WEBVTT

1
00:00:00.080 --> 00:00:03.399
<v Speaker 1>Microsoft's generative pages look like the final glorious victory for

2
00:00:03.480 --> 00:00:06.160
<v Speaker 1>low code. The moment the spreadsheet crowd finally caught up

3
00:00:06.160 --> 00:00:09.599
<v Speaker 1>to the coders, you typer sentence, press enter, and GPT

4
00:00:09.720 --> 00:00:12.759
<v Speaker 1>five obediently assembles a working React page that talks to

5
00:00:12.839 --> 00:00:16.480
<v Speaker 1>data Verse, decorates itself with orange flare, and politely runs

6
00:00:16.519 --> 00:00:19.600
<v Speaker 1>on first try q applause, confetti, and a brief illusion

7
00:00:19.640 --> 00:00:23.160
<v Speaker 1>that we've transcended the need for developers entirely. Yes, it

8
00:00:23.199 --> 00:00:26.760
<v Speaker 1>looks effortless. A user describes a dashboard and within seconds,

9
00:00:26.760 --> 00:00:29.679
<v Speaker 1>the app agent conjures data grids, filters even export buttons.

10
00:00:29.760 --> 00:00:32.719
<v Speaker 1>Text becomes React, and because it's built right inside power apps,

11
00:00:32.759 --> 00:00:36.159
<v Speaker 1>it feels safe, regulated, sandboxed. Like the rest of the platform.

12
00:00:36.200 --> 00:00:40.479
<v Speaker 1>What could possibly go wrong? Everything that tidy UI hides,

13
00:00:40.520 --> 00:00:44.000
<v Speaker 1>the quiet click of a lock disengaging the magical instant

14
00:00:44.000 --> 00:00:46.520
<v Speaker 1>when you whisper edit code and the platform hands you

15
00:00:46.560 --> 00:00:49.600
<v Speaker 1>the keys plus the entire mortgage. Each regenerated line of

16
00:00:49.679 --> 00:00:53.079
<v Speaker 1>JSX isn't a convenience, it's a liability. You now own

17
00:00:53.600 --> 00:00:57.000
<v Speaker 1>a trojan horse dressed in productivity, wheels straight past governance

18
00:00:57.039 --> 00:01:00.960
<v Speaker 1>and security review. The promise is autonomy. The price is maintenance.

19
00:01:01.399 --> 00:01:04.000
<v Speaker 1>You didn't hire a developer, you became one, minus the

20
00:01:04.040 --> 00:01:07.519
<v Speaker 1>salary and version control habits. Here's the absurd part. Someone

21
00:01:07.519 --> 00:01:11.879
<v Speaker 1>decided that giving citizen makers direct React access was empowerment. Apparently,

22
00:01:12.079 --> 00:01:15.840
<v Speaker 1>years of runaway Excel macros and untested Power effects formulas

23
00:01:16.079 --> 00:01:19.319
<v Speaker 1>didn't teach us enough humility. So Microsoft wrapped this chaos

24
00:01:19.359 --> 00:01:23.079
<v Speaker 1>in pustle branding, stamped it generative AI and declared it progress.

25
00:01:23.280 --> 00:01:26.239
<v Speaker 1>Generative pages whispered, don't worry, the agent will handle it.

26
00:01:26.239 --> 00:01:29.519
<v Speaker 1>It won't. The agent rights convincing React not sustainable architecture.

27
00:01:29.719 --> 00:01:32.599
<v Speaker 1>Every tweak creates divergence from the low code core, the

28
00:01:32.640 --> 00:01:35.640
<v Speaker 1>same core that once safeguarded you from dependency held NPM,

29
00:01:35.719 --> 00:01:38.319
<v Speaker 1>drift and patroulette. You think you got a shortcut, What

30
00:01:38.400 --> 00:01:42.680
<v Speaker 1>you actually got was responsibility, the promise, and the pivot. Officially,

31
00:01:42.799 --> 00:01:46.239
<v Speaker 1>Microsoft causes a bridge, a seamless link between low code

32
00:01:46.280 --> 00:01:50.480
<v Speaker 1>convenience and pro code flexibility. In theory, GPT five inside

33
00:01:50.519 --> 00:01:52.719
<v Speaker 1>power Apps is the final layer of the stack that

34
00:01:52.799 --> 00:01:56.400
<v Speaker 1>lets business users dream in sentences instead of scripting languages.

35
00:01:56.959 --> 00:02:00.000
<v Speaker 1>Type built a page that lists internal users with filters

36
00:02:00.439 --> 00:02:05.120
<v Speaker 1>and a capable AI architect assembles the page automatically, files materialize,

37
00:02:05.120 --> 00:02:08.280
<v Speaker 1>components wire themselves up, and the illusion of mastery begins.

38
00:02:08.719 --> 00:02:11.560
<v Speaker 1>But here's where the bridge analogy collapses. This isn't a bridge.

39
00:02:11.680 --> 00:02:14.479
<v Speaker 1>It's an autopilot that starts rewiring the airplane mid flight.

40
00:02:14.960 --> 00:02:17.520
<v Speaker 1>You may believe your cruising comfortably between low code and

41
00:02:17.560 --> 00:02:20.319
<v Speaker 1>custom depth. In fact, the AI quietly tears down the

42
00:02:20.319 --> 00:02:23.080
<v Speaker 1>cockpit controls and sells you a saldering iron. The intent

43
00:02:23.120 --> 00:02:26.520
<v Speaker 1>is noble. Microsoft's ecosystem has always danced between citizen makers

44
00:02:26.520 --> 00:02:29.840
<v Speaker 1>and professional depths. The company wants both populations to coexist,

45
00:02:30.120 --> 00:02:35.039
<v Speaker 1>sharing ditaverse tables and governance policies generative AI, they argue. Finally,

46
00:02:35.159 --> 00:02:38.639
<v Speaker 1>levels that divide because now anyone can issue natural language

47
00:02:38.639 --> 00:02:42.599
<v Speaker 1>commands and get production ready code. Except production ready implies

48
00:02:42.719 --> 00:02:45.439
<v Speaker 1>someone somewhere will maintain it. And that's the catch. Low

49
00:02:45.439 --> 00:02:49.000
<v Speaker 1>code worked because it was declarative rules, configurations, and formulas

50
00:02:49.000 --> 00:02:52.800
<v Speaker 1>that Microsoft's engine could interpret, validate, and patch safely. Type

51
00:02:52.800 --> 00:02:55.199
<v Speaker 1>a formula wrong and you got a friendly error. Toast

52
00:02:55.759 --> 00:02:58.719
<v Speaker 1>edit react, you get LINTD errors, broken imports, and a

53
00:02:58.800 --> 00:03:02.039
<v Speaker 1>vacation into stack overflow threads. Last updated in twenty nineteen,

54
00:03:02.199 --> 00:03:04.840
<v Speaker 1>This is the moment the promise pivots. The interface still

55
00:03:04.840 --> 00:03:07.280
<v Speaker 1>looks like power apps, but the guts have left the building.

56
00:03:07.560 --> 00:03:09.759
<v Speaker 1>Once that edit code button is pressed, your app is

57
00:03:09.800 --> 00:03:13.400
<v Speaker 1>no longer a managed configuration. Its source code, the platform

58
00:03:13.439 --> 00:03:17.639
<v Speaker 1>stops enforcing its clean boundaries. Identity, data, access, control, logic,

59
00:03:17.680 --> 00:03:20.879
<v Speaker 1>styling all become mutable text text. You now have to secure,

60
00:03:20.960 --> 00:03:23.479
<v Speaker 1>diff and patch yourself. Think of power Apps as a

61
00:03:23.520 --> 00:03:27.479
<v Speaker 1>managed city. Roads are paved, light synchronized, sanitation handled nightly.

62
00:03:28.039 --> 00:03:32.159
<v Speaker 1>Everyone builds within zoning laws, so nothing collapses. Now. Picture

63
00:03:32.199 --> 00:03:36.960
<v Speaker 1>generative pages granting zoning exemptions. Suddenly, backyard skyscrapers sprout besides

64
00:03:37.000 --> 00:03:39.840
<v Speaker 1>single story homes. Power cables cross sidewalks, and no one

65
00:03:39.960 --> 00:03:42.919
<v Speaker 1>show who maintains the plumbing. It's freedom, yes, but freedom

66
00:03:42.919 --> 00:03:46.800
<v Speaker 1>that invites entropy. The cognitive dissonance is spectacular. Marketing says

67
00:03:46.840 --> 00:03:50.159
<v Speaker 1>anyone can build. Reality says anyone can break, and few

68
00:03:50.199 --> 00:03:53.039
<v Speaker 1>can fix. This gap between illusion and responsibility is where

69
00:03:53.080 --> 00:03:56.680
<v Speaker 1>technical debt breeds. Users who thought they'd delegate complexity to

70
00:03:56.759 --> 00:04:00.000
<v Speaker 1>AI discover they've merely delayed it to next quarter's outage.

71
00:04:00.039 --> 00:04:03.280
<v Speaker 1>Let's dwell on that anyone can maintain myth. A low

72
00:04:03.319 --> 00:04:06.759
<v Speaker 1>code page describes what to show a React component, prescribes

73
00:04:06.800 --> 00:04:11.159
<v Speaker 1>how to show it that, how carries dependencies, state management,

74
00:04:11.680 --> 00:04:15.919
<v Speaker 1>ACYNC behavior data calls each potential point of failure. A

75
00:04:15.960 --> 00:04:18.759
<v Speaker 1>citizen deav might no ditaverse schemas, but not the difference

76
00:04:18.759 --> 00:04:21.120
<v Speaker 1>between a promise chain and an ACYNC A weight. GPT

77
00:04:21.279 --> 00:04:24.240
<v Speaker 1>five can generate them both, but it won't explain why

78
00:04:24.279 --> 00:04:28.319
<v Speaker 1>one leak's memory underload. Developers see this and laugh, convinced

79
00:04:28.319 --> 00:04:31.519
<v Speaker 1>the feature finally elevates them. Now we can extend power

80
00:04:31.560 --> 00:04:34.879
<v Speaker 1>apps freely. They cheer forgetting that freedom without guardrails produces

81
00:04:34.879 --> 00:04:38.360
<v Speaker 1>the same technical debt they already drown in every sprint. Ironically,

82
00:04:38.439 --> 00:04:41.560
<v Speaker 1>Microsoft's attempt to merge low code safety with pro code

83
00:04:41.600 --> 00:04:44.959
<v Speaker 1>control just hands every participant the other camp's problems, and

84
00:04:45.000 --> 00:04:48.199
<v Speaker 1>that tiny edit button that's where everything unravels. The break

85
00:04:48.480 --> 00:04:50.920
<v Speaker 1>why pro code is a debt. The moment you click

86
00:04:51.079 --> 00:04:54.800
<v Speaker 1>edit code, power Apps stops being your babysitter. That comforting

87
00:04:54.800 --> 00:04:58.240
<v Speaker 1>declarative shield, the one that prevented you from doing anything catastrophic,

88
00:04:58.600 --> 00:05:00.879
<v Speaker 1>is gone. You now inhabit pure, your React land, where

89
00:05:00.879 --> 00:05:04.360
<v Speaker 1>one misplaced bracket can unravel an entire interface. Beneath the

90
00:05:04.439 --> 00:05:08.959
<v Speaker 1>esthetic continuity, the architecture has switched species. Declarative became imperative.

91
00:05:09.000 --> 00:05:13.360
<v Speaker 1>Governed became freelance. Predictable became good luck. Technically, what happens

92
00:05:13.480 --> 00:05:16.839
<v Speaker 1>is simple but devastating. A generative page starts as metadata.

93
00:05:16.879 --> 00:05:19.879
<v Speaker 1>Microsoft's engine compiles it into components that follow the Power

94
00:05:19.879 --> 00:05:22.240
<v Speaker 1>Apps runtime. Once you open the code panel, the system

95
00:05:22.279 --> 00:05:25.279
<v Speaker 1>snapshots that pages generated. REACT wraps it in a thin

96
00:05:25.319 --> 00:05:29.040
<v Speaker 1>integration layer and tells the platform this file is externally managed.

97
00:05:29.319 --> 00:05:32.600
<v Speaker 1>Translation Microsoft stops maintaining it. The safety net doesn't tear.

98
00:05:32.680 --> 00:05:37.560
<v Speaker 1>It's intentionally removed. From here on. The dependencies libraries and

99
00:05:37.680 --> 00:05:42.000
<v Speaker 1>JSX logic are yours to shepherd security updates your problem.

100
00:05:42.079 --> 00:05:46.000
<v Speaker 1>Dependency mismatches also yours. When dataverse modifies an endpoint signature,

101
00:05:46.160 --> 00:05:49.399
<v Speaker 1>your ungoverned code doesn't refractor itself. It just breaks quietly

102
00:05:49.439 --> 00:05:51.600
<v Speaker 1>at three am on a Sunday, right after you told

103
00:05:51.639 --> 00:05:55.120
<v Speaker 1>leadership the app was self maintaining. In the original low

104
00:05:55.120 --> 00:05:59.160
<v Speaker 1>code world, the Power Apps compiler interpreted formulas. It safeguarded

105
00:05:59.160 --> 00:06:02.680
<v Speaker 1>them with type value permissions and centralized patching. You couldn't

106
00:06:02.680 --> 00:06:06.879
<v Speaker 1>import a vulnerable library because everything lived inside Microsoft's fenced ecosystem.

107
00:06:07.120 --> 00:06:09.879
<v Speaker 1>React editing dismantles that fence. What material you I find,

108
00:06:09.920 --> 00:06:12.720
<v Speaker 1>It'll import straight from NPM. Want to inject a date library,

109
00:06:12.800 --> 00:06:16.199
<v Speaker 1>chart component or custom avatar renderer, go ahead. Each new

110
00:06:16.199 --> 00:06:19.360
<v Speaker 1>dependency is a potential malware injection vector with the full

111
00:06:19.399 --> 00:06:22.680
<v Speaker 1>privileges of your data connection. Essentially, the power platform was

112
00:06:22.720 --> 00:06:26.439
<v Speaker 1>a carefully managed city grid. Every building page flow table

113
00:06:26.519 --> 00:06:30.480
<v Speaker 1>built under strict architectural codes, sewers connect, traffic, lights synchronize,

114
00:06:30.480 --> 00:06:34.199
<v Speaker 1>and every upgrade rolls out citywide. Hitting edit code converts

115
00:06:34.240 --> 00:06:37.240
<v Speaker 1>your plot of land into an unlicensed construction site. You

116
00:06:37.279 --> 00:06:40.160
<v Speaker 1>can now extend, patch or repaint your property freely. But

117
00:06:40.240 --> 00:06:42.480
<v Speaker 1>when the sewage backs up through your basement, city hall

118
00:06:42.519 --> 00:06:45.240
<v Speaker 1>won't help. Let's visualize the debt that blots quietly. After that.

119
00:06:45.800 --> 00:06:48.639
<v Speaker 1>First comes the React version drift. Power Apps might upgrade

120
00:06:48.680 --> 00:06:51.759
<v Speaker 1>its rendering engine to a new React release. Your component

121
00:06:51.800 --> 00:06:55.600
<v Speaker 1>still targets the old one. Hooks deprecate, life cycle methods, change,

122
00:06:55.720 --> 00:06:59.519
<v Speaker 1>and suddenly it worked yesterday becomes your daily lament. Then

123
00:06:59.519 --> 00:07:03.240
<v Speaker 1>come NP dependencies, each with its own patch cycle, security advisories,

124
00:07:03.279 --> 00:07:06.439
<v Speaker 1>and breaking change schedule. Unless you're actively reading CV reports

125
00:07:06.439 --> 00:07:10.000
<v Speaker 1>a pastime, no business analyst requested, You're walking blindfolded through

126
00:07:10.000 --> 00:07:14.160
<v Speaker 1>a minefield of vulnerabilities. Consider data verse schema evolution. Someone

127
00:07:14.160 --> 00:07:17.600
<v Speaker 1>in it renames a column or alters a relationship. In

128
00:07:17.639 --> 00:07:21.160
<v Speaker 1>classic low code mode, the run time adjusts automatically. The

129
00:07:21.240 --> 00:07:24.240
<v Speaker 1>next published rebinds controls to the updated schema. But your

130
00:07:24.279 --> 00:07:26.800
<v Speaker 1>custom React page doesn't know about those updates. It still

131
00:07:26.879 --> 00:07:30.319
<v Speaker 1>queries the old field name fails silently and serves empty

132
00:07:30.319 --> 00:07:33.120
<v Speaker 1>grids while end users file help desk tickets. Then there's

133
00:07:33.160 --> 00:07:37.800
<v Speaker 1>authentication drift. Managed power apps enforce Microsoft enter permissions automatically.

134
00:07:38.160 --> 00:07:41.480
<v Speaker 1>Custom React components live outside that enforcement boundary. Forget a

135
00:07:41.480 --> 00:07:44.480
<v Speaker 1>permission check, and your page might happily render sensitive user

136
00:07:44.519 --> 00:07:47.480
<v Speaker 1>data to anyone with the link. You didn't merely break functionality,

137
00:07:47.839 --> 00:07:51.199
<v Speaker 1>You violated compliance. Yet the makers remain blissfully convinced the

138
00:07:51.240 --> 00:07:53.920
<v Speaker 1>AI will patch things later. Oh, I'll just tell the

139
00:07:53.959 --> 00:07:56.879
<v Speaker 1>agent to fix it, they say, as though GPT were

140
00:07:56.879 --> 00:08:00.439
<v Speaker 1>a dependable colleague instead of a stochastic parrot with attention issues.

141
00:08:00.879 --> 00:08:04.040
<v Speaker 1>Generative AI can rewrite broken code, Yes, it cannot understand

142
00:08:04.040 --> 00:08:07.399
<v Speaker 1>why it broke. Each regeneration piles obstruction upon abstraction until

143
00:08:07.399 --> 00:08:10.120
<v Speaker 1>your app resembles a tower built by well intentioned interns

144
00:08:10.120 --> 00:08:12.839
<v Speaker 1>on red Bull impressive from a far unstable up close,

145
00:08:13.319 --> 00:08:16.800
<v Speaker 1>here's the quiet irony. Professional developers already fight this debt

146
00:08:16.839 --> 00:08:21.240
<v Speaker 1>in traditional projects. They use CICD pipelines, linters, dependency scanners,

147
00:08:21.279 --> 00:08:24.120
<v Speaker 1>and version locks to contain it. Citizen developers, those new

148
00:08:24.120 --> 00:08:27.839
<v Speaker 1>recruits in productivity, rarely have such discipline. When granted full

149
00:08:27.879 --> 00:08:30.360
<v Speaker 1>react powers, they create the same debt patterns, but without

150
00:08:30.399 --> 00:08:34.639
<v Speaker 1>the guardrails, and when the inevitable failure arrives, it inherits

151
00:08:34.679 --> 00:08:38.320
<v Speaker 1>the mess discovering code written half by humans, half by AI,

152
00:08:38.480 --> 00:08:41.679
<v Speaker 1>and wholly by negligence. So yes, pro code offers control,

153
00:08:41.759 --> 00:08:44.720
<v Speaker 1>but control without governance becomes chaos with a keyboard. The

154
00:08:44.759 --> 00:08:48.000
<v Speaker 1>technical debt isn't hypothetical, it's encoded in the moment responsibility

155
00:08:48.039 --> 00:08:51.399
<v Speaker 1>shifts from platform to person. Every security patch skipped, every

156
00:08:51.399 --> 00:08:55.360
<v Speaker 1>dependency left unpinned, every minor API change untested, all accrue interest.

157
00:08:55.519 --> 00:08:58.919
<v Speaker 1>The cost isn't just rework hours, it's exposure surface. Let's

158
00:08:58.919 --> 00:09:01.799
<v Speaker 1>follow one practical chain reaction. The maker adds an import

159
00:09:01.840 --> 00:09:05.279
<v Speaker 1>from material Ui to display avatars harmless. Six months later,

160
00:09:05.320 --> 00:09:08.440
<v Speaker 1>material Ui releases a patch for a cross side scripting exploit.

161
00:09:08.519 --> 00:09:10.960
<v Speaker 1>Power apps can't apply it because it's not part of

162
00:09:10.960 --> 00:09:14.360
<v Speaker 1>their managed run time. Your app remains vulnerable until someone

163
00:09:14.360 --> 00:09:17.639
<v Speaker 1>remembers which app even included that library. Multiply that across

164
00:09:17.679 --> 00:09:22.279
<v Speaker 1>dozens of pages, and congratulations, you've federated security through ignorance. Meanwhile,

165
00:09:22.360 --> 00:09:26.679
<v Speaker 1>AI complacency grows. Makers train themselves to rely on prompts

166
00:09:26.799 --> 00:09:29.960
<v Speaker 1>rather than comprehension. They stop reading the generated code, assuming

167
00:09:29.960 --> 00:09:33.919
<v Speaker 1>anything produced by Microsoft's agent must meet Microsoft's standards. It doesn't.

168
00:09:34.240 --> 00:09:36.960
<v Speaker 1>The agent speaks react fluently but has no notion of

169
00:09:37.000 --> 00:09:40.960
<v Speaker 1>corporate security baselines. It will happily import outdated packages if

170
00:09:41.000 --> 00:09:44.480
<v Speaker 1>they satisfy your vague request for nicer buttons. And here's

171
00:09:44.480 --> 00:09:47.879
<v Speaker 1>the checkmate. Once a page enters code edited status, reverting

172
00:09:47.919 --> 00:09:50.840
<v Speaker 1>it to pure low code is effectively impossible. The generator

173
00:09:50.879 --> 00:09:55.039
<v Speaker 1>won't safely reabsorb your modifications. At best, it overrides them.

174
00:09:55.120 --> 00:09:58.639
<v Speaker 1>At worst, it merges nonsense. You can't undo pro code.

175
00:09:58.720 --> 00:10:01.399
<v Speaker 1>It's a one way migration from platform governed safety into

176
00:10:01.399 --> 00:10:05.519
<v Speaker 1>self managed fragility. Sarcastically speaking, congratulations, you just became a

177
00:10:05.559 --> 00:10:08.360
<v Speaker 1>front end developer without consent. You didn't sign up for

178
00:10:08.480 --> 00:10:11.519
<v Speaker 1>NPM audits, regression tests, or dependency chains. Yet here you

179
00:10:11.600 --> 00:10:14.720
<v Speaker 1>are managing them by accident. You traded Microsoft safety net

180
00:10:14.720 --> 00:10:18.480
<v Speaker 1>for autonomy. You can't afford believing AI would subsidize competence. Spoiler,

181
00:10:18.639 --> 00:10:21.320
<v Speaker 1>it doesn't. It's not if this breaks, it's which part

182
00:10:21.360 --> 00:10:24.679
<v Speaker 1>breaks first. Is the proof of collapse. What breaks first?

183
00:10:25.000 --> 00:10:27.919
<v Speaker 1>Microsoft already knows this is unstable. That's why the new

184
00:10:27.960 --> 00:10:31.879
<v Speaker 1>code Compare tool exists. It's not innovation, it's insurance. Code

185
00:10:31.879 --> 00:10:34.039
<v Speaker 1>compare lets you view the before and after of your

186
00:10:34.159 --> 00:10:37.440
<v Speaker 1>edits and admission that contradictory code states are now expected.

187
00:10:37.600 --> 00:10:39.960
<v Speaker 1>In the low code world, version control was implicit. The

188
00:10:40.000 --> 00:10:43.639
<v Speaker 1>platform tracked everything. Now with code Compare, Microsoft politely hands

189
00:10:43.679 --> 00:10:47.480
<v Speaker 1>you Git without the GitHub, a babysitting feature disguised as empowerment.

190
00:10:47.639 --> 00:10:50.360
<v Speaker 1>Consider what it reveals. As soon as code compare appears,

191
00:10:50.559 --> 00:10:53.679
<v Speaker 1>you're no longer using low code. You're debugging. You can

192
00:10:53.759 --> 00:10:57.879
<v Speaker 1>literally watch the AI regenerate react after your edits, splicing

193
00:10:57.879 --> 00:11:01.159
<v Speaker 1>its code suggestions beside yours. It's the visual manifestation of

194
00:11:01.240 --> 00:11:04.120
<v Speaker 1>technical debt. A diff where half the lines are human,

195
00:11:04.320 --> 00:11:07.360
<v Speaker 1>half are GPT, and none are documented. That's not a workflow,

196
00:11:07.399 --> 00:11:11.039
<v Speaker 1>that's forensic work. The supposed flexibility of external imports makes

197
00:11:11.080 --> 00:11:13.639
<v Speaker 1>this worse the moment you bring in something like material Ui.

198
00:11:13.799 --> 00:11:18.240
<v Speaker 1>You've stepped outside power App's walled garden. Inside, controls are vetted, sandboxed,

199
00:11:18.320 --> 00:11:22.200
<v Speaker 1>updated alongside data verse Outside. You're trusting strangers on NPM

200
00:11:22.279 --> 00:11:25.600
<v Speaker 1>to behave The import line looks innocent import avatar from

201
00:11:25.600 --> 00:11:29.080
<v Speaker 1>at maui material Avatar. But behind that cute syntax lurk

202
00:11:29.200 --> 00:11:32.519
<v Speaker 1>megabytes of unreviewed dependencies with their own transitive chains and

203
00:11:32.559 --> 00:11:36.519
<v Speaker 1>potential exploits. One styling component pulls ten subpackages, each pulling

204
00:11:36.519 --> 00:11:38.720
<v Speaker 1>two more. You now have a dependency tree tall enough

205
00:11:38.720 --> 00:11:42.080
<v Speaker 1>to shade your compliance officer. And here comes the security bombshell.

206
00:11:42.240 --> 00:11:44.559
<v Speaker 1>Those libraries don't live in isolation. They run with the

207
00:11:44.559 --> 00:11:47.240
<v Speaker 1>same privileges as the page, meaning they handle the same

208
00:11:47.360 --> 00:11:51.559
<v Speaker 1>enterprise data. You just gave unaudited, open source JavaScript access

209
00:11:51.600 --> 00:11:55.480
<v Speaker 1>to your company's internal directory. Calling that citizen development is

210
00:11:55.519 --> 00:11:58.639
<v Speaker 1>like letting strangers run electrical wiring in your office because

211
00:11:58.679 --> 00:12:01.799
<v Speaker 1>they watched one tutorial. It's not merely theory. Style tweaks

212
00:12:01.879 --> 00:12:05.960
<v Speaker 1>ripple unpredictably. One user changes a table header color, React

213
00:12:06.000 --> 00:12:09.759
<v Speaker 1>recompiles entire component trees because your modified page divert from

214
00:12:09.759 --> 00:12:13.200
<v Speaker 1>Microsoft's templates automated patching no longer applies cleanly. The next

215
00:12:13.200 --> 00:12:15.879
<v Speaker 1>time power apps updates its rendering engine, your styled grid

216
00:12:15.919 --> 00:12:19.960
<v Speaker 1>becomes a Picasso composition. Columns evaporate, filter's misbehave, and hovering

217
00:12:20.000 --> 00:12:23.120
<v Speaker 1>over a label triggers existential dread. Then comes the double

218
00:12:23.159 --> 00:12:26.399
<v Speaker 1>generation problem. Users assume GPT five will respect their manual

219
00:12:26.399 --> 00:12:29.679
<v Speaker 1>code tweaks when regenerating it doesn't. The agent rewrites with

220
00:12:29.759 --> 00:12:34.159
<v Speaker 1>cheerful indifference, overwriting some variables, leaving others, producing franken code

221
00:12:34.159 --> 00:12:36.879
<v Speaker 1>that half works. The brand new code compare view becomes

222
00:12:36.919 --> 00:12:39.879
<v Speaker 1>a Morgue report, red and green lines, chronicling the slow

223
00:12:39.919 --> 00:12:43.919
<v Speaker 1>decomposition of one's stable behavior. AI and human fight silently

224
00:12:43.919 --> 00:12:46.720
<v Speaker 1>over control of the same file, each confident it knows best.

225
00:12:47.039 --> 00:12:49.399
<v Speaker 1>Imagine a simple change, adding a filter to show only

226
00:12:49.480 --> 00:12:54.279
<v Speaker 1>enabled users. AI does its rewrite, preserving earlier modifications when possible,

227
00:12:54.320 --> 00:12:58.440
<v Speaker 1>And somewhere in that vague phrase lies disaster. Perhaps you

228
00:12:58.519 --> 00:13:00.879
<v Speaker 1>renamed a constant or wrapped lock loic in a new hook.

229
00:13:01.080 --> 00:13:04.679
<v Speaker 1>GPT doesn't pass intent, It pattern matches strings. The outcome

230
00:13:04.759 --> 00:13:08.360
<v Speaker 1>is familiar in visible breakage, visible embarrassment. A weekday merges

231
00:13:08.639 --> 00:13:12.159
<v Speaker 1>into a lost week end of debugging conversationally generated nonsense

232
00:13:12.600 --> 00:13:15.759
<v Speaker 1>data verse adds its own sabotage via schema, drift tables,

233
00:13:15.759 --> 00:13:20.879
<v Speaker 1>evolve columns, renamed, relationships restructured. Low code handled those changes automatically.

234
00:13:21.279 --> 00:13:24.080
<v Speaker 1>Your detached React page doesn't know this evolution happened. It

235
00:13:24.159 --> 00:13:27.440
<v Speaker 1>still calls user email, but the field became primary email.

236
00:13:27.559 --> 00:13:31.000
<v Speaker 1>The result empty grids, silent errors, chaos disguise as functionality,

237
00:13:31.320 --> 00:13:35.000
<v Speaker 1>and because the bug isn't syntax level, nothing crashes. The

238
00:13:35.000 --> 00:13:39.159
<v Speaker 1>page just lies convincingly. Upgrading power apps once meant excitement.

239
00:13:39.240 --> 00:13:41.799
<v Speaker 1>Now it's Russian roulette. Each new release could obsolete one

240
00:13:41.840 --> 00:13:44.399
<v Speaker 1>of your imports or break a binding that AI invented

241
00:13:44.399 --> 00:13:46.320
<v Speaker 1>months ago. The only way to test safety is to

242
00:13:46.360 --> 00:13:49.600
<v Speaker 1>open code, compare, and pray there's nothing read. Some organizations

243
00:13:49.600 --> 00:13:54.360
<v Speaker 1>already lock environments to frozen versions, trading progress for survival. Congratulations,

244
00:13:54.360 --> 00:13:57.799
<v Speaker 1>you've recreated legacy SharePoint customization. But shinier. Here's where the

245
00:13:57.840 --> 00:14:01.679
<v Speaker 1>humor kurdles. Microsoft build generated pages to accelerate development, but

246
00:14:01.759 --> 00:14:04.879
<v Speaker 1>quietly equipped power apps with code forensics instead of new features.

247
00:14:04.960 --> 00:14:08.440
<v Speaker 1>That's not confidence, that's crisis management. When a platform invents

248
00:14:08.480 --> 00:14:12.039
<v Speaker 1>tools for diffing your creative freedom, it's admitting loss of control.

249
00:14:12.159 --> 00:14:16.200
<v Speaker 1>Even styling choices become volatility engines. Remember that lighter orange

250
00:14:16.240 --> 00:14:19.399
<v Speaker 1>grid stripe. Each color hex you replace can trigger cascading

251
00:14:19.399 --> 00:14:22.919
<v Speaker 1>diffs through CSS. In JS bindings, one user's vanity change

252
00:14:22.919 --> 00:14:25.919
<v Speaker 1>becomes another's runtime error. The new orange theme might compile

253
00:14:26.000 --> 00:14:28.799
<v Speaker 1>locally but fail in production because the updated material u

254
00:14:28.799 --> 00:14:32.120
<v Speaker 1>I theme no longer exposes that variable. This isn't creative expression.

255
00:14:32.120 --> 00:14:35.799
<v Speaker 1>Its artisanal chaos at scale. And let's not ignore patch roulette.

256
00:14:35.919 --> 00:14:38.480
<v Speaker 1>The moment a data verse or entra update collides with

257
00:14:38.519 --> 00:14:41.600
<v Speaker 1>your ungoverned logic role based access change slightly, your hard

258
00:14:41.600 --> 00:14:44.720
<v Speaker 1>coded condition still assumes the old object path. Now half

259
00:14:44.759 --> 00:14:46.840
<v Speaker 1>your users can't load the page and the other half

260
00:14:46.879 --> 00:14:50.879
<v Speaker 1>can see everyone's data. Fixing it requires pouring over AI

261
00:14:51.039 --> 00:14:56.240
<v Speaker 1>generated conditionals that nobody wrote intentionally. Collectively, these failures reveal

262
00:14:56.240 --> 00:14:59.080
<v Speaker 1>the fundamental truth. The low code safety net isn't broken.

263
00:14:59.240 --> 00:15:02.080
<v Speaker 1>It's gone. The guarded runtime that once insulated you from

264
00:15:02.120 --> 00:15:05.519
<v Speaker 1>open source entropy has been replaced with privileged escalation on demand.

265
00:15:05.879 --> 00:15:07.919
<v Speaker 1>You used to build within a secure toy box, Now

266
00:15:07.919 --> 00:15:10.320
<v Speaker 1>you've been handed a chainsaw with a smiley sticker. At

267
00:15:10.320 --> 00:15:14.240
<v Speaker 1>this point, prevention is fantasy. The architecture encourages divergence faster

268
00:15:14.320 --> 00:15:17.759
<v Speaker 1>than governance can respond. Microsoft's patching schedule can't account for

269
00:15:17.799 --> 00:15:21.320
<v Speaker 1>thousands of citizen altered react branches, each mutating independently like

270
00:15:21.399 --> 00:15:24.399
<v Speaker 1>digital species. The code compare feature isn't a safeguard, it's

271
00:15:24.399 --> 00:15:27.720
<v Speaker 1>an archaeological tool for future incident response. So the next

272
00:15:27.720 --> 00:15:31.200
<v Speaker 1>time an enthusiastic manager asks if generative pages empower the business,

273
00:15:31.559 --> 00:15:35.600
<v Speaker 1>answer carefully yes, they empower it to inherit unbounded liability.

274
00:15:36.039 --> 00:15:39.159
<v Speaker 1>The glamour of AI coded freedom conceals a maintenance nightmare

275
00:15:39.159 --> 00:15:42.519
<v Speaker 1>where every grid, color and import might detonate tomorrow. At

276
00:15:42.519 --> 00:15:46.360
<v Speaker 1>this point, prevention is impossible. Only containment remains, containing the

277
00:15:46.440 --> 00:15:49.639
<v Speaker 1>chaos governance in a post low code world. Let's be pragmatic.

278
00:15:49.720 --> 00:15:51.720
<v Speaker 1>The horse has left the stable, burned the barn, and

279
00:15:51.799 --> 00:15:55.200
<v Speaker 1>is currently generating JSX in your production environment. Rolling back

280
00:15:55.240 --> 00:15:59.120
<v Speaker 1>generative pages isn't an option. Managing their fallout is. Microsoft

281
00:15:59.120 --> 00:16:01.799
<v Speaker 1>won't revoke the feature. It's too shiny for marketing to surrender,

282
00:16:01.840 --> 00:16:05.080
<v Speaker 1>So governance must adapt from prevent to contain the new

283
00:16:05.080 --> 00:16:08.720
<v Speaker 1>Discipline isn't about stopping chaos, it's about quarantining it. Containment

284
00:16:08.720 --> 00:16:12.440
<v Speaker 1>starts with three rules. Isolate, review, restrict think of them

285
00:16:12.440 --> 00:16:15.759
<v Speaker 1>as bio hazard procedures for code exposure. Rule one isolate

286
00:16:15.799 --> 00:16:18.440
<v Speaker 1>and elevate. The moment a maker clicks edit code, that

287
00:16:18.519 --> 00:16:20.879
<v Speaker 1>app ceases to be a low code artifact. It's now

288
00:16:20.919 --> 00:16:23.759
<v Speaker 1>a software project and must live in a developer environment.

289
00:16:23.799 --> 00:16:27.039
<v Speaker 1>With proper life cycle management, you wouldn't store a radioactive

290
00:16:27.039 --> 00:16:29.879
<v Speaker 1>isotope in the breakroom. Don't let edited react pages sit

291
00:16:29.919 --> 00:16:32.279
<v Speaker 1>in the same tenant as citizen apps. Move them to

292
00:16:32.320 --> 00:16:34.919
<v Speaker 1>a pro dev workspace where visual designers fear to tread,

293
00:16:34.919 --> 00:16:38.440
<v Speaker 1>attach version control, and track dependencies like adults. Low code

294
00:16:38.440 --> 00:16:41.559
<v Speaker 1>governance tools can't validate dependencies or run unit tests, but

295
00:16:41.639 --> 00:16:45.960
<v Speaker 1>DevOps pipelines can. Elevating contaminated apps isn't punishment, it's cleanup.

296
00:16:46.360 --> 00:16:50.000
<v Speaker 1>Rule two review gate. Every modified page, whether changed by

297
00:16:50.039 --> 00:16:53.279
<v Speaker 1>a human or the AI agent, needs continuous inspections. Establish

298
00:16:53.320 --> 00:16:57.440
<v Speaker 1>an approval gate that mimics enterprise CIICD, run eres lint,

299
00:16:57.600 --> 00:17:01.240
<v Speaker 1>dependency scanners, and static code analysers before republishing. If that

300
00:17:01.279 --> 00:17:04.799
<v Speaker 1>sounds excessive for citizen development, good that means you remember

301
00:17:04.799 --> 00:17:07.960
<v Speaker 1>what discipline looks like. Microsoft's own update cadence will collide

302
00:17:07.960 --> 00:17:11.000
<v Speaker 1>with your code eventually. Linting infrastructure gives you a fighting

303
00:17:11.079 --> 00:17:14.839
<v Speaker 1>chance to notice before users do. Remember if everything compare

304
00:17:14.880 --> 00:17:17.720
<v Speaker 1>not just for syntax, but for intent. An unreviewed AI

305
00:17:17.799 --> 00:17:20.839
<v Speaker 1>patch is indistinguishable from a supply chain exploit. Rule three

306
00:17:20.920 --> 00:17:23.279
<v Speaker 1>one way door policy. Once code is edited, it never

307
00:17:23.319 --> 00:17:26.839
<v Speaker 1>returns to the garden. No regenerating it back into declarative metadata.

308
00:17:27.200 --> 00:17:30.480
<v Speaker 1>No just undoing the pro code status. Lock the file

309
00:17:30.480 --> 00:17:34.440
<v Speaker 1>and taget as independently maintained. This establishes accountability. When it breaks,

310
00:17:34.480 --> 00:17:36.799
<v Speaker 1>and it will, you'll already know who owns the problem.

311
00:17:37.119 --> 00:17:39.799
<v Speaker 1>It's the digital equivalent of labeling your lunch in the

312
00:17:39.799 --> 00:17:43.200
<v Speaker 1>office fridge to avoid mysterious disappearances. These three rules don't

313
00:17:43.240 --> 00:17:46.799
<v Speaker 1>restore purity, but they define boundaries in a hybrid ecosystem

314
00:17:46.880 --> 00:17:50.160
<v Speaker 1>that's lost them. Treat every generative page as a separate species,

315
00:17:50.200 --> 00:17:54.799
<v Speaker 1>requiring controlled habitat. Pro def environments become fenced preserves where

316
00:17:54.880 --> 00:17:58.240
<v Speaker 1>mutated apps can evolve without infecting your stable population of

317
00:17:58.279 --> 00:18:02.640
<v Speaker 1>classic power apps. Its evolutionary containment via environment segmentation, a

318
00:18:02.680 --> 00:18:06.480
<v Speaker 1>concept familiar to anyone managing cloud tenants or frankly zoo exhibits.

319
00:18:06.599 --> 00:18:09.400
<v Speaker 1>Now to the cultural problem. Business users still believe code

320
00:18:09.519 --> 00:18:14.079
<v Speaker 1>editing equals empowerment. Disabuse them gently but firmly. Governance is maturity,

321
00:18:14.240 --> 00:18:19.480
<v Speaker 1>not micromanagement. Enforcing reviews and segregating edited apps doesn't cage creativity.

322
00:18:19.599 --> 00:18:23.079
<v Speaker 1>It saves continuity. The irony of low codes evolution is

323
00:18:23.119 --> 00:18:26.720
<v Speaker 1>that it brings enterprises full circle back to software engineering fundamentals.

324
00:18:26.759 --> 00:18:30.480
<v Speaker 1>They once escaped, version control, least privileged, code review, old

325
00:18:30.559 --> 00:18:34.480
<v Speaker 1>rituals reborn under pastel ux. And remember the sarcasm baked

326
00:18:34.480 --> 00:18:38.200
<v Speaker 1>into this transformation. You clicked edit code, Congratulations, you own

327
00:18:38.279 --> 00:18:42.119
<v Speaker 1>it now. Ownership means maintenance, monitoring, patching, documentation, the boring

328
00:18:42.160 --> 00:18:46.119
<v Speaker 1>work necessary to keep lights on. Pretending otherwise just ensures overtime. Later,

329
00:18:46.480 --> 00:18:49.920
<v Speaker 1>what once felt like spontaneous automation now demands structured operations.

330
00:18:50.000 --> 00:18:52.880
<v Speaker 1>That's not failure, that's recognition of scale. Still, this shift

331
00:18:52.920 --> 00:18:56.519
<v Speaker 1>is worth something valuable. When governance catches up, organizations gain

332
00:18:56.559 --> 00:19:00.240
<v Speaker 1>a bifurcated ecosystem that reflects reality instead of fantasy. Low

333
00:19:00.240 --> 00:19:04.000
<v Speaker 1>code site delivers agility for safe configurations. The pro code branch,

334
00:19:04.119 --> 00:19:08.079
<v Speaker 1>fenced and audited handles customization beyond Microsoft's reach. The chaos

335
00:19:08.079 --> 00:19:11.559
<v Speaker 1>becomes predictable. The liabilities mapped. That's the maturity arc of

336
00:19:11.599 --> 00:19:16.920
<v Speaker 1>all technology. Exuberant adoption painful consequences. Then, principled governance. Power

337
00:19:16.920 --> 00:19:19.920
<v Speaker 1>apps isn't dying, it's being reclassified. What was once no

338
00:19:20.079 --> 00:19:24.119
<v Speaker 1>code now spans from descriptive to imperative, from playground to

339
00:19:24.200 --> 00:19:27.759
<v Speaker 1>factory flaw. Enterprises that adapt policy faster than makers break

340
00:19:27.759 --> 00:19:31.000
<v Speaker 1>features will survive this generative adolescence with minimal scarring. Those

341
00:19:31.000 --> 00:19:33.440
<v Speaker 1>who don't will discover what technical debt feels like when

342
00:19:33.480 --> 00:19:36.240
<v Speaker 1>multiplied by AI enthusiasm. Because this isn't the death of

343
00:19:36.319 --> 00:19:41.920
<v Speaker 1>power apps, it's its reclassification. The reality Microsoft created generative

344
00:19:41.960 --> 00:19:46.160
<v Speaker 1>pages didn't enhance power apps. They dismantled its illusion of safety.

345
00:19:46.240 --> 00:19:49.839
<v Speaker 1>By bridging low code and pro code, Microsoft accidentally vaporized

346
00:19:49.880 --> 00:19:53.079
<v Speaker 1>the border that kept novice makers from detonating production environments.

347
00:19:53.279 --> 00:19:56.119
<v Speaker 1>The result is a platform where every prompt can generate

348
00:19:56.200 --> 00:20:00.279
<v Speaker 1>beauty or liability at scale. The grand moral power without

349
00:20:00.279 --> 00:20:04.240
<v Speaker 1>governance breeds breakage. Microsoft democratized innovation, yes, but it also

350
00:20:04.240 --> 00:20:08.079
<v Speaker 1>democratized the blast radius. Click edit code and you inherit

351
00:20:08.119 --> 00:20:11.839
<v Speaker 1>the complexity entire teams once handled. Locode wasn't built to

352
00:20:11.880 --> 00:20:14.119
<v Speaker 1>carry that weight yet Now every user drags it behind

353
00:20:14.119 --> 00:20:16.759
<v Speaker 1>their prompts like a forgotten anchor. So treat every new

354
00:20:16.799 --> 00:20:20.039
<v Speaker 1>feature less like magic and more like chemistry. Powerful volatile

355
00:20:20.079 --> 00:20:24.359
<v Speaker 1>requiring goggles. Adopt containment policies, automate reviews, label ownership, or

356
00:20:24.359 --> 00:20:27.640
<v Speaker 1>prepare for the next AI written patch to helpfully rewrite

357
00:20:27.640 --> 00:20:31.119
<v Speaker 1>your security posture or worse your job description. If this

358
00:20:31.200 --> 00:20:35.000
<v Speaker 1>clarified the mess, repay the sanity, subscribe, turn on notifications

359
00:20:35.000 --> 00:20:38.599
<v Speaker 1>before GBT six releases and starts generating governance policies on

360
00:20:38.640 --> 00:20:41.599
<v Speaker 1>your behalf. Better to learn them here first, voluntarily