move the risk from "this took too long to build" to "we do not fully know what we built or whether it is secure."
Our position is straightforward: we use AI to build faster. We use our expertise to ensure what we build is sound. Every solution we deliver is covered by our security review process — whether it was built with AI assistance or not.
This applies across everything we deploy: from MCP integrations to Zoho Zia Agents and multi-agent workflows.
Frequently asked questions
Would you like an independent review of an AI-generated solution already deployed in your Zoho environment?
