The Pendulum
Enterprise response. Governance fragmentation. Shadow AI.
The three parallel failures
IT's Framework
Naming conventions nobody followed. Release process everyone routed around. Approval forms managers skimmed between meetings. Spreadsheet where every row said "pending." Zero governance became governance theater.
Legal's Team
AI Governance Committee. Compliance. Privacy. InfoSec. Overlapping mandate with IT — didn't know IT was building a framework three floors away. Neither spoke to the people actually building agents.
What it contains
Security notices first. Not IT — IT was running its own shadow AI. SRE with personal Claude key. Network engineer on free-tier OpenAI. Security has the taxonomy: SOC 2 Type II, GDPR, data sovereignty, audit trails, attack surface. They ask the question nobody else asked: how many of these are running? Then the more dangerous one: how many can we not see?
IT builds the framework once Security makes it their problem. But the framework doesn't touch reality. Meanwhile Legal builds a parallel team. The approval process takes six weeks. The unapproved path takes six minutes.
Shadow AI is not a handful of rogue actors. It is the default operating model when the approved operating model is too slow to function.
Personal accounts. Personal API keys. Expensed $20 subscriptions under the flagging threshold. Tools the company never vetted. Data the company didn't know was being accessed. Not recklessness — survival. The approved path was slower than the deadline.
The pendulum didn't swing. The pendulum shattered. Pieces everywhere. No center.
Why this post is fourth
- Completes the "what happened" arc before the diagnosis turn
- Shows the response to the graveyard — and that the response failed too
- Security as clear-eyed assessor adds credibility (frameworks, SOC 2, GDPR)
- Shadow AI is the universal experience — every org has it, nobody names it
- Second failure mode: not anarchy, fragmentation. The pendulum doesn't swing, it shatters
- Sets up the Mirror: the governance failed because it was solving symptoms, not causes