An organizational crack

One observation in McKinsey Global Institute’s The AI Economy: Interconnected Forces, Feedback Loops, and Speeds of Change stayed with me. Responsibility for AI is distributed across functions that were created for a different technological era. Technology organizations operate systems. Data organizations manage information. Legal interprets obligations. Risk establishes controls. Human resources governs aspects of the workforce. Business units own operating outcomes. Strategy decides where the enterprise intends to go.

This decomposition made sense when software was primarily an instrument used by people.

It becomes less coherent when software can interpret context, formulate options, make recommendations, initiate workflows, communicate with other systems, and increasingly take actions that carry economic or institutional consequence. An autonomous system can cross several organizational boundaries in the course of a single decision. The enterprise, meanwhile, continues distributing responsibility according to those boundaries.

The resulting problem is easy to describe but surprisingly difficult to locate on an organization chart:

Who owns the space between what the system can do and what the institution permits it to do?

Capability is not authority

This distinction has become one of the recurring threads in my thinking about autonomous systems. Technical capability answers one question: Can the system perform this action? Institutional authority answers another: May this system perform this action, under these circumstances, on whose behalf, within what limits, using what evidence, with what possibility of refusal or reversal, and with whom remaining accountable for the consequence?

Those questions cannot be collapsed into model capability.

Nor are they adequately answered by putting a human somewhere in the loop. Human involvement can itself become ceremonial if the person lacks context, time, authority, or meaningful ability to contest the machine’s recommendation. A nominal approval step is not necessarily judgment, just as a policy document is not necessarily governance.

The interesting territory lies between capability and consequence.

That territory contains identity, context, evidence, policy, authority, delegation, verification, exception handling, reversibility, accountability, and institutional memory. These are often treated as separate technical or governance concerns. Autonomous systems increasingly reveal them as parts of one operating problem.

The missing institutional layer

Perhaps this is why AI governance so often feels appended to the enterprise rather than native to it. We are attempting to govern a new form of agency through organizational structures designed around systems that did not possess agency.

IT can operate the technology but cannot independently determine legitimate business authority. Legal can interpret obligations but does not operate every decision loop. Risk can establish controls but cannot provide all the context in which those controls must execute. Business leaders can own outcomes without understanding every machine action that contributes to them. Human oversight cannot scale by placing a person beside every autonomous decision.

No existing function naturally contains the whole problem.

That suggests the answer may not be another committee or another governance document. The missing layer may need to become part of the operating architecture itself: a place where context, policy, evidence, identity, authority, action, verification, and accountability are connected before consequential action occurs.

Governance, in that formulation, is not something applied to autonomous intelligence from outside. It becomes part of the machinery through which autonomous intelligence is allowed to act.

The question I want to keep

For decades, enterprise architecture has been concerned primarily with connecting systems, applications, processes, and data. Autonomous intelligence introduces another architectural object: delegated authority.

Once machines can act, architecture has to answer not merely how information moves, but how permission to act moves with it.

That leaves a question I suspect we will encounter repeatedly:

What kind of institution must an enterprise become when capability can travel farther and faster than authority?

The space between capability and consequence is no longer empty. Something will occupy it.

The question is whether we design it deliberately.