Abstract

A Unified Socio-Technical Framework for Governing Shadow AI, Vibe Coding and Cognitive Security

The democratization of artificial intelligence has opened two fronts at once. Software synthesis is moving from deterministic, localized syntax assistance (IDE autocomplete) to stateful, autonomous ecosystems (vibe orchestration), while beneath official programmes a parallel ecosystem of grassroots shadow AI is growing — unsanctioned tools, models and agents embedded directly into daily work. Both shifts render perimeter-based AppSec and static governance obsolete, and punitive bans consistently fail, driving usage further underground onto personal devices.

This paper unifies two strands of the author’s research into a single dual-axis framework. On the technical axis it presents an open intake register, SASE-enabled Enterprise AI Gateways, semantic caching, tiered cognitive guardrails, agile LLMOps and a Cognitive Security Stack built on Least-Context Access Control (LCAC). On the social axis it shows that inclusive leadership — through positive error management, psychological safety and psychological empowerment — is the catalyst that makes the pipeline work. Both axes are anchored in an integrated governance matrix spanning ISO/IEC 27001:2022, ISO/IEC 42001:2023, ISO 22301:2019, ISO 45003:2021 (guidance within ISO 45001:2018) and the NIST AI RMF 1.0 (2023).

• Keywords. Shadow AI; vibe coding; vibe orchestration; SASE; AI gateway; cognitive guardrails; LLMOps; Least-Context Access Control; cognitive security; inclusive leadership; psychological safety; AI governance.