The Wall Nobody Meant to Build

Last week, I kept getting logged out of Slack on both my phone and my laptop. It was getting annoying. I went to get some coffee, and when I came back I found my Windows account disabled, and my supervisor and one of my direct reports had been notified.

I hadn't done anything wrong. I was trying to get my own data.

Mine to read, not to pull

For about a month I've been working on a personal AI project. Nothing exotic. Analysis I'd do anyway — on my own work, my own business, my own productivity — except properly, at scale, with the AI doing the rote work of pulling patterns out of a mountain of text.

To do that, I needed data. A lot of it. And not in a browser tab — in a format the AI could actually use.

All of this data is data I'm allowed to have. Read, copy, print, forward, search — I can do any of it, one record at a time, inside the sanctioned interfaces. But in bulk, in a format I can feed to an AI? Locked down. No internal API access for this kind of thing. Not out of malice. By default. So I started the workarounds.

Email first. Days of running a Google Script that parsed my mailbox 100 threads at a time until it hit the daily API limit, then resuming the next morning. About 800 Google Docs next — bulk-converted to Office formats through another script. Then Slack, which is the one that locked me out. Then scraping a Tableau dashboard because I couldn't query the warehouse behind it.

The UI was the rate limit

The access-control framework in most big companies was built for a world where humans used interfaces and software used APIs. Humans were self-limiting. You can only click so fast, read so much, copy so much, before someone notices or your hands give out. The interface was the governor. You weren't going to exfiltrate 800 documents through the Docs viewer because you'd be at it for a week.

APIs were the other thing. APIs were what integrations used. APIs were also what malware used if it got hold of your credentials. So API access got locked down against a pre-AI threat model — credential compromise plus bulk exfiltration equals a very bad afternoon for someone. Closed by default. Case-by-case exceptions. The policy made sense. It still makes sense until the guardrails get recalibrated.

The thing is — the risk of big amounts of precious data getting sucked in bulk by a bad actor is still real. But in this rapidly emerging work shift, a human with an AI, trying to do analysis they're already permitted to do, needs API-shaped access to the data they already have sanctioned UI access to. Our internal policies, systems, and budgets need to account for both truths, ASAP.

The human-versus-software line the policy was drawn along has dissolved. I'm still the human. The AI is my assistant. The data is still mine to see. I'm obligated to use that data to maximize value for our customers, shareholders, and team members.

The system hasn't caught up to that. So people like me are cutting our own paths.

Access is efficient

The old controls made sense. They still do, mostly. They were written when nobody was trying to feed a company's data into an AI, so closing the pipe was the right call — nobody needed it open, and leaving it open created real risk.

What's changed isn't whether those risks matter. They still do. What's changed is that there's a cost on the other side of the ledger now — one nobody could see back when the rules were written, because the work itself didn't exist yet.

When someone tries to do AI-assisted analysis on their own work, the workaround has a price tag. Time spent writing little scripts to pull the data out piece by piece. Time spent cleaning up what comes through messy. Sessions that log out and have to be restarted. Security alerts the team has to chase down.

And then there's the AI cost itself. Every word the AI reads costs something — those are tokens, the unit AI models charge by. The workaround path produces a bigger, messier pile of data than a clean pull would. So the AI reads more, costs more, and — because it's wading through a lot of noise — gives answers that aren't as sharp as they could be. More money spent for worse output.

A proper internal version — even one with tighter controls than most — could actually be easier on everyone. Less scrambling for the person doing the work. Fewer false alarms for the security team. A clearer record of what happened. And a meaningfully smaller AI bill at the end of the month.

The old controls aren't the problem. There's just a new set of costs showing up, and we haven't accounted for them yet.

Quiet collisions

This is what paradigm shifts look like, close up. Not drama — a series of quiet collisions between how things were built and how things are now done. UI versus API. Human versus software. Friction as control. Access as permission. Each of those made sense in the world they were built for. None of them fit cleanly on a knowledge worker with an AI assistant trying to do their actual job.

The fix isn't to pretend the old rules still apply. The fix is to build the new ones, deliberately, before an incident writes them for us.

For what it's worth — I'm not trying to route around my company. My system tax was intentionally short-lived, and the ROI is going to be felt. I want the cleanest path. I want the API, the scoped token, the logging, the policy that spells out exactly what's okay. Everything I've done with scripts and scrapes, I'd happily swap for something better.

I am happy to have learned that our IT security folks are both highly vigilant AND very reasonable. But they're like my doctor. Great guy — but I'd rather we never talk. I've got way too many awesome things going on to be sick or walking slow.