What it is
The Citizen-Developer Training Plan is a tiered training and certification plan that takes business users from their first form to governed, production-ready apps — safely. It maps skills, milestones, and guardrails to each builder tier so a Center of Excellence can grow citizen developers without growing shadow IT, security gaps, or technical debt. Its premise is that the skill that matters is not just how to drag and drop a screen together, but knowing what to build where, what data is off-limits, and when to hand off to the platform team.
The plan ties learning to a tiered builder model in which permissions, training, and certification advance together. Tier 1 (Foundation) teaches any business user data basics, forms, simple workflows, and the intake process, with a governance focus on data classification — and can build in personal/dev environments only. Tier 2 (Maker) covers relational data, reusable components, standard connectors, and testing, with least-privilege sharing and the promotion path — and can reach prod via a review gate. Tier 3 (Advanced Maker) adds complex logic, integrations, ALM, and performance and limits, with security review and RBAC design — and can reach prod via a governed pipeline. A final hand-off level teaches makers to recognize when to escalate edge or high-risk cases to professional developers.
Each tier comes with a concrete curriculum (Tier 1 foundations in weeks 1-2, Tier 2 making over months 1-2 with a mentor-reviewed capstone, Tier 3 advanced work in quarter 1, plus ongoing office hours and recertification) and a set of certification requirements: completing the curriculum and assessments, building a tier-appropriate capstone, demonstrating correct data classification and least-privilege sharing, following the intake and registration process, promoting through the governed pipeline (Tier 2+), passing a security self-review (Tier 3), agreeing to the governance policy, and scheduling recertification.
What it's used for
Organizations use this plan to grow capable citizen developers whose reach always matches their proven competence — so training, permissions, and certification advance together rather than handing powerful tools to untrained users. It is the enablement engine a CoE runs to scale building safely.
- ✓ Replacing a single onboarding session with a tiered learning path, so a maker's permissions expand only after they have demonstrated both the technical skill and the governance judgment to use them responsibly.
- ✓ Delivering a tier-appropriate curriculum: Tier 1 foundations (forms, data sensitivity 101, the intake process, sharing safely) in weeks 1-2; Tier 2 making (relational data, reusable components, approved connectors, the dev-to-test-to-prod path, a mentor-reviewed capstone) over months 1-2; and Tier 3 advanced work (complex workflows, integrations and blast radius, ALM and rollback, performance and limits, a security self-review) in quarter 1.
- ✓ Certifying makers against clear requirements per tier — curriculum and assessments completed, a tier-appropriate capstone built, correct data classification and least-privilege sharing demonstrated, the intake process followed, and the governance policy agreed.
- ✓ Teaching the most underrated skill of all: knowing the limits of the citizen tier and when to hand off edge or high-risk cases to professional developers rather than trying to do everything.
- ✓ Sustaining skills over time with office hours, a maker community, a champions program, recertification when policies or the platform change, and brown-bag sessions on new features and retired anti-patterns.
- ✓ Running cohorts on a regular cadence so there is always a path from interested user to certified maker, with managers sponsoring learners and protecting time for training.
- ✓ Measuring the program by certified makers per tier, apps promoted through the governed pipeline, the share of production apps built by certified makers, and the drop in ungoverned or ownerless apps — using rising certification with falling shadow IT as the signal that training is working.
Who uses it
The plan is owned by the Center of Excellence and works through learners, mentors, and managers. It is most valuable in organizations that want to scale citizen development deliberately rather than letting untrained enthusiasm outrun governance.
Context & good to know
Handing business users a powerful low-code platform with a single onboarding session is how organizations end up with ungoverned apps, exposed data, and a portfolio nobody can maintain. The training plan exists because tooling alone does not produce safe builders — judgment does. Teaching someone to assemble a screen is easy; teaching them to classify data correctly, share at least privilege, and recognize when a request exceeds their tier is the harder, more valuable skill, and it is the one the plan is built to develop.
The defining design choice is that training, permissions, and certification advance together. A maker does not get the ability to reach production through a governed pipeline until they have demonstrated the ALM and security judgment that warrants it. This keeps a maker's reach always matched to their proven competence — the structural mechanism that lets a CoE expand its builder base without expanding its risk surface. The hand-off level reinforces the same point: knowing when not to build, and to escalate instead, is itself a certified competence.
This plan is the enablement pillar of the low-code governance system. It teaches makers to follow the intake form, respect the builder tiers of the governance policy, build along the ALM and environment strategy's promotion path, and run the security and compliance self-review before submitting Tier 3 apps. A CoE charter names the team that runs it, and the app portfolio review measures whether it is working through the falling-shadow-IT signal. Because the program depends on the platform's learning resources and governance guardrails, comparing those across Power Apps, OutSystems, Mendix, Appian, and Zoho Creator at spotsaas.com helps ensure the platform supports the path this plan defines.