Enterprise response. Governance fragmentation. Shadow AI.
Naming conventions nobody followed. Release process everyone routed around. Approval forms managers skimmed between meetings. Spreadsheet where every row said "pending." Zero governance became governance theater.
AI Governance Committee. Compliance. Privacy. InfoSec. Overlapping mandate with IT — didn't know IT was building a framework three floors away. Neither spoke to the people actually building agents.
Security notices first. Not IT — IT was running its own shadow AI. SRE with personal Claude key. Network engineer on free-tier OpenAI. Security has the taxonomy: SOC 2 Type II, GDPR, data sovereignty, audit trails, attack surface. They ask the question nobody else asked: how many of these are running? Then the more dangerous one: how many can we not see?
IT builds the framework once Security makes it their problem. But the framework doesn't touch reality. Meanwhile Legal builds a parallel team. The approval process takes six weeks. The unapproved path takes six minutes.
Shadow AI is not a handful of rogue actors. It is the default operating model when the approved operating model is too slow to function.
Personal accounts. Personal API keys. Expensed $20 subscriptions under the flagging threshold. Tools the company never vetted. Data the company didn't know was being accessed. Not recklessness — survival. The approved path was slower than the deadline.
The pendulum didn't swing. The pendulum shattered. Pieces everywhere. No center.