A sales manager connects an AI assistant to her inbox so it can draft follow-ups. An engineer gives a coding agent access to a staging database. Someone in finance builds an automation that reads invoices and posts to a vendor portal. Nobody asked IT. Nobody told security. Each person saved an hour a day. That is how shadow AI agents arrive. They come through a helpful afternoon, not a breach. We run a software company, and we speak with CTOs, CIOs, CISOs, COOs, and IT managers every week. The question has changed. Two years ago it was “should we adopt AI?” Now it is “how many AI tools are already running here, and what can they touch?” Most leaders cannot answer the second part. This guide helps you answer it, then act on it. Here is what you will get: how shadow AI agents enter a business, the shadow AI risks that matter, a six-step plan for AI agent security that brings shadow AI agents under control, and a checklist to decide whether you need a formal AI integration and security assessment. What Are Shadow AI Agents? Shadow AI agents are AI tools that read company data or take actions in company systems without approval, ownership or visibility from IT and security. The word “agent” matters. A chatbot answers a question. An agent opens your files, calls other tools, sends messages and changes records, usually under the login of the employee who set it up. That gap between answering and acting is why shadow AI agents need their own plan, separate from the old shadow IT playbook. A rogue spreadsheet sits still. Shadow AI agents keep working at 3 a.m. with permissions nobody reviewed. Classic shadow IT Shadow AI agents What it does Stores or moves data Reads, decides and acts on data Access One app, one login Many apps through connected accounts Visibility Shows up in software lists Often invisible to software lists Spread Slow, needs installs Fast, one click or one API key Failure mode Data sits in the wrong place Wrong action runs at machine speed The scale of shadow AI agents is larger than most leaders assume. Reco’s State of Agent Security 2026 report found that about 80% of the AI tools in its telemetry operated without IT oversight, and that small and mid-size companies averaged 414 unsanctioned AI tools per 1,000 employees. IBM’s 2025 Cost of a Data Breach report found that one in five breached organisations had a breach involving shadow AI, and that it added roughly $670,000 to breach costs. Treat these as directional numbers, since methods differ between studies. The direction is still clear. How Shadow AI Agents Enter Your Organisation Most shadow AI agents do not come from bad intent. They come from pressure to move faster than approved tooling allows. When the official route takes six weeks and a free tool takes six minutes, people pick the free tool. Entry route What it looks like Why it slips through Personal AI accounts An employee pastes a contract into a personal chatbot Runs in a browser, nothing to install Browser extensions and meeting bots A note-taker joins calls and stores transcripts externally One-click install with broad permissions OAuth connections “Sign in with Google” gives an AI app read access to mail and Drive Looks like a normal login Low-code automation A team builds workflows with AI steps in Zapier, Make or n8n Business users own them, IT never sees them Developer tooling Coding agents and MCP servers wired to repos and databases Engineers treat them as personal tools AI inside approved SaaS A CRM or helpdesk switches on an AI feature by default A vendor update changes behaviour overnight Look at the pattern. None of these routes needed a purchase order, and none triggered a security review. Shadow AI agents grow in the space between how fast teams want to work and how fast governance can respond. Shadow AI Risks Leaders Should Take Seriously The shadow AI risks that come with shadow AI agents fall into a few groups. Each one links to a business outcome you already track: revenue, trust, audit results and downtime. Risk What happens Business impact Data exposure Customer, financial or source code data leaves your control Contract breaches, loss of client trust Excess permissions An agent holds read and write access it never needed A small mistake becomes a large one Unreviewed actions An agent sends emails, edits CRM records or triggers payments Errors reach customers before anyone notices Compliance gaps Personal data flows through tools with no data agreement Trouble under GDPR, India’s DPDP Act or client contracts Orphaned agents The creator leaves, the connection stays active A live access path with no owner Prompt injection A poisoned document or web page tells the agent what to do An outsider steers your agent AI agent security is mostly an identity problem. Every one of the shadow AI agents borrows an identity, either a person’s login or a service key, and then acts with it. If you cannot list those identities, you cannot say who or what is acting inside your systems. Three practical points about shadow AI agents follow from that: Enterprise AI governance exists to fix exactly this. It gives every agent a name, an owner, a purpose and a permission set. Without it, shadow AI agents decide your risk profile for you. The Six-Step Plan to Find and Control Shadow AI Agents Banning AI does not work. People route around bans and shadow AI agents move further out of sight. The aim is visibility first, then control, then a sanctioned path for the work people are already trying to do. Here is the plan at a glance. Step Question it answers Output 1. Discover Where are shadow AI agents running? Raw list of tools, accounts and connections 2. Inventory What exactly is each one? One register with owner and purpose 3. Classify How risky is each one? Risk tier per agent 4.
Your platform just closed its biggest month. Trade count is up, registered accounts are up, and the board deck looks healthy. Then the CFO asks one plain question: “What do we keep from the average trade after everything it costs us to complete it?” Nobody in the room has a number. That silence is the problem. Carbon platform unit economics is the profit or loss on one unit of activity: one trade, one account, one tonne of CO₂e moved. Most carbon platforms are priced and built without it. Revenue climbs because volume climbs. Margin shrinks because cost per trade climbs faster than anyone measured. Read this if: you are a founder, CEO, or CFO planning or running a carbon exchange, marketplace or brokerage, you earn a take rate or a subscription, and you cannot yet state your contribution margin per trade in one number. Why Carbon Platform Unit Economics Differ From Any Other Marketplace Generic marketplace advice tells you to track take rate, acquisition cost, lifetime value, and contribution margin. That advice is right and incomplete. A carbon platform carries cost lines a normal marketplace never meets. A product marketplace ships a parcel. A carbon platform must prove that one serial-numbered credit was genuine, unretired, eligible for the buyer’s use, and correctly transferred. That proof costs money on every trade. The cost drivers that surprise teams most: None of these appear as a line in the first financial model. All of them appear in month eight. The Three Units of Carbon Platform Unit Economics “Unit” is not one thing on a carbon platform. Pick the wrong one and the model lies to you. Unit What it measures Best question it answers Common mistake Trade Revenue and cost of one completed transaction Do we make money when someone trades? Using average ticket size and ignoring the spread between small and large trades Account Lifetime contribution of one onboarded buyer, seller or broker Is acquiring and keeping this customer worth it? Counting signups instead of accounts that actually trade Credit (tCO₂e) Cost to issue, hold, move and retire one tonne Where does cost scale with volume of carbon, not trades? Ignoring that cost per tonne falls with big tickets but rises with fragmented ones Start your carbon platform unit economics model with the trade. It is the unit closest to cash, and it exposes most of the leaks. The Contribution Stack: What One Trade Actually Earns This stack is the working core of carbon platform unit economics. Think of a trade as a stack. Revenue sits on top. Each variable cost takes a slice. What remains is contribution, the money that pays for your fixed team, office, and roadmap. Layer Line Who usually owns it Revenue Take rate, listing fee, retirement fee, data fee Founder / CFO Variable cost 1 Payment and settlement rails, FX CFO Variable cost 2 Registry API calls and status sync CTO Variable cost 3 KYC/KYB checks, amortised per account Compliance / CFO Variable cost 4 Compute, storage, audit-log retention CTO Variable cost 5 Reconciliation exception handling Operations / CTO Variable cost 6 Customer support per trade Operations Contribution What is left per trade Everyone Two things stand out. First, no single person owns the whole stack, which is why it goes unmeasured. Second, the CTO controls more of it than the P&L suggests. Architecture decisions made in month one decide the size of those slices in year two. Alt text: Stacked diagram showing carbon platform unit economics, with revenue per trade reduced by six variable costs down to contribution. A Carbon Platform Unit Economics Example: Revenue Up, Margin Down The numbers below are illustrative. They show the method, not your results. Assume an average ticket of $15,000 and three customer segments with different negotiated take rates. Segment Take rate Revenue per trade Variable cost per trade Contribution Margin Aggregators and project developers 1.5% $225.00 $95.00 $130.00 58% Institutional buyers 0.5% $75.00 $62.00 $13.00 17% Anchor strategic buyer 0.25% $37.50 $50.00 -$12.50 -33% Now mix them: 30% of trades from aggregators, 50% institutional, 20% from the anchor buyer. Assume fixed monthly costs of $60,000. Break-even is about 1,400 trades a month. Here is the trap in these carbon platform unit economics. The anchor buyer is the one your sales team celebrates, because they bring volume and a logo. Every trade they add loses money. If that segment grows from 20% to 40% of trades while the others shrink proportionally, revenue per trade falls and break-even moves further away, even as your headline volume hits a record. That is the pattern behind “we are growing but not getting richer.” Carbon platform unit economics would have flagged it before the contract was signed. What Your CFO Needs vs What Your CTO Must Deliver Most founders get stuck because finance and engineering use different vocabularies. Translate them. Decision The CFO needs The CTO must deliver Pricing Margin per trade by customer segment A fee engine that supports tiered, per-segment and per-registry rates without code changes Forecasting Cost per trade at 10x volume Cost tagging on every event, so cost can be traced to the trade that caused it Cash control Net settlement amounts, not gross Settlement logic that records FX, bank and rail fees against each trade Risk Exception cost and error exposure Automated reconciliation against registries, with exceptions queued and measured Roadmap Which feature protects margin A cost-per-trade dashboard that ranks engineering work by money saved Strong carbon platform unit economics need both columns filled in. If your CFO cannot get the left column, the CTO cannot prioritise the right column. They are one problem described twice. Five Architecture Decisions That Shape Carbon Platform Unit Economics From Day One Cost per trade is partly a market outcome and partly a design choice, so your carbon platform unit economics are partly in your engineers’ hands. These five choices move it most. None of this needs a bigger budget. It needs to be decided before the first line of settlement code
A practical look at AI MVP development for startup founders who want speed without losing control of what gets built. You typed a prompt. Twenty minutes later, you had a working app. A signup flow, a dashboard, a payment button that actually charges cards. It felt like magic, and for a weekend hackathon or a pitch deck demo, it was. Then you got your first fifty real users. And the app started doing things nobody asked it to do. Welcome to the part of AI MVP development nobody puts in the demo video. This is the story behind almost every AI MVP development project we get called in to fix. Not because the AI failed. Because nobody was actually responsible for what it built. The Problem: Speed Without a Second Owner Founders love AI MVP development for one honest reason: it removes the two things that used to gate every startup idea, time and money. What once needed a technical co-founder and eight weeks now needs a prompt and an afternoon. Tools like Lovable, Bolt, Replit Agent, and Cursor have made “just build it with AI” a legitimate first move, not a shortcut for people who can’t code. But here’s what founders discover a few months in, usually at the worst possible time: None of this shows up during the AI MVP development demo, while you’re pitching to five friendly beta users. It shows up the day your app gets covered somewhere, or a paid ad campaign sends real traffic, or an investor asks for a security review before writing a check. The real question isn’t “can AI build my MVP.” It clearly can. The real question is: when it breaks, who fixes it, and who’s even allowed to? Why the Obvious Fix Fails The obvious response is “just hire a developer to take over.” This is where most founders doing AI MVP development lose months instead of weeks. Handing an AI-generated codebase to a new developer is not the same as handing them a codebase a human engineer designed with intent. A human engineer leaves a trail: architecture decisions, comments explaining tradeoffs, a reason the folder structure looks the way it does. AI-assisted output optimizes for “does this prompt’s request work right now,” not for “will the next person understand this in six months.” A new developer opening an AI MVP development codebase for the first time typically finds: What They Expect What They Actually Find A consistent data model Three different naming conventions for the same entity Reusable components The same UI logic copy-pasted across twelve files A reason behind each dependency Fifteen packages installed to solve problems that had one-line fixes Documentation or comments None, because the AI never had to explain itself to anyone So the “quick fix” of hiring a developer turns into weeks of reverse-engineering the app before anyone can safely touch it. You end up paying for a rebuild anyway, just later and under more pressure, with paying customers already depending on the thing that’s breaking. There’s also a quieter problem with AI MVP development: ownership itself. Several AI coding platforms hold generated code in ways that make export, IP assignment, or even basic version control murkier than founders expect. If your cap table or your acquirer’s due diligence team ever asks “do you actually own this code, cleanly, with no third-party claim on it,” you want a confident answer, not a scramble. What Actually Needs to Be Solved Strip away the panic and the actual problem with AI MVP development is narrow and solvable. It has three parts: This is the shift founders need to make mentally about AI MVP development: done right, AI MVP development isn’t “let the AI build it and hope.” It’s “use AI to move fast, inside a structure a real engineer is responsible for.” The output looks similar on day one. It looks completely different on day ninety. The Technical and Business Decision Founders Actually Face Every founder doing AI MVP development is really choosing between three paths, whether they realize it or not: Most founders approaching AI MVP development don’t know Path C exists until something breaks. It’s the path that actually matches what a fast-moving startup needs: velocity now, ownership and stability by the time it matters. This is also a business decision about AI MVP development, not just a technical one. The cost of Path A showing up as a production outage during a fundraise, or a security gap during due diligence, is almost always higher than the cost of getting the architecture right the first time. What a Competent Implementation Actually Requires If you want AI MVP development that still ends in something you own and can scale, a few things have to be true from day one: This is the part AI-only tools genuinely cannot do on their own in AI MVP development. They don’t know your growth plan, your compliance requirements, or what an investor is going to ask in six months. A person has to. Common Vendor Mistakes Founders Should Watch For Not every vendor offering AI MVP development is actually equipped to solve this. Some of the most common mistakes we see when founders bring in outside help: Any one of these mistakes turns an AI MVP development success story into a “we got stuck” story. Founders rarely notice until they try to change vendors, raise a round, or scale past their first few hundred users. What to Check Before You Hire Anyone Before you hand your AI MVP development project, or your next AI-assisted build, to any outside team, ask these directly: If a vendor can’t answer these clearly and specifically, they’re not equipped for AI MVP development that survives contact with real users. They’re equipped to make a demo. How Techaroha Approaches This We’ve been building custom software for over a decade, and AI MVP development has been part of how we work for years, not a pivot we made when it became trendy. The difference
A compliance buyer at an international airline opens your platform, filters for Article 6.4-eligible inventory, and clears an order against a lot of what your database calls “available credits.” Forty minutes later, the host country’s national authority issues a Letter of Authorization on a completely unrelated administrative timeline, and the units the airline just bought quietly stop being what they were sold as. The row in your ledger didn’t change. The legal reality underneath it did. This is not a hypothetical edge case dreamed up for a conference panel. It is the structural consequence of how the Paris Agreement Crediting Mechanism (PACM) actually works, and it is the single most under-engineered problem in carbon market software right now. Any platform still treating credits as flat, static rows is building on a foundation that the regulation itself has already made obsolete. What every serious exchange, registry, and compliance desk needs instead is a carbon credit state machine architecture, and almost nobody has one. Why a Single Credit Now Has Two Legal Identities Under Article 6.4, a project doesn’t just issue “carbon credits.” It issues Article 6.4 Emission Reductions, or A6.4ERs, and those units arrive in one of two legal states. If the host country has not authorized a unit for international use, it is issued and held as a Mitigation Contribution Unit (MCU) usable domestically, for results-based climate finance, or for a country’s own NDC, but legally barred from crossing a border for compliance purposes. If the host country has authorized the unit and applied a corresponding adjustment, it becomes an Authorized Emission Reduction (AER), eligible to move internationally and clear against schemes like CORSIA. Here is the part that breaks flat databases: a unit issued as an MCU is not permanently an MCU. Host countries can grant retroactive authorization, and the moment they do, that unit’s legal identity flips – it stops being a domestically-contained MCU and becomes an internationally transferable AER, provided it hasn’t already been transferred out of the mechanism registry. The reverse containment rule matters just as much: MCUs remain confined to transactions within the mechanism registry until that authorization event happens. A platform’s asset ledger is not looking at one static object. It’s looking at a unit with a lifecycle, governed by a decision made by a national authority on a timeline your engineering team does not control and often can’t even observe in real time. This is exactly why a carbon credit state machine architecture has to be the starting assumption for any exchange handling Article 6.4 inventory, not a feature bolted on after the first compliance incident. The Structural Problem: What Happens When Your Ledger Treats Credits as Fungible Rows Picture the default approach most platforms take, because it’s the same approach that has worked fine for years of pre-Article-6 voluntary credits: a table with a credit ID, a project reference, a vintage, a quantity, and a status column that says “available,” “retired,” or “sold.” Fungible. Flat. Fast to query. Now put an MCU into that table. The status column says “available.” A compliance buyer, say, an airline covering CORSIA obligations – filters inventory, sees the lot, and clears the trade. Nothing in the schema stopped this, because nothing in the schema knew the difference between an MCU and an AER in the first place. The airline has now taken legal ownership of a unit that cannot clear their compliance ledger, because it was never authorized for international transfer at the moment of sale. Nobody committed fraud. The seller may not have even realized the lot hadn’t cleared host-country authorization. The matching engine did exactly what matching engines do: it matched a buy order against available inventory. The failure isn’t behavioral. It’s architectural. A platform without a carbon credit state machine architecture cannot distinguish between an MCU and an AER at the only moment that legally matters: the instant before settlement, because it was never built to track legal state as a first-class property of the asset. This is the exact failure mode regulators are now scrutinizing under anti-greenwashing enforcement regimes. It’s not enough to detect the mismatch after the fact through a reconciliation job. The question examiners are asking exchange operators is whether the platform’s data model made an unauthorized clearing possible in the first place. If the answer is yes, that’s not a footnote. That’s an exposure line item with a compliance buyer’s name attached to it. The Software Architecture Solution: A Conditional State-Machine Pattern for the Asset Ledger The fix is not a better compliance checkbox, and it’s not a nightly reconciliation batch that tells you about a mismatch twelve hours after it already cleared. The fix is redesigning the asset ledger so that a unit’s authorization status is a governed state, not a display label. This is the core of a functioning carbon credit state machine architecture. Here’s the shape of it, stripped to its engineering bones. Why “Just Add a Status Filter” Doesn’t Solve This The tempting shortcut here is the same one platforms reached for with dual-claiming risk: add a filter on the front end so buyers “should” only see eligible inventory, and add an attestation checkbox at checkout confirming the buyer understands the unit’s authorization status. This does almost nothing, for the same reason it never works elsewhere. A front-end filter is a display convenience, not an architectural guarantee; it doesn’t stop an API call, an internal admin override, or a race condition where a unit’s status changes between page load and order submission from clearing an ineligible trade anyway. An attestation checkbox shifts liability onto a buyer’s understanding of a UN mechanism most corporate procurement teams have never had to parse line by line. Neither approach constitutes a carbon credit state machine architecture. Both are policy dressed up as engineering, and regulators evaluating anti-greenwashing controls are no longer satisfied by the distinction between “we tell the buyer” and “we structurally prevent the mismatch.” They’re asking whether the platform’s asset ledger could have allowed this trade
