You join the afternoon standup and someone demos a chatbot that already talks to staging data. Token cost looked like zero, so the spike used a free remote model without named owners. You ask who pages if the endpoint starts leaking customer fields, and the room goes quiet. That silence is the real incident, because promotion happened without a written gate on the wiki.
The failure you are actually debugging
A free-tier spike fails in a quieter way than a crashed process or a red deploy. The model answers quickly, the shared host stays up, and reviewers assume someone else classified the data. You later find prompt logs in a world-readable volume, plus an API token inside a notebook. None of those mistakes required advanced attackers, because they only required a missing promotion owner on the wiki.
Name five roles before anyone shares a URL
You should refuse a public demo until these names exist in the wiki, even if the prototype still runs on a laptop. The names can be placeholders, but they cannot be Slack group mentions that nobody reads. If a role is vacant, the gate fails closed, and the spike must stay on a private branch. You are not blocking creativity; you are blocking an implicit production contract that nobody signed.
