← Back to InsightsBuilding Intelligence

The Tenant Just Built an AI Stack Around Your Building. Here Is Why.

Multifamily residents are now running consumer AI and open-source tools to work around closed building systems. That is not a renter problem. It is an architecture problem — and it is costing owners control of the resident relationship.

May 22, 2026·By Drew Hall

Brad Hargreaves's Thesis Driven letter this week named a pattern I have been watching show up on multifamily sites for the last six months. Residents are using consumer AI tools and open-source projects to regain control of how their own apartments operate. Not because they are particularly technical. Because the building's stack is closed to them, and the resident wants the apartment to behave like the rest of their digital life. The article points to an open-source GitHub project that connects HomeAssistant to SmartRent without any vendor cooperation. That repo exists because every major property management platform — Yardi, RealPage, AppFolio, Entrata, Buildium, ResMan — has APIs, but those APIs are gated to certified vendor partners. The resident is not on that list. So the resident builds their own. Let's demystify what is actually happening here. This is not a renter problem. This is an architecture problem.

The story underneath the story

Most of the trade press will read the Thesis Driven piece and ask whether multifamily PMS vendors should open their APIs. That is the wrong question. The architecture question is much more interesting and much more consequential for the owner. Inside the building, you have two parallel data planes that do not talk to each other. One is the owner-controlled stack — building management system, access control, in-unit thermostat, leak sensors, package locker, the part of the building covered by your operating contracts. The other is the resident-controlled stack — their phone, their voice assistant, their personal home automation, their browser, and increasingly an AI agent that the resident treats as their interface to everything in the apartment.

For a long time those two planes could ignore each other. The resident's stack handled streaming, ordering, and personal stuff. The owner's stack handled HVAC, access, and operations. The resident-owner interface was a maintenance request form and an in-unit thermostat. That arrangement is over. The resident's stack now expects to interface with the apartment itself — to know when the HVAC is on, to set its own schedule, to talk to the door, to coordinate with the package locker. The Apartments.com Smart Search white paper this month reported 35 million AI search sessions in the first two months since launch. The resident is already arriving at the building with AI-mediated expectations of how the unit will behave. The unit does not meet them. So the resident builds the bridge themselves.

Where the architecture forces this

Multifamily owners have spent a decade buying in-unit technology — smart locks, smart thermostats, leak sensors, in-unit hubs — almost entirely from vendors who designed the API for their own certified partner list and not for the resident. There is good reason for that. Vendors do not want to expose protocols that compromise the contract they have with the owner. The owner did not specifically ask for a tenant-facing interface in the deal. The result is a building stack that talks fluently to the property manager's portal, sometimes to the PMS, and not at all to the resident.

That is a Connect failure. Connectivity inside the building is not governed for tenant-side use. It is also a Coordinate failure. Identity, access, and lineage all live inside the vendor's API. The owner does not control whether the resident can see their own consumption data, set their own schedule, or hand permission to their preferred home-assistant system. The vendor does. So when the resident wants the apartment to work the way the rest of their digital life works, the resident routes around the building stack entirely. They install HomeAssistant. They run a small home server. They follow a GitHub thread to bridge the smart lock to their voice assistant without telling the building. The shadow stack is not malicious. It is the rational response to a stack that does not include them.

What's the real problem we're solving

The real problem is not that residents are technically resourceful. It is that the resident relationship is migrating to a system the owner does not see and does not govern. When the resident's primary interface to the apartment is their own AI agent talking to their own home server, the owner has just lost a slice of the operating relationship. Maintenance signals the building used to catch (a thermostat used in unusual patterns, a leak sensor tripped, a door access anomaly) now show up in the resident's home dashboard before they show up anywhere on the owner's side. The resident makes decisions about energy usage without the building knowing. Resident-side automations create odd HVAC and access patterns the building's analytics layer cannot interpret because it never saw the source.

This is also a security architecture problem. A resident routing the smart lock through an unsanctioned home server is creating a network path the building's segmentation strategy never anticipated. That is not a hypothetical. CISA advisories on OT-IoT crossover incidents in commercial properties have consistently called out exactly this pattern — devices on networks they were never supposed to touch, talking to systems nobody chartered. The shadow stack is a network surface the owner did not approve and cannot monitor.

What's it really worth

Here is the part where this stops being a tech story and becomes an asset-management story. A multifamily property's tenant experience scores, retention rates, and AVS premiums are now partially being shaped by data & digital infrastructure the owner does not control. If the resident has to build their own bridge to make the apartment work the way they expect, the moment a competing property offers a more open in-unit experience, the resident has a clean reason to leave. Retention is NOI. NOI is value. A 1% retention improvement in a stabilized multifamily asset, on a 5 cap, is real money. The architecture decision the owner made five years ago — to accept a vendor's closed stack as default — is now showing up in 2026 in tenant satisfaction surveys and renewal rates.

There is also the AI side of the same problem. If the resident's AI agent has more data about how the apartment operates than the owner's analytics layer does, the resident-side AI is going to develop a better understanding of the unit than the owner does. The owner will look at the resident-experience problem and wonder why their dashboards show a different story than the resident's reality. The dashboards are not wrong. They are reading a different stack.

The architecture fix

This is a Connect, Coordinate, and Control problem in PPP 5C™ language, and it has a specific architecture answer.

Connect — the building has to have a tenant-side connectivity contract, not just an operations connectivity contract. The resident's network is part of the building's data plane, not separate from it. ElasticISP® and BoT® (Building of Things®) are how OpticWise lands this — one owner-controlled connectivity layer that includes the resident path as a governed, segmented surface, not a side channel.

Coordinate — the building has to have a tenant-facing identity and access governance model. Who is the resident, what can the resident see about their own unit, who can the resident grant access to (their home-assistant system, their AI agent, their family). Today this is a vendor question because the vendor's API holds the keys. It needs to be an owner question. The owner's standard decides what is exposed and on what terms.

Control — when the owner's intelligence layer (Property Brain™ at the property scale) sees the resident-side activity through a governed interface rather than through an unsanctioned network bridge, the owner can include resident behavior in operations decisions without violating the resident's privacy. That is how the resident-side stack becomes a contributor to the building's intelligence instead of a competitor for it. Portfolio Brain™ is what makes the same model work across hundreds of properties under one operating standard.

This is also exactly the conversation the four enterprise CRE platform CEOs — Yardi, MRI Software, VTS, Altus Group — are about to defend on the Realcomm main stage. The vendor pitch will be a tighter integration story. The owner question is whether the integration is one the owner controls or one the vendor controls. The answer to that question is upstream of which vendor you pick.

What to do about it on Monday

Three architecture moves to put in motion now.

One. Map the in-unit stack at one representative property. Every device, every API, every vendor permission, every network path. Mark which surfaces the resident touches today, which surfaces they could touch if they routed around you, and which network segments their shadow stack would sit on. Most owners do not have this map. The map alone changes the conversation.

Two. Add a tenant-side connectivity and identity layer to your operating standard. If you are buying new in-unit hardware in 2026 without asking the vendor "what does the resident see, and under whose permissions," you are buying yourself the same problem in 2031. The data and digital infrastructure review is the right venue for this question.

Three. Bring resident-side AI signals into your intelligence layer through a governed interface, not by trying to ban resident automation. Banning it does not work — the GitHub repo already exists. Governing it does. Property Brain™ and Portfolio Brain™ are the layer that lets resident-permitted signals contribute to operations without compromising privacy.

If you don't own your data & digital infrastructure, your vendors do — and the resident's AI agent will quietly inherit the part of the operating relationship the vendor did not bother to expose to you.

Data is king. Digital infrastructure is the means to get to it. The resident already understands that. So should the owner.

Own your data & digital infrastructure. Operate with strategic foresight. Build for the long game.

References Cited

Connect Media (Weekender) — "Yes, AI Assists with Title Workflows. But Humans Remain Essential" — 2026-05-16 — https://www.connectcre.com/

Your Next Step

Complimentary CRE Data & Digital Review Session

One building. Map who owns what, where data lives, who has permission to act on it, and where operational burden stacks up vs your KPIs.