An IT director at a mid-sized distribution company got a message last week that would have been unthinkable two years ago: a business analyst on the finance team had built a complete case-management app, tables, forms, a security role, and an approval workflow included, in an afternoon, by describing what she needed in plain English. No developer was involved. No ticket sat in a backlog. The app worked on the first try. The IT director’s reaction was not relief. It was a question nobody on her team could immediately answer: who actually checked what that security role grants access to? The tool behind the app, it turned out, was the newly generally available Power Apps Model App-Builder Skill.
That scenario is no longer hypothetical. Microsoft’s September 2026 Power Platform update confirmed general availability for the Power Apps Model App-Builder Skill, a capability that lets makers use AI coding tools such as GitHub Copilot CLI or Claude Code to generate an entire model-driven app from a natural-language description, including Dataverse tables, forms, views, sitemaps, security roles, business process flows, and business rules. This sits alongside the already-GA generative pages capability, which handles individual pages inside a model-driven app the same way. Put together, the distance between “someone wrote a paragraph describing an app” and “a production business process exists in Dataverse” has collapsed to something close to zero.
For a CIO or IT director already managing a Power Platform footprint, the interesting part isn’t the productivity story. That part is straightforward: fewer requests stuck behind a scarce pool of Dataverse developers, faster turnaround for genuinely simple line-of-business apps, and a natural entry point for citizen developers who previously needed a professional developer just to get a security role configured correctly. The interesting part is what happens between the prompt and the deployment, because Microsoft did build a checkpoint into this workflow. The question worth asking before turning it on broadly is whether that checkpoint checks the things an organization actually needs checked.
What the Power Apps Model App-Builder Skill Actually Generates
The documented workflow follows a pattern Microsoft has used elsewhere in its AI code generation tools for Power Apps: a planner agent reads the natural-language requirement and proposes a plan describing what it intends to build, the maker reviews that plan and can ask for adjustments, the maker confirms once the plan matches intent, and only then do specialized agents generate the artifacts and deploy them. Some workflows in this family include an optional verification pass using automated browser testing before the app goes live. Microsoft’s own guidance is candid about where responsibility lands afterward: the tools make “a best-effort attempt to generate complete, production-ready code with accessibility and security best practices,” but the maker is ultimately responsible for validating what gets produced.
That single sentence is worth sitting with, because it reframes what “the app worked on the first try” actually means. It means the functional description matched. It does not mean the security role’s field-level permissions match the organization’s data classification policy, or that the generated business rule doesn’t create a downstream conflict with an existing plugin, or that the sitemap navigation doesn’t expose a table that shouldn’t be visible to that user’s role. A business analyst confirming a plan in the reviewer step is answering “does this do what I described,” which is a different question from “is this safe to run in production,” and most of the people who will use this tool are, by design, not the people equipped to answer the second question.
Not Every Piece of This Carries the Same Guarantee
There’s a second nuance worth flagging before any organization treats “Model App-Builder Skill: GA” as a blanket green light. The broader family of AI code generation tools for model-driven apps includes capabilities at different maturity levels within the same feature set. Microsoft’s own documentation for the related generative pages capability, for instance, states plainly that connector support for reaching data outside Dataverse is a preview feature, and adds the standard caution that “preview features aren’t meant for production use and may have restricted functionality.” That distinction matters in practice: a maker building a generated page or app that only touches Dataverse tables is working with generally available functionality, while a maker who extends that same generation flow to pull data through a connector has quietly stepped into preview territory without necessarily realizing it, since the interface doesn’t force that distinction on them.
The practical lesson isn’t that this capability is unready. It’s that GA status attached to a feature name in a release announcement doesn’t automatically extend to every path a user can take through that feature. Anyone signing off on a broad rollout should ask, capability by capability, which specific paths are GA and which are still preview, rather than accepting the headline classification at face value.
Where the Business Case Genuinely Holds Up
None of this argues against adopting the capability. The economics are real. Organizations running Power Platform at any scale already carry a backlog of small, well-understood app requests that never justify a professional developer’s time: an approval tracker for a regional office, a case log for a compliance team, an intake form tied to a simple review workflow. These are exactly the apps this tool is suited to generate, and getting them built by the people who understand the business process, without a six-week wait for developer capacity, is a legitimate efficiency gain. The plan-review step, imperfect as a security control, is also a genuine improvement over the alternative most organizations had before AI-assisted building existed, which was citizen developers hand-configuring security roles inside the maker portal with even less structured oversight than a mandatory plan review provides.
What to Put in Place Before Turning This On Broadly
The fix isn’t to block the capability. It’s to extend existing Power Platform governance so it explicitly accounts for AI-generated artifacts rather than assuming manually built and AI-generated apps carry the same risk profile by default. A few specific steps hold up in practice. First, the plan-review step needs a defined second reviewer for any app that generates a new security role or business process flow, someone who understands the Dataverse security model and can evaluate a generated role’s actual grants, not just the person who requested the app confirming it matches their description. Second, generated apps should flow through the same promotion gate as manually built ones before reaching a production environment, meaning a Managed Environment with rules that don’t exempt AI-generated solutions from the review and testing stages already required for everything else. Third, generated solutions should be identifiable as such, through naming convention or solution metadata, so a Center of Excellence audit can actually find and review them as a distinct population rather than discovering one during an incident. Finally, before authorizing broad use, someone on the platform team should walk through which specific capabilities inside this tool family are GA and which remain preview, since that boundary will keep shifting as Microsoft continues to expand it through 2026 release wave 2 and beyond.
None of this is a reason to slow-walk adoption. It’s a reason to make sure the governance conversation happens at the same speed as the feature rollout, rather than six months after the first generated security role turns up somewhere nobody expected it. The tools that let a business analyst build a working app in an afternoon are genuinely useful, and organizations that get the review discipline right early will capture that speed without absorbing the risk that comes from treating a functional plan review as if it were a security review. Routeget Technologies has been helping clients extend Center of Excellence frameworks to explicitly cover AI-generated Power Platform artifacts as this category of tooling matures, and the pattern holds across nearly every engagement: the technology is ready faster than the governance process is, and closing that gap deliberately is cheaper than closing it after something ships that shouldn’t have.
#PowerApps #ModelDrivenApps #AIAppBuilder #PowerPlatformGovernance #CitizenDevelopment #EnterpriseAI
No comment yet, add your voice below!