[{"data":1,"prerenderedAt":1792},["ShallowReactive",2],{"site-nav-content":3,"hiring-banner-content":177,"blog:\u002Fblog\u002Fnon-human-user-access-control":189,"blog-index-copy":842,"blog:\u002Fblog\u002Fnon-human-user-access-control:surround":863,"site-cta-content":1773},{"header":4,"productNav":9,"nav":42,"footer":61,"askAI":132,"id":161,"title":162,"archived":163,"authors":164,"badge":164,"body":165,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":173,"relatedHeading":164,"seo":174,"series":164,"sitemap":163,"status":164,"stem":175,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":176},{"productLabel":5,"loginLabel":6,"contactLabel":7,"contactSalesLabel":8},"Product","Log in","Contact","Get started for free",[10,14,18,22,26,30,34,38],{"label":11,"to":12,"description":13},"Overview","\u002Foverview","Seven layers. One closed loop.",{"label":15,"to":16,"description":17},"Conflux","\u002Fproduct\u002Fconflux","Where your team, workstreams, and agents meet.",{"label":19,"to":20,"description":21},"Agent Teams","\u002Fproduct\u002Fagent-teams","Specialist teams - governed from day one.",{"label":23,"to":24,"description":25},"Lifecycle Graph","\u002Fproduct\u002Flifecycle-graph","Intelligence that compounds across every interaction.",{"label":27,"to":28,"description":29},"Company Wiki","\u002Fproduct\u002Fwiki","Playbooks and policies where expertise stays.",{"label":31,"to":32,"description":33},"Workstreams","\u002Fproduct\u002Fworkstreams","From brief to signed-off deliverable on one canvas.",{"label":35,"to":36,"description":37},"Perception Console","\u002Fproduct\u002Fperception","Ask your whole business in plain English.",{"label":39,"to":40,"description":41},"Governance","\u002Fproduct\u002Fgovernance","Frontier AI you can actually sign off on.",[43,46,49,52,55,58],{"label":44,"to":45},"Models","\u002Fmodels",{"label":47,"to":48},"Pricing","\u002Fpricing",{"label":50,"to":51},"Integrations","\u002Fintegrations",{"label":53,"to":54},"Security","\u002Fsecurity",{"label":56,"to":57},"Partners","\u002Fpartners",{"label":59,"to":60},"Insights","\u002Fblog",{"productHeading":5,"companyHeading":62,"resourcesHeading":63,"legalHeading":64,"docsLabel":65,"docsUrl":66,"statementLines":67,"copyright":70,"companyLinks":71,"resourcesLinks":86,"legalLinks":102,"socialLinks":109,"bottomLinks":119},"Company","Resources","Legal","Docs","https:\u002F\u002Fdocs.gonimbus.ai",[68,69],"Stop training someone else's model.","Control your AI.","© 2026 Nimbus Intelligence, Inc. All rights reserved.",[72,73,74,75,76,78,81,84],{"label":47,"to":48},{"label":50,"to":51},{"label":53,"to":54},{"label":59,"to":60},{"label":77,"to":57},"Partner Program",{"label":79,"to":80},"Careers","\u002Fcareers",{"label":82,"to":83},"System status","\u002Fstatus",{"label":7,"to":85},"\u002Fcontact",[87,90,93,96,99],{"label":88,"to":89},"Glossary","\u002Fglossary",{"label":91,"to":92},"Compare","\u002Fcompare",{"label":94,"to":95},"Evaluate","\u002Fevaluate",{"label":97,"to":98},"Problems","\u002Fproblems",{"label":100,"to":101},"Use cases","\u002Fuse-cases",[103,106],{"label":104,"to":105},"Terms of Service","\u002Fterms",{"label":107,"to":108},"Privacy Policy","\u002Fprivacy",[110,113,116],{"label":111,"href":112},"LinkedIn","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fgonimbusai\u002F",{"label":114,"href":115},"X","https:\u002F\u002Fx.com\u002Fgonimbusai",{"label":117,"href":118},"Instagram","https:\u002F\u002Fwww.instagram.com\u002Fgonimbus_ai\u002F",[120,122,124,127,128],{"label":121,"to":105},"Terms",{"label":123,"to":108},"Privacy",{"label":125,"to":126},"Compliance","\u002Fcompliance",{"label":82,"to":83},{"label":129,"to":130,"external":131},"LLMs.txt","\u002Fllms.txt",true,{"text":133,"prompt":134,"platforms":135},"Ask AI about Nimbus","I'm researching enterprise intelligence platforms and want to know how Nimbus combines perception, collaboration, and autonomous agents to drive strategic decision-making. Summarize the highlights from Nimbus's website: https:\u002F\u002Fgonimbus.ai",[136,141,146,151,156],{"name":137,"label":138,"icon":139,"hrefPrefix":140},"chatgpt","ChatGPT","simple-icons:openai","https:\u002F\u002Fchatgpt.com\u002F?prompt=",{"name":142,"label":143,"icon":144,"hrefPrefix":145},"perplexity","Perplexity","mdi:magnify","https:\u002F\u002Fwww.perplexity.ai\u002Fsearch\u002Fnew?q=",{"name":147,"label":148,"icon":149,"hrefPrefix":150},"grok","Grok","simple-icons:x","https:\u002F\u002Fx.com\u002Fi\u002Fgrok?text=",{"name":152,"label":153,"icon":154,"hrefPrefix":155},"claude","Claude","simple-icons:anthropic","https:\u002F\u002Fclaude.ai\u002Fnew?q=",{"name":157,"label":158,"icon":159,"hrefPrefix":160},"google-ai","Google AI","simple-icons:google","https:\u002F\u002Fwww.google.com\u002Fsearch?udm=50&aep=11&q=","content\u002Fshared\u002Fnav.md","Site navigation",false,null,{"type":166,"value":167,"toc":168},"minimark",[],{"title":169,"searchDepth":170,"depth":170,"links":171},"",2,[],"md","\u002Fshared\u002Fnav",{"title":162,"description":169},"shared\u002Fnav","Q7sDe7TuGEwhwUMamyeOxjvGlsUaF3Iay9VTW0KaE_U",{"enabled":163,"message":178,"linkLabel":79,"linkHref":80,"id":179,"title":180,"archived":163,"authors":164,"badge":164,"body":181,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":185,"relatedHeading":164,"seo":186,"series":164,"sitemap":163,"status":164,"stem":187,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":188},"We're hiring! Join the team building the Sentient Enterprise.","content\u002Fshared\u002Fhiring.md","Hiring banner",{"type":166,"value":182,"toc":183},[],{"title":169,"searchDepth":170,"depth":170,"links":184},[],"\u002Fshared\u002Fhiring",{"title":180,"description":169},"shared\u002Fhiring","1zs3boivKda1e-b-hAyuNcmZSKjZUAXmecnwHVgcHzk",{"id":190,"title":191,"archived":163,"authors":192,"badge":196,"body":198,"date":817,"definedTerm":164,"department":164,"description":818,"extension":172,"eyebrow":164,"faqHeader":819,"faqs":822,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":832,"relatedHeading":164,"seo":833,"series":834,"sitemap":131,"status":164,"stem":835,"subhead":164,"tags":836,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":841},"content\u002Fblog\u002Fnon-human-user-access-control.md","The Access Control Blindspot: Unmonitored Non-Human AI Agents",[193],{"name":194,"to":195},"Nimbus Research","https:\u002F\u002Fgonimbus.ai",{"label":197},"Thought Leadership",{"type":166,"value":199,"toc":806},[200,204,213,218,221,229,242,320,324,327,334,340,346,354,426,430,433,436,444,452,456,459,462,470,478,532,536,543,546,554,558,569,572,579,641,645,651,677,680,742,746,749,752,755,759],[201,202,203],"p",{},"Security programmes spent years making a simple idea stick. A person joins, moves, or leaves, and their access follows. Privileged access is rare, time-bounded, and reviewed. A shared administrator password is an audit finding, not a convenience. Then a pilot needed a connector “so the demo would work,” and a token was minted with rights no employee in that team possesses. The token does not go on leave. It does not fail a performance review. It sits in a secret store and calls the billing system whenever a prompt tells it to.",[201,205,206,207,212],{},"That token is a non-human user. Treat it as one. The next costly incidents in this area will not require anyone to steal a model’s weights. They will be ordinary privilege problems: too much scope, no owner, a prompt that can aim the scope. ",[208,209,211],"a",{"href":210},"https:\u002F\u002Fnewsroom.ibm.com\u002F2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls","IBM’s 2025 research"," already reads that way. Thirteen percent of organisations reported a breach involving an AI model or application. Of those, 97 percent lacked proper AI access controls. Sixty percent of the AI-related incidents compromised data and 31 percent caused operational disruption. The common path ran through the supply chain of apps, APIs, and plugins. One in five organisations reported a breach involving shadow AI. This is joiner-mover-leaver, skipped, wearing a new headline.",[214,215,217],"h2",{"id":216},"the-superuser-that-was-never-hired","The superuser that was never hired",[201,219,220],{},"A human superuser is uncomfortable on purpose. The account is named. Someone recertifies it. Break-glass use is logged and reviewed. An agent superuser is created in the opposite mood. The pilot is on Thursday’s agenda. The narrow role would take a ticket. The shared write credential is faster, and “temporary” is written in a chat rather than as an expiry in the identity system. By the following week the credential has been copied into a second experiment, because copying is easier than requesting. Two jobs, one identity, no owner.",[201,222,223,224,228],{},"The blast radius is the product of that identity and whatever text can influence the run. ",[208,225,227],{"href":226},"https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F","OWASP’s account of tool abuse and indirect prompt injection"," describes the class. A customer thread, a PDF, a web page the agent was told to read, contains an instruction to ignore a limit, widen a permission, or send a promise. If the token can do the thing, the model’s helpfulness is not a defence. Untrusted content authorised a transaction. You already forbid that pattern for email rules that auto-forward wires. The natural-language interface is not an exception.",[201,230,231,232,236,237,241],{},"Shadow use widens the same problem from a different direction. ",[208,233,235],{"href":234},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fworklab\u002Fwork-trend-index\u002Fai-at-work-is-here-now-comes-the-hard-part","Most AI users bring their own tools",". A personal chatbot cannot post to your ledger. A person can paste what it drafted into a system they can post to, after the sensitive context has already left. ",[208,238,240],{"href":239},"https:\u002F\u002Fwww.cnbc.com\u002F2023\u002F05\u002F02\u002Fsamsung-bans-use-of-ai-like-chatgpt-for-staff-after-misuse-of-chatbot.html","Samsung’s restriction"," after source code was uploaded is the intellectual-property case of a missing sanctioned identity: people used a tool that would accept the file because the official path would not. Only 37 percent of organisations in the IBM study had policies to manage or detect that kind of use. A policy that cannot see the token and cannot see the phone is not an identity programme.",[243,244,245,261],"table",{},[246,247,248],"thead",{},[249,250,251,255,258],"tr",{},[252,253,254],"th",{},"Human privileged user",[252,256,257],{},"Non-human run, as usually deployed",[252,259,260],{},"What parity requires",[262,263,264,276,287,298,309],"tbody",{},[249,265,266,270,273],{},[267,268,269],"td",{},"Named person",[267,271,272],{},"Shared “pilot-admin”",[267,274,275],{},"An identity per job",[249,277,278,281,284],{},[267,279,280],{},"Joins, moves, leaves",[267,282,283],{},"Lives until someone remembers the secret",[267,285,286],{},"Expiry, and revocation when the workstream ends or the sponsor leaves",[249,288,289,292,295],{},[267,290,291],{},"Recertified",[267,293,294],{},"“Temporary,” in a chat",[267,296,297],{},"A date in the identity system",[249,299,300,303,306],{},[267,301,302],{},"Least privilege is an argument you have already had",[267,304,305],{},"Write on whatever the demo needed",[267,307,308],{},"Read by default. Write is a separate grant",[249,310,311,314,317],{},[267,312,313],{},"Break-glass is logged",[267,315,316],{},"The model retries the tool call",[267,318,319],{},"The payload, the refusal, and the person who released a write",[214,321,323],{"id":322},"joiner-mover-leaver-for-a-run","Joiner, mover, leaver for a run",[201,325,326],{},"Apply the process you already trust. Do not invent a parallel universe called “AI identity” that the IAM team never sees.",[201,328,329,333],{},[330,331,332],"strong",{},"Joiner."," The identity is created when a workstream is allowed to execute, not when a vendor is purchased. It can read the systems that job needs, in the scope of the people who own the job. It cannot read the HR file because a finance team was curious, and it cannot pay because support wanted to “close the loop.” Connector scope is the joiner form. If the form says administrator, send it back.",[201,335,336,339],{},[330,337,338],{},"Mover."," When the job changes — a new class of record, a new system — the scope changes by request, not by copying yesterday’s secret into today’s environment. The approver of a write scope is not the pilot’s sponsor. Sponsors are paid to make Thursday’s demo. Approvers are paid to refuse.",[201,341,342,345],{},[330,343,344],{},"Leaver."," When the workstream ends, the sponsor changes roles, or the review says stop, the identity dies the same week. A stopped pilot with a live token is still a user. “Continue to explore” without an owner is how temporary becomes the account named in the incident report.",[201,347,348,349,353],{},"Recertify on a calendar, the way you recertify human privilege. Bring one refused write to the review: the payload, the identity that lacked the scope, the person who would have had to release it. If you cannot bring it, the control is a sentence in a standard. ",[208,350,352],{"href":351},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","NIST’s framework"," and every prior access-control standard already say least privilege. The agent programme abandons it because a single company-wide token demos better. The demo is the blast radius.",[243,355,356,369],{},[246,357,358],{},[249,359,360,363,366],{},[252,361,362],{},"Event",[252,364,365],{},"Human process you already run",[252,367,368],{},"The same event for a run",[262,370,371,382,393,404,415],{},[249,372,373,376,379],{},[267,374,375],{},"Start",[267,377,378],{},"Account created against a role",[267,380,381],{},"Identity created against one workstream’s connector list",[249,383,384,387,390],{},[267,385,386],{},"Change of job",[267,388,389],{},"Access recertified or cut",[267,391,392],{},"Write scope requested again. The old token is not copied",[249,394,395,398,401],{},[267,396,397],{},"End",[267,399,400],{},"Account disabled on the leaving date",[267,402,403],{},"Token revoked when the workstream stops or the owner leaves",[249,405,406,409,412],{},[267,407,408],{},"Review",[267,410,411],{},"Show privileged use",[267,413,414],{},"Show a refused write, or explain why none exists",[249,416,417,420,423],{},[267,418,419],{},"Emergency",[267,421,422],{},"Break-glass, then review",[267,424,425],{},"A time-bounded grant, then revocation. Not a standing admin",[214,427,429],{"id":428},"read-and-write-are-different-products","Read and write are different products",[201,431,432],{},"The architectural line is the same line finance already understands between viewing a ledger and posting to it. Read access lets a run ground a draft in records the operator could have opened. Write access changes the record other people trust. Collapse them and every prompt is a potential posting.",[201,434,435],{},"Read-only as a default is what makes an agent usable rather than what makes it timid. Teams get speed on the draft. Security gets a token that cannot move money while a researcher is still learning the failure modes. When a write is justified, it is a named class of object, a quoted payload, and a human release. The release is stored with the rule version. Retries do not get to invent a second side effect. A ceiling on value or on steps stops the run and records the stop. A ceiling that only notifies has not constrained anything.",[201,437,438,439,443],{},"Segment by job. The recruiting team’s run does not hold the payments connector. Finance does not hold the employee file. This is dull, and it is the difference between a contained mistake and an incident that crosses domains. ",[208,440,442],{"href":441},"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=OJ:L_202401689","The EU AI Act"," will require, for some systems, oversight that can interrupt them. Interruptibility is a property of the token and the gate, not of the model card.",[201,445,446,447,451],{},"Test it the way you test a payments change. Take a realistic inbound message and try to push the run into a tool it should not call, and into a write above its ceiling. If either succeeds, file a defect with an owner. Do not file a lesson learned. ",[208,448,450],{"href":449},"https:\u002F\u002Fwww.ftc.gov\u002Fbusiness-guidance\u002Fblog\u002F2023\u002F02\u002Fkeep-your-ai-claims-check","A governance claim that a human is in the loop, while the token posts alone, is the kind of description regulators have already disliked in other clothes",".",[214,453,455],{"id":454},"privileged-access-applied-to-a-connector","Privileged access, applied to a connector",[201,457,458],{},"Privileged access management exists because a standing administrator is how a small mistake becomes a large incident. Checkout, use, return, review. The privileged action is rare on purpose. A connector violates that pattern the moment it can write whenever a run happens to be awake. “The integration is connected” is not a control. It is a standing grant, often broader than any employee in the sponsoring team, created so a workshop could finish on time.",[201,460,461],{},"The privileged action for an agent is a payload, not a role that lasts all quarter. A person checks out the right to release one credit, one email, one journal line. The release covers that payload. It expires. Someone looks at it afterward, the way break-glass use is looked at. The model does not receive a durable role called operator that includes payments, outbound mail, and the employee file because all three appeared in the integration catalogue on the same afternoon.",[201,463,464,465,469],{},"Specialist swarms make least privilege specific, and they create a new way to lose it. The finance pass holds a ledger read. The policy pass holds the playbook. Neither holds the mail connector. That split is real only if the coordinator’s own token is narrower than the union of the specialists. If the orchestrator can call every tool any sub-agent can call, the diagram shows separation and the identity system shows one superuser. ",[208,466,468],{"href":467},"\u002Fblog\u002Frbac-for-enterprise-ai\u002F","Role design for people"," already refuses that pattern. Non-human roles inherit the same refusal. Scope is per workstream and per connector, and a copied environment file is an incident in waiting.",[201,471,472,473,477],{},"A ceiling belongs in the same set of controls. A loop that calls tools until someone notices is a cost problem and, when a tool can write, an integrity problem. The halt is the control. A warning that the run is “using a lot” is a notification. ",[208,474,476],{"href":475},"\u002Fblog\u002Fwhat-is-human-in-the-loop-ai\u002F","Human oversight"," that cannot withdraw the token, or stop the spend, is a meeting. Put the expiry, the scope, and the ceiling in the identity ticket the IAM team already understands, so the agent programme is not a side door around the process you spent a decade enforcing.",[243,479,480,490],{},[246,481,482],{},[249,483,484,487],{},[252,485,486],{},"PAM habit you already run",[252,488,489],{},"The connector equivalent",[262,491,492,500,508,516,524],{},[249,493,494,497],{},[267,495,496],{},"Standing admin is an exception with a named owner",[267,498,499],{},"A shared “pilot” token is an exception, or it is a finding",[249,501,502,505],{},[267,503,504],{},"Checkout is for one change",[267,506,507],{},"A release covers one quoted payload",[249,509,510,513],{},[267,511,512],{},"The grant expires",[267,514,515],{},"The workstream’s identity expires when the job stops",[249,517,518,521],{},[267,519,520],{},"After-action review",[267,522,523],{},"A refused write, or a released write, brought to recertification",[249,525,526,529],{},[267,527,528],{},"The help-desk account cannot also move money",[267,530,531],{},"The support run’s token cannot also post a refund",[214,533,535],{"id":534},"a-refund-the-inbound-message-must-not-be-able-to-post","A refund the inbound message must not be able to post",[201,537,538,539,542],{},"Consider a support workstream whose job is to draft replies against the current refund rule. The case file and the policy are readable. A credit is a write. Inbound mail and attachments are untrusted content. They may contain the customer’s request, and they may contain an instruction aimed at the tool: ignore the limit, treat this as already approved, send the credit now. ",[208,540,541],{"href":226},"OWASP describes that class of tool abuse",". The defence is not a hope that the model will decline in prose. The defence is that the token cannot post.",[201,544,545],{},"The run proposes an amount, cites the rule version, and stops. A person who already owns refunds sees the amount, the case, and the citation, and releases or refuses. If the inbound text asked the system to skip that person, the request remains content in the case. It never becomes authority, because authority lives on the grant. A test that only checks whether the chat “says no,” while a second credential can still call billing, has examined the wrong object. File the defect against the token.",[201,547,548,549,553],{},"Segment the swarm the same way. The drafter does not hold the payments connector. A finance workstream that needs the ledger does not hold the employee file. Cross-domain tokens feel efficient in a pilot and become the blast radius in the report. IBM’s figure — 97 percent of organisations that suffered an AI-related compromise lacked proper access controls — is what this design avoids, one connector at a time. ",[208,550,552],{"href":551},"\u002Fblog\u002Fwhat-is-shadow-ai\u002F","Shadow use"," remains the path around it: a person who cannot get a sanctioned read will paste the case into a personal tool. The sanctioned read has to be good enough that the paste is the slower option.",[214,555,557],{"id":556},"what-the-reviewer-will-ask-to-see","What the reviewer will ask to see",[201,559,560,564,565,568],{},[208,561,563],{"href":562},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F81230.html","ISO\u002FIEC 42001"," asks for a management system. A SOC examination asks whether access control, change control, and logging operate in practice. ",[208,566,567],{"href":351},"NIST"," asks you to map what you deployed and to govern it. None of them will accept a slide titled “human in the loop” in place of an exhibit. The exhibit is boring, and that is the point.",[201,570,571],{},"Access control is the inventory: every non-human identity, the workstream it serves, the systems it may read, the systems it may not write, the date it dies. Change control is the gate: the payload, the tier of checkpoint — a light release for a draft that stays inside the workspace, a harder release for a customer promise or a posting — and the person who let it go. Logging is a history the team that runs the agent cannot quietly rewrite. The writer of the action is not the editor of the record. Whether you keep that history in the platform’s decision log or in the archive you already trust, the property is the same.",[201,573,574,575,578],{},"The ",[208,576,577],{"href":441},"EU AI Act"," adds, for systems that fall in scope, an obligation that people can oversee and interrupt. Interruptibility is a property you can demonstrate: here is the token, here is how it is withdrawn, here is a run that stopped. A model card does not demonstrate it. Bring the withdrawn token from a pilot you actually ended. If the pilot ended in a slide and the secret is still valid, the management system is a document.",[243,580,581,591],{},[246,582,583],{},[249,584,585,588],{},[252,586,587],{},"Control the questionnaire names",[252,589,590],{},"The artefact that answers it",[262,592,593,601,609,617,625,633],{},[249,594,595,598],{},[267,596,597],{},"Least privilege",[267,599,600],{},"Connector scope per workstream, read separated from write",[249,602,603,606],{},[267,604,605],{},"Joiner-mover-leaver",[267,607,608],{},"Create, recertify, and revoke on the same calendar as human privilege",[249,610,611,614],{},[267,612,613],{},"Change management",[267,615,616],{},"A released payload with a person and a rule version",[249,618,619,622],{},[267,620,621],{},"Logging and integrity",[267,623,624],{},"A decision history the run cannot edit",[249,626,627,630],{},[267,628,629],{},"Oversight that can interrupt",[267,631,632],{},"A ceiling and a revocation that have fired at least once",[249,634,635,638],{},[267,636,637],{},"Acceptable use of shadow tools",[267,639,640],{},"A measured pulse, and a sanctioned path people prefer",[214,642,644],{"id":643},"what-an-auditor-can-be-shown","What an auditor can be shown",[201,646,647,648,650],{},"Standards do not replace the artefact. They tell you which artefact will be asked for. ",[208,649,563],{"href":562}," asks for a management system around AI. SOC reports ask whether access control and change control operate. NIST asks you to map and govern what you deployed. A package that satisfies the question, rather than the binder, contains:",[652,653,654,658,661,664,667,670],"ul",{},[655,656,657],"li",{},"The inventory of non-human identities and the workstream each serves.",[655,659,660],{},"The connector scope, read or write, and the expiry.",[655,662,663],{},"A sample refusal, with the payload that did not leave.",[655,665,666],{},"A sample release, with the person, the rule version, and the system that changed.",[655,668,669],{},"Evidence that a stopped pilot lost its token.",[655,671,672,673,676],{},"Evidence that personal-account use of customer data, code, and unpublished numbers is measured, not assumed away. ",[208,674,675],{"href":234},"The Work Trend Index"," makes a blanket “approved tools only” statement difficult to defend if you have not looked.",[201,678,679],{},"The lifecycle record is what joins these. An identity without a trail of actions is a user you cannot investigate. A trail that can be edited by the same token it describes is not a trail. Immutability here means the practical kind: the team that runs the agent cannot silently rewrite yesterday’s approval. Whether that is enforced by the platform’s own log or by your existing archive, the property you need is that the story of the write cannot be changed by the writer.",[243,681,682,692],{},[246,683,684],{},[249,685,686,689],{},[252,687,688],{},"Ask",[252,690,691],{},"A complete exhibit",[262,693,694,702,710,718,726,734],{},[249,695,696,699],{},[267,697,698],{},"Who can change a record?",[267,700,701],{},"A list of non-human identities, not “the AI platform”",[249,703,704,707],{},[267,705,706],{},"How much can they do?",[267,708,709],{},"Read or write, per system, with an expiry",[249,711,712,715],{},[267,713,714],{},"Show me a control that fired",[267,716,717],{},"One refused payload",[249,719,720,723],{},[267,721,722],{},"Show me a change that was allowed",[267,724,725],{},"The payload, the person, the rule version",[249,727,728,731],{},[267,729,730],{},"What happened to the pilot you stopped?",[267,732,733],{},"The token is gone",[249,735,736,739],{},[267,737,738],{},"What about the phone?",[267,740,741],{},"A pulse, not a proxy log that went quiet",[214,743,745],{"id":744},"a-call-to-chief-information-security-officers","A call to chief information security officers",[201,747,748],{},"Stop leading with the chatbot domain you might block. Lead with credentials. An assistant that can write is a privileged user. Put it through joiner-mover-leaver, recertify it, and demand a refused transaction the way you would of a human superuser. Give employees a sanctioned read path that can see the files they are already allowed to see, or they will paste those files into an identity you do not control.",[201,750,751],{},"The 2025 pattern is not mysterious. Access was broad. Oversight was thin. Shadow use filled the gap. Narrow the token. Log the action. Expire the identity. The fact that the user speaks in prompts does not make a superuser acceptable.",[753,754],"hr",{},[214,756,758],{"id":757},"references","References",[652,760,761,766,772,777,782,787,792,797,801],{},[655,762,763],{},[208,764,765],{"href":210},"IBM newsroom, 30 July 2025",[655,767,768],{},[208,769,771],{"href":770},"https:\u002F\u002Fwww.ibm.com\u002Freports\u002Fdata-breach","IBM, Cost of a Data Breach",[655,773,774],{},[208,775,776],{"href":226},"OWASP Top 10 for LLM Applications",[655,778,779],{},[208,780,781],{"href":234},"Microsoft and LinkedIn, 2024 Work Trend Index",[655,783,784],{},[208,785,786],{"href":239},"CNBC, Samsung restricts generative AI after misuse",[655,788,789],{},[208,790,791],{"href":351},"NIST AI Risk Management Framework",[655,793,794],{},[208,795,796],{"href":441},"Regulation (EU) 2024\u002F1689",[655,798,799],{},[208,800,563],{"href":562},[655,802,803],{},[208,804,805],{"href":449},"U.S. FTC, Keep your AI claims in check",{"title":169,"searchDepth":170,"depth":170,"links":807},[808,809,810,811,812,813,814,815,816],{"id":216,"depth":170,"text":217},{"id":322,"depth":170,"text":323},{"id":428,"depth":170,"text":429},{"id":454,"depth":170,"text":455},{"id":534,"depth":170,"text":535},{"id":556,"depth":170,"text":557},{"id":643,"depth":170,"text":644},{"id":744,"depth":170,"text":745},{"id":757,"depth":170,"text":758},"2026-09-22","Traditional identity access management was built for people. How to govern API keys, tokens, and privileges for non-human AI users.",{"eyebrow":820,"title":821},"Short answers","Agents are users with tokens",[823,826,829],{"question":824,"answer":825},"Why does joiner-mover-leaver fail for agents?","It was built for people. An agent run is a privileged user with a token, no performance review, and often no expiry.",{"question":827,"answer":828},"What is the breach pattern?","Access. The model is rarely stolen. The token is used.",{"question":830,"answer":831},"What should access control cover?","Which non-human identity may call which system, for how long, and what happens to the token when the job ends.","\u002Fblog\u002Fnon-human-user-access-control",{"title":191,"description":818},"insight","blog\u002Fnon-human-user-access-control",[837,838,839,840],"thought-leadership","security","identity","governance","SwY3uGaW2bq4S07eBQza3nt16Hfqs0ZgYfjxujcPaJU",{"hero":843,"id":845,"title":846,"archived":163,"authors":164,"badge":164,"body":847,"date":164,"definedTerm":164,"department":164,"description":851,"extension":172,"eyebrow":852,"faqHeader":164,"faqs":164,"footerBand":853,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":60,"relatedHeading":859,"seo":860,"series":164,"sitemap":131,"status":164,"stem":861,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":862},{"filename":844},"u2221455217_Flat_design_of_a_futuristic_minimalist_landscape__5d589295-cdea-4ea9-a262-be766881accf_1.png","content\u002Fblog\u002Findex.md","Exploring the future of intelligence.",{"type":166,"value":848,"toc":849},[],{"title":169,"searchDepth":170,"depth":170,"links":850},[],"Deep dives into pre-cognitive intelligence, sentient enterprises, and the evolving landscape of AI-driven business transformation.","Latest Research",{"headline":854,"description":855,"primaryLabel":856,"primaryTo":857,"secondaryLabel":858,"secondaryTo":12},"Stay at the frontier.","Subscribe for product updates and new insights.","Subscribe","\u002Fnewsletter","Explore the platform","More research",{"title":846,"description":851},"blog\u002Findex","BFSWGYO9bcTlaulivKYWyg08_DJHsdGg3OC6g_CG1Hw",[864,1325],{"id":865,"title":866,"archived":163,"authors":867,"badge":871,"body":872,"date":817,"definedTerm":164,"department":164,"description":1305,"extension":172,"eyebrow":164,"faqHeader":1306,"faqs":1308,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1318,"relatedHeading":164,"seo":1319,"series":834,"sitemap":131,"status":164,"stem":1320,"subhead":164,"tags":1321,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1324},"content\u002Fblog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk.md","Why Buying AI Demos Leaves Enterprise Procurement Exposed",[868],{"name":869,"role":870,"to":195},"Zac Radbone","Co-Founder and CCO",{"label":197},{"type":166,"value":873,"toc":1296},[874,877,880,884,887,900,903,913,974,978,990,995,1056,1060,1063,1071,1074,1077,1080,1086,1148,1152,1155,1158,1161,1165,1168,1240,1244,1247,1250,1252,1254],[201,875,876],{},"Enterprise buying was built for products that sit still. A database has a capacity. A suite has a seat. A security review has a questionnaire that mostly stays true after signature. Generative systems do not sit still. The model behind the demo changes. The vendor’s subprocessors change. The customer’s own staff discover uses the statement of work never named. Procurement, which is supposed to be the adult in the buying process, is still scoring the demo.",[201,878,879],{},"The result is a contract that buys a capability and inherits an operating model by accident. The operating model — who may paste what, what is retained, whether a human must approve a customer-facing sentence, what happens when the vendor’s claim exceeds the product — is where the cost and the liability are. It is rarely the section with the weighting in the scorecard.",[214,881,883],{"id":882},"what-the-scorecard-rewards","What the scorecard rewards",[201,885,886],{},"A typical AI procurement scores accuracy on a canned set, integration logos, price per seat, and a security packet. Those are not worthless. They are incomplete.",[201,888,889,890,894,895,899],{},"Accuracy on a canned set does not tell you what the system does with your stale policy. ",[208,891,893],{"href":892},"https:\u002F\u002Fwww.cbc.ca\u002Fnews\u002Fcanada\u002Fbritish-columbia\u002Fair-canada-chatbot-lawsuit-1.7116416","Air Canada’s chatbot"," was not failing a benchmark. It was contradicting the company’s own bereavement rule, and ",[208,896,898],{"href":897},"https:\u002F\u002Fwww.canlii.org\u002Fen\u002Fbc\u002Fbccrt\u002Fdoc\u002F2024\u002F2024bccrt149\u002F2024bccrt149.html","the tribunal"," held the company to the contradiction. A buyer who never ran the demo against their own live rule bought a spokesperson.",[201,901,902],{},"Price per seat hides the production meter. Two customers with the same headcount will consume wildly different inference once one of them lets the tool touch real volume. If the contract converts overages into a surprise, finance will meet the tool again as a variance, not as a project. Ask for the unit of work and the ceiling, and ask what the product does when the ceiling is hit. A product that continues and bills is a different risk from a product that stops and records the stop.",[201,904,905,906,909,910,912],{},"The security packet is a snapshot. ",[208,907,908],{"href":210},"IBM’s 2025 findings"," — 97 percent of organisations with an AI-related breach lacking access controls, shadow AI in one in five breaches — describe customers more than they describe vendors. A vendor can be certified and still be deployed, by you, without access control. Procurement’s job is to make the deployment conditions contractual: identity, least privilege, logging, a ban on training on your prompts unless you opt in in writing. ",[208,911,352],{"href":351}," is a reasonable exhibit to attach. A logo on a slide is not.",[243,914,915,928],{},[246,916,917],{},[249,918,919,922,925],{},[252,920,921],{},"What the scorecard weights",[252,923,924],{},"What it does not tell you",[252,926,927],{},"The test that belongs in the RFP",[262,929,930,941,952,963],{},[249,931,932,935,938],{},[267,933,934],{},"Accuracy on a canned set",[267,936,937],{},"What the system does with your stale policy",[267,939,940],{},"Run it against the live rule. If it contradicts you, you are buying a spokesperson",[249,942,943,946,949],{},[267,944,945],{},"Integration logos",[267,947,948],{},"Whether a connector can write, and who can cut it off at 9 p.m.",[267,950,951],{},"Read versus write, an owner, and a kill switch",[249,953,954,957,960],{},[267,955,956],{},"Price per seat",[267,958,959],{},"The production meter once the tool touches real volume",[267,961,962],{},"Unit of work, ceiling, and whether hitting the ceiling stops or bills",[249,964,965,968,971],{},[267,966,967],{},"A security packet",[267,969,970],{},"How you will deploy it. Certified vendors are still deployed without access control",[267,972,973],{},"Identity, least privilege, logging, and no training on your prompts unless you opt in in writing",[214,975,977],{"id":976},"claims-are-a-procurement-issue","Claims are a procurement issue",[201,979,980,981,985,986,989],{},"Vendors are under the same pressure as their customers to sound advanced. Some will overshoot. The ",[208,982,984],{"href":983},"https:\u002F\u002Fwww.sec.gov\u002Fnewsroom\u002Fpress-releases\u002F2024-36","SEC’s cases against Delphia and Global Predictions"," were about advisers, not software firms, but the pattern — “AI-driven” as an untrue statement of fact — is one a buyer should assume exists in the market. The ",[208,987,988],{"href":449},"FTC has told advertisers"," to keep AI claims in check. Translate that into the RFP. Require the bidder to describe, for each headline claim, the feature that implements it today, not on the roadmap. Reserve a right to test that feature on your data before acceptance. If the claim is “human in the loop,” make them show the screen the human sees and the state in which the system is blocked without that human.",[201,991,992,994],{},[208,993,563],{"href":562}," certification, where a vendor has it, is a sign they run a management system. It is not a sign their sales deck is precise. Read the deck against the admin guide.",[243,996,997,1010],{},[246,998,999],{},[249,1000,1001,1004,1007],{},[252,1002,1003],{},"Headline claim",[252,1005,1006],{},"What you require before it scores",[252,1008,1009],{},"Fail",[262,1011,1012,1023,1034,1045],{},[249,1013,1014,1017,1020],{},[267,1015,1016],{},"“AI-driven,” “ensures,” “the first”",[267,1018,1019],{},"The feature that implements it today, not on the roadmap, tested on your data",[267,1021,1022],{},"The deck describes a roadmap. The admin guide does not",[249,1024,1025,1028,1031],{},[267,1026,1027],{},"“Human in the loop”",[267,1029,1030],{},"The screen the human sees, and the state in which the system is blocked without them",[267,1032,1033],{},"The human sees a digest the next morning",[249,1035,1036,1039,1042],{},[267,1037,1038],{},"“Will not invent policy”",[267,1040,1041],{},"A refusal, in your environment, on your stale document, on purpose",[267,1043,1044],{},"They cannot refuse. The claim is advertising",[249,1046,1047,1050,1053],{},[267,1048,1049],{},"A management-system certificate",[267,1051,1052],{},"Hygiene. Still read the deck against the admin guide",[267,1054,1055],{},"The certificate is asked to stand in for the afternoon you did not spend breaking the product",[214,1057,1059],{"id":1058},"what-a-good-pilot-contract-looks-like","What a good pilot contract looks like",[201,1061,1062],{},"Procurement’s leverage is highest before signature and almost gone after. Use it to buy a pilot that can fail, not a subscription that can only expand.",[201,1064,1065,1066,1070],{},"The pilot has a named job inside your company, not the vendor’s script. One team, one class of work, a frozen baseline from the month before: cycle time, error or reopen rate, and the concessions or rework you already measure. The vendor may help instrument the run. The vendor does not get to define success as “users liked it.” Liking is not a control. ",[208,1067,1069],{"href":1068},"https:\u002F\u002Fwww.mckinsey.com\u002Fcapabilities\u002Fquantumblack\u002Four-insights\u002Fthe-state-of-ai","Most organisations are still piloting",". A pilot that cannot fail is how that sentence stays true for another year.",[201,1072,1073],{},"The pilot also has a ceiling. Spend, messages, and — if a write exists — the value of the write. Hitting the ceiling stops the run and pages a person. A ceiling that only sends a warning is a suggestion. Put the stop in the order form. Put the owner, a company employee, in the order form too. If the sponsor cannot name the owner, you do not have a deployment. You have a demo with a purchase order.",[201,1075,1076],{},"Demand the artefacts the demo skipped. Where an answer came from, shown to a non-specialist. What is retained, for how long, in which region. Whether prompts are used to improve a model, and how the enterprise agreement changes that default. How you export prompts, configurations, and logs. How fast a connector that can write can be cut off, and who can cut it off at 9 p.m. These are buying questions you already ask of systems that move money or personal data. The fact that the interface is a conversation does not retire them. A customer-facing answer has already been treated as the company’s answer. Buy the log before you buy the fluency.",[201,1078,1079],{},"Score claims against the documentation, not against the deck. If the proposal says the system will not invent policy, have the vendor show the refusal in your environment, on your stale document, on purpose. If they cannot refuse, the claim is advertising. Advertising claims about AI are already a regulatory subject. You do not need a novel clause. You need the refusal recorded in the pilot notes, and a warranty that matches what you saw. A management-system certificate can support the vendor’s hygiene. It cannot replace the afternoon you spent trying to make the product break.",[201,1081,1082,1083,1085],{},"Finally, price the labour you inherit. Someone must keep the cited policy current, review the class of output that can become a promise, and answer the screenshot. If that labour is not in the business case, send the business case back. Procurement is allowed to be the function that says the saving is not real yet. That is the job. A seat price times a headcount, with no unit of work and no reviewer, is how the company acquires a tool it cannot explain and a bill it cannot attribute. The SEC cases were about public descriptions. An internal description you cannot open is how you get there. The ",[208,1084,577],{"href":441}," will make some of this documentary duty statutory for higher-risk uses. Buyers who wait for the statute to teach them the questions will pay for the lesson in a tender they cannot score.",[243,1087,1088,1098],{},[246,1089,1090],{},[249,1091,1092,1095],{},[252,1093,1094],{},"In the order form",[252,1096,1097],{},"If it is missing",[262,1099,1100,1108,1116,1124,1132,1140],{},[249,1101,1102,1105],{},[267,1103,1104],{},"One named job, one team, a baseline frozen last month",[267,1106,1107],{},"The vendor’s script will become the success metric",[249,1109,1110,1113],{},[267,1111,1112],{},"Cycle time, error or reopen rate, concessions or rework",[267,1114,1115],{},"“Users liked it” will be the result. Liking is not a control",[249,1117,1118,1121],{},[267,1119,1120],{},"A ceiling on spend, messages, and the value of any write. Hitting it stops the run",[267,1122,1123],{},"A warning is a suggestion. A product that continues and bills is a different contract",[249,1125,1126,1129],{},[267,1127,1128],{},"A company employee as owner",[267,1130,1131],{},"A demo with a purchase order",[249,1133,1134,1137],{},[267,1135,1136],{},"Retention, region, training default, export, and who can cut a write connector at 9 p.m.",[267,1138,1139],{},"You bought fluency and not the log",[249,1141,1142,1145],{},[267,1143,1144],{},"Labour: who updates the cited rule, who reads the sample, who answers the screenshot",[267,1146,1147],{},"The saving is not real yet. Send the business case back",[214,1149,1151],{"id":1150},"after-signature-the-scorecard-is-yours","After signature, the scorecard is yours",[201,1153,1154],{},"The contract does not operate the tool. In the first month, run the job you named, against the baseline you froze, and keep the refusal when the product invents a policy you do not have. If the vendor’s success manager wants to substitute a different job because it demos better, that is a no. You bought a job. A customer-facing answer remains yours when the job is live, which is why the first month is a legal event and not only an onboarding plan.",[201,1156,1157],{},"Hold the ceiling. If spend or writes blow through it, the run stops. A vendor that treats the ceiling as a notification has sold you a meter, not a control. Escalate that as a contract performance issue, not as a training issue. At the same time, name the internal labour: who updates the cited rule, who reads the sample, who answers the screenshot. If those names are vacant, pause rollout. A vacant name is how a purchase becomes the pile of tools surveys keep finding inside companies that have not scaled.",[201,1159,1160],{},"When the quarter ends, decide with the scorecard you wrote before you were charmed. Promote, narrow, or stop. Do not let a renewal auto-execute because the purchase order is easier to repeat than to revisit. If you stop, export the configuration and revoke the credentials in the same week. A stopped pilot with a live token is still a system. Claims in the proposal that the documentation does not support should already have been struck. If they survived into the contract, surviving them into the website is how a buying mistake becomes a public one.",[214,1162,1164],{"id":1163},"the-first-month-is-the-contract","The first month is the contract",[201,1166,1167],{},"Run the named job against the frozen baseline. Keep every refusal. If the vendor swaps in a prettier job, decline. Hold the ceiling as a stop, not a warning. If the internal owner of the cited rule is still unnamed, pause. At the quarter, promote, narrow, or stop, and if you stop, export the configuration and revoke the token the same week. A live token is not a cancelled pilot. Auto-renewal is how a demo becomes a permanent system nobody chose twice. Choose twice. A second signature is the point of having a scorecard. Without it, the renewal is inertia.",[243,1169,1170,1183],{},[246,1171,1172],{},[249,1173,1174,1177,1180],{},[252,1175,1176],{},"First month",[252,1178,1179],{},"Hold",[252,1181,1182],{},"Pause or stop",[262,1184,1185,1196,1207,1218,1229],{},[249,1186,1187,1190,1193],{},[267,1188,1189],{},"The job",[267,1191,1192],{},"The one named in the order form, against the frozen baseline",[267,1194,1195],{},"A prettier job the success manager prefers",[249,1197,1198,1201,1204],{},[267,1199,1200],{},"The refusal",[267,1202,1203],{},"Kept, especially when the product invents a policy you do not have",[267,1205,1206],{},"A month of fluency and no refusal. You cannot see the control",[249,1208,1209,1212,1215],{},[267,1210,1211],{},"The ceiling",[267,1213,1214],{},"A stop that pages a person",[267,1216,1217],{},"A warning, or a bill. That is a meter",[249,1219,1220,1223,1226],{},[267,1221,1222],{},"The names",[267,1224,1225],{},"Who updates the rule, who reads the sample, who answers the screenshot",[267,1227,1228],{},"Any vacancy. Rollout waits",[249,1230,1231,1234,1237],{},[267,1232,1233],{},"Quarter end",[267,1235,1236],{},"Promote, narrow, or stop. A stop exports the configuration and revokes the token the same week",[267,1238,1239],{},"Auto-renewal. A live token is not a cancelled pilot",[214,1241,1243],{"id":1242},"a-call-to-chief-procurement-officers","A call to chief procurement officers",[201,1245,1246],{},"You are not late to a technology trend. You are on time for a buying discipline you already know, applied to a product that talks. Make the vendor show the control, not the fluent sample. Make your own sponsor show the owner and the baseline. Refuse seat maths that do not state the unit of work.",[201,1248,1249],{},"The companies that look sophisticated in this market will not be the ones with the most logos. They will be the ones whose contracts describe the workflow that actually runs on the Tuesday after go-live.",[753,1251],{},[214,1253,758],{"id":757},[652,1255,1256,1261,1266,1270,1274,1279,1283,1287,1292],{},[655,1257,1258],{},[208,1259,1260],{"href":892},"CBC News, Air Canada chatbot liability",[655,1262,1263],{},[208,1264,1265],{"href":897},"Moffatt v. Air Canada, 2024 BCCRT 149",[655,1267,1268],{},[208,1269,765],{"href":210},[655,1271,1272],{},[208,1273,791],{"href":351},[655,1275,1276],{},[208,1277,1278],{"href":983},"U.S. SEC press release 2024-36",[655,1280,1281],{},[208,1282,805],{"href":449},[655,1284,1285],{},[208,1286,563],{"href":562},[655,1288,1289],{},[208,1290,1291],{"href":1068},"McKinsey, The State of AI: Global Survey 2025",[655,1293,1294],{},[208,1295,796],{"href":441},{"title":169,"searchDepth":170,"depth":170,"links":1297},[1298,1299,1300,1301,1302,1303,1304],{"id":882,"depth":170,"text":883},{"id":976,"depth":170,"text":977},{"id":1058,"depth":170,"text":1059},{"id":1150,"depth":170,"text":1151},{"id":1163,"depth":170,"text":1164},{"id":1242,"depth":170,"text":1243},{"id":757,"depth":170,"text":758},"Why standard RFPs fail to catch systemic AI risk, unowned connectors, and data retention traps, and how to fix your procurement scorecard.",{"eyebrow":820,"title":1307},"The risk arrives after the RFP",[1309,1312,1315],{"question":1310,"answer":1311},"What does a typical AI RFP miss?","It asks for features. The risk arrives later as a connector, a retention clause, and a workflow procurement has not seen run.",{"question":1313,"answer":1314},"What should procurement ask to see?","A real job: which system changes, who signs, what is retained, and what happens when the vendor is removed.",{"question":1316,"answer":1317},"Why is a demo a poor proxy?","A demo shows the happy path. Operating risk is the path where the assistant is allowed to act.","\u002Fblog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk",{"title":866,"description":1305},"blog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk",[837,1322,1323,840],"procurement","vendors","NzCfwEPO5DSKNmZc10mxZ7Hi7Fdvt-lXcthkquVyM1Q",{"id":1326,"title":1327,"archived":163,"authors":1328,"badge":1330,"body":1331,"date":817,"definedTerm":164,"department":164,"description":1753,"extension":172,"eyebrow":164,"faqHeader":1754,"faqs":1756,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1766,"relatedHeading":164,"seo":1767,"series":834,"sitemap":131,"status":164,"stem":1768,"subhead":164,"tags":1769,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1772},"content\u002Fblog\u002Fmodel-concentration-is-an-operating-risk.md","The Hidden Risk of Single-Model Dependency Across the Enterprise",[1329],{"name":194,"to":195},{"label":197},{"type":166,"value":1332,"toc":1745},[1333,1336,1346,1350,1361,1372,1381,1391,1467,1471,1474,1481,1488,1550,1554,1557,1560,1563,1566,1569,1630,1634,1637,1691,1695,1698,1701,1703,1705],[201,1334,1335],{},"Critical suppliers are a board topic when they are a factory, a cloud region, or a payments network. They are a footnote when they are a model. That classification is out of date. A provider that sits inside the forecast commentary, the customer channel, the software build, and the staff’s daily drafting is no longer a tool. It is a dependency. If its prices change, its terms change, its safety filter changes, or its service degrades, the operating rhythm degrades with it. Calling this a partnership does not diversify it.",[201,1337,1338,1341,1342,1345],{},[208,1339,1340],{"href":1068},"McKinsey’s 2025 survey"," shows why the dependency accumulates quietly: use is already normal — 88 percent of organisations in at least one function — while enterprise scaling is not. Teams adopt whatever is easiest, often the same famous model, because nobody has been asked to design for exit. ",[208,1343,1344],{"href":234},"Microsoft’s Work Trend Index"," adds personal concentration: 78 percent of AI users bring their own tools, which in practice means a very small number of consumer brands. The enterprise standardises by accident on the same names the staff already opened.",[214,1347,1349],{"id":1348},"what-concentration-actually-threatens","What concentration actually threatens",[201,1351,1352,1355,1356,1360],{},[330,1353,1354],{},"Terms."," A vendor that reserves the right to train on inputs, retain prompts, or change subprocessors can turn a renewal into a data-protection event. The ",[208,1357,1359],{"href":1358},"https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002Fartificial-intelligence\u002Fguidance-on-ai-and-data-protection\u002F","ICO’s AI guidance"," is a reminder that purpose and security duties sit with the controller, not with the brand of the model. If you cannot leave, you cannot renegotiate those duties. You can only accept them.",[201,1362,1363,1366,1367,1371],{},[330,1364,1365],{},"Behaviour."," Models change without a release note your operators would recognise as a change. A filter tightens and a legitimate workflow starts failing. A filter loosens and a customer-facing assistant becomes more willing to speculate. ",[208,1368,1370],{"href":1369},"https:\u002F\u002Fwww.reuters.com\u002Ftechnology\u002Fgoogle-ai-chatbot-bard-offers-inaccurate-information-company-ad-2023-02-08\u002F","The Bard demo"," showed how a single public error moves a market. An internal error moves a forecast or a promise. If you have no second model that can run the same job, you cannot even tell whether the failure is yours or theirs.",[201,1373,1374,1377,1378,1380],{},[330,1375,1376],{},"Price."," Seat-plus-usage contracts feel smooth until usage is the business. A concentrated vendor can price the increment because switching means revalidating every job. Procurement scored the demo. The switching cost was never scored. ",[208,1379,563],{"href":562}," will not choose your second supplier. It will at least force you to name the suppliers you have and the impact if they fail.",[201,1382,1383,1386,1387,1390],{},[330,1384,1385],{},"Claims."," If your market story is “we run on X,” you have coupled your disclosure to X’s reputation. The ",[208,1388,1389],{"href":983},"SEC’s AI-washing cases"," were about false claims of capability. A true claim of total dependence is a different risk: when X has an outage or a scandal, your operational status and your narrative move together.",[243,1392,1393,1409],{},[246,1394,1395],{},[249,1396,1397,1400,1403,1406],{},[252,1398,1399],{},"What moves",[252,1401,1402],{},"What you feel first",[252,1404,1405],{},"Why you cannot leave in the notice period",[252,1407,1408],{},"What to have already stored",[262,1410,1411,1425,1439,1453],{},[249,1412,1413,1416,1419,1422],{},[267,1414,1415],{},"Terms: training on inputs, retention, subprocessors",[267,1417,1418],{},"A data-protection question at renewal",[267,1420,1421],{},"Purpose and security sit with you, not with the brand",[267,1423,1424],{},"The agreement, the region, and a path that does not accept the new default",[249,1426,1427,1430,1433,1436],{},[267,1428,1429],{},"Behaviour: a filter tightens or loosens",[267,1431,1432],{},"A workflow fails, or a customer-facing answer speculates",[267,1434,1435],{},"You cannot tell a vendor change from your own bug",[267,1437,1438],{},"A second model that can run the same job against the same sources",[249,1440,1441,1444,1447,1450],{},[267,1442,1443],{},"Price: usage becomes the business",[267,1445,1446],{},"The increment is priced because switching means revalidating every job",[267,1448,1449],{},"The demo was scored. The exit was not",[267,1451,1452],{},"Time-to-cutover from a drill, not a hope",[249,1454,1455,1458,1461,1464],{},[267,1456,1457],{},"Claims: “we run on X”",[267,1459,1460],{},"An outage or a scandal moves your operations and your story together",[267,1462,1463],{},"The disclosure is coupled to someone else’s reputation",[267,1465,1466],{},"A description of the job that does not depend on the logo",[214,1468,1470],{"id":1469},"a-resilience-test-that-fits-on-one-page","A resilience test that fits on one page",[201,1472,1473],{},"List the jobs that would miss a customer commitment, a close, or a release if the primary model were unavailable for five days. For each, name the fallback: a second model, a human procedure, or a degraded service you are willing to announce. If the fallback is “wait,” you have accepted a single point of failure. Write that down where the board can see it. Hidden acceptance is how concentration becomes a surprise.",[201,1475,1476,1477,1480],{},"For the jobs that write or promise, the fallback has to include the control, not only the prose. A second model that is more willing to invent a discount is not resilience. It is a second ",[208,1478,1479],{"href":892},"Air Canada",". The policy, the approval, and the log should be yours. The model should be replaceable underneath them. Companies that embed the rule in a vendor’s proprietary instruction will discover, at renewal, that the rule is not portable.",[201,1482,1483,1484,1487],{},"Test the exit once a year the way you test a restore. Take one real job. Run it on the alternative. Compare the output against the same sources. Time the cutover. The first test will be humbling. That is the point. A test you have not run is a hope, and hopes are what ",[208,1485,1486],{"href":210},"IBM’s access-control findings"," suggest companies have been operating on: systems in production without the controls that would make them substitutable or even inspectable.",[243,1489,1490,1506],{},[246,1491,1492],{},[249,1493,1494,1497,1500,1503],{},[252,1495,1496],{},"Job that would miss a commitment, a close, or a release",[252,1498,1499],{},"Fallback if the primary model is dark for five days",[252,1501,1502],{},"Control that must travel with it",[252,1504,1505],{},"If the cell says “wait”",[262,1507,1508,1522,1536],{},[249,1509,1510,1513,1516,1519],{},[267,1511,1512],{},"Name the job a customer would recognise",[267,1514,1515],{},"A second model, a human procedure, or a degraded service you will announce",[267,1517,1518],{},"The policy, the approval, and the log stay yours. The model is underneath",[267,1520,1521],{},"You have accepted a single point of failure. Put it in the board pack",[249,1523,1524,1527,1530,1533],{},[267,1525,1526],{},"A job that writes or promises",[267,1528,1529],{},"The alternative must be able to refuse a discount the policy does not allow",[267,1531,1532],{},"A second model that invents a remedy is a second spokesperson, not a fallback",[267,1534,1535],{},"Do not call it resilience",[249,1537,1538,1541,1544,1547],{},[267,1539,1540],{},"One job you will actually cut over this year",[267,1542,1543],{},"Time the cutover. Compare outputs against the same sources",[267,1545,1546],{},"Prompts and policy as files you hold, not settings in a console",[267,1548,1549],{},"A test you have not run is a hope",[214,1551,1553],{"id":1552},"the-renewal-you-should-be-able-to-walk-away-from","The renewal you should be able to walk away from",[201,1555,1556],{},"Concentration is not a philosophical worry about markets. It is the renewal conversation in which you cannot leave. You discover it when a price change, a retention change, or an outage arrives with notice, and the list of exposed jobs is assembled by asking around. Sales says the assistant only drafts. The draft is the proposal. Support says they can fall back to macros. The macros were generated and never filed. Engineering says the coding tool is optional. The last release was reviewed by people who used it to explain code they did not write. Optional became structural while the contract still said convenience.",[201,1558,1559],{},"A company that can walk away has already done the dull work. The prompts and the policy text exist as files you own, not only as settings in a vendor console. The evaluation set — a few dozen real tasks with the answer you would accept — is saved, so “the other model is worse” is a comparison rather than a mood. Credentials are per job, so cutover is not a security project you start during the notice period. Access control is the control most often missing when AI systems show up in breach reports. It is also the control that makes an exit possible. You cannot move a job whose identity you cannot name.",[201,1561,1562],{},"Run the alternative twice a year on the five jobs you would miss in a week. Record time-to-cutover and the share of outputs a person rejected. Those are the concentration metrics. A second model that refuses more often is not automatically a failure. Some refusals are the policy, finally enforced. The promise, on either model, is still yours. Portability includes the refusal.",[201,1564,1565],{},"Do not confuse an enterprise agreement with a reduction in concentration if staff still do the sensitive work in personal accounts. Bring-your-own use is the norm among AI users. That is a second dependency, often on the same small set of brands, with worse logs. An exit plan that ignores it will discover, in the crisis, that the work was never on the contract you are trying to leave.",[201,1567,1568],{},"The board question is the one you already ask of payroll, identity, and payments: what is the worst week, and what do we do on the Monday? If the answer is the vendor’s status page, you do not have a supplier. You have a single point of operation. Fund the alternative before you need it. Needing it is a bad time to discover you cannot.",[243,1570,1571,1584],{},[246,1572,1573],{},[249,1574,1575,1578,1581],{},[252,1576,1577],{},"What people will say in the notice period",[252,1579,1580],{},"What has actually become structural",[252,1582,1583],{},"What “able to walk away” requires",[262,1585,1586,1597,1608,1619],{},[249,1587,1588,1591,1594],{},[267,1589,1590],{},"“It only drafts”",[267,1592,1593],{},"The draft is the proposal",[267,1595,1596],{},"The proposal template and the rule live in files you own",[249,1598,1599,1602,1605],{},[267,1600,1601],{},"“We can fall back to macros”",[267,1603,1604],{},"The macros were generated and never filed",[267,1606,1607],{},"A filed procedure someone other than the vendor can run",[249,1609,1610,1613,1616],{},[267,1611,1612],{},"“The coding tool is optional”",[267,1614,1615],{},"The last release was reviewed by people who used it to explain code they did not write",[267,1617,1618],{},"An evaluation set of real tasks, with the answer you would accept",[249,1620,1621,1624,1627],{},[267,1622,1623],{},"“We have an enterprise agreement”",[267,1625,1626],{},"Sensitive work is still on personal accounts, often the same brands",[267,1628,1629],{},"The work has moved onto the contract, or the exit plan is fiction",[214,1631,1633],{"id":1632},"a-drill-with-a-date-on-it","A drill with a date on it",[201,1635,1636],{},"Twice a year, cut the five jobs you would miss in a bad week over to an alternative, using prompts, policy text, and evaluation cases you store yourselves. Write down how long it took and what a person rejected. If you cannot start the drill because the prompts live only in the vendor’s console, that fact is the finding. Fix the finding before the renewal, not during a price dispute. An identity you can name and revoke is part of the drill. So is the personal-account path: if the sensitive work never moved onto the contract, leaving the contract will not move the work. Report the drill to the board in two numbers. Logo count is not one of them. If the drill did not happen, report that. Absence is the concentration.",[243,1638,1639,1649],{},[246,1640,1641],{},[249,1642,1643,1646],{},[252,1644,1645],{},"Report this",[252,1647,1648],{},"Not this",[262,1650,1651,1659,1667,1675,1683],{},[249,1652,1653,1656],{},[267,1654,1655],{},"Time to cut the five jobs over",[267,1657,1658],{},"How many model logos are on the architecture slide",[249,1660,1661,1664],{},[267,1662,1663],{},"Share of outputs a person rejected on the alternative",[267,1665,1666],{},"A mood that “the other model is worse”",[249,1668,1669,1672],{},[267,1670,1671],{},"Whether prompts and policy were already files you hold",[267,1673,1674],{},"A finding discovered during the price dispute",[249,1676,1677,1680],{},[267,1678,1679],{},"Whether the sensitive work was on the contract at all",[267,1681,1682],{},"An enterprise agreement that staff do not use for the sensitive work",[249,1684,1685,1688],{},[267,1686,1687],{},"“The drill did not happen,” if it did not",[267,1689,1690],{},"Silence. Absence is the concentration",[214,1692,1694],{"id":1693},"a-call-to-chief-strategy-and-technology-officers","A call to chief strategy and technology officers",[201,1696,1697],{},"Treat the model provider as critical infrastructure when the jobs are critical, and as a commodity when they are not. Most companies have it backwards: commodity treatment of a critical dependency, and strategic language for a chatbot that drafts internal notes.",[201,1699,1700],{},"Name the five jobs you would not want to run on a single provider. Build the fallback before the renewal conversation, not during it. The negotiation you want is the one you can walk away from. Concentration is what happens when you no longer can, and have decided not to notice.",[753,1702],{},[214,1704,758],{"id":757},[652,1706,1707,1711,1715,1720,1725,1729,1733,1737,1741],{},[655,1708,1709],{},[208,1710,1291],{"href":1068},[655,1712,1713],{},[208,1714,781],{"href":234},[655,1716,1717],{},[208,1718,1719],{"href":1358},"ICO, guidance on AI and data protection",[655,1721,1722],{},[208,1723,1724],{"href":1369},"Reuters, Alphabet shares and the Bard demo",[655,1726,1727],{},[208,1728,563],{"href":562},[655,1730,1731],{},[208,1732,1278],{"href":983},[655,1734,1735],{},[208,1736,1260],{"href":892},[655,1738,1739],{},[208,1740,765],{"href":210},[655,1742,1743],{},[208,1744,791],{"href":351},{"title":169,"searchDepth":170,"depth":170,"links":1746},[1747,1748,1749,1750,1751,1752],{"id":1348,"depth":170,"text":1349},{"id":1469,"depth":170,"text":1470},{"id":1552,"depth":170,"text":1553},{"id":1632,"depth":170,"text":1633},{"id":1693,"depth":170,"text":1694},{"id":757,"depth":170,"text":758},"Relying on a single foundation model for forecasts, customer support, and code creates a single point of operational failure.",{"eyebrow":820,"title":1755},"One provider, many jobs",[1757,1760,1763],{"question":1758,"answer":1759},"What is model concentration?","One provider drafting the forecasts, the customer replies, and the code. The company describes it as a partnership. It is a single point of failure.",{"question":1761,"answer":1762},"Why treat it like a supplier risk?","Because an outage, a price change, or a policy change now stops more than one function at once.",{"question":1764,"answer":1765},"What is the practical control?","A routing policy and a record of which model did which job, so a second provider is a switch, not a rewrite.","\u002Fblog\u002Fmodel-concentration-is-an-operating-risk",{"title":1327,"description":1753},"blog\u002Fmodel-concentration-is-an-operating-risk",[837,1323,1770,1771],"resilience","strategy","OPXNpGLuTEbHZ4Z35fIbTPE50AcBG8sfI1ojB2sIecI",{"fold":1774,"id":1778,"title":1779,"archived":163,"authors":164,"badge":164,"body":1780,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":1784,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1788,"relatedHeading":164,"seo":1789,"series":164,"sitemap":163,"status":164,"stem":1790,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1791},{"headline":1775,"description":1776,"primaryLabel":8,"primaryTo":1777,"secondaryLabel":858,"secondaryTo":12},"Run frontier AI your business actually owns.","Governed workstreams, 3,000+ integrations, and a proprietary knowledge graph. Start on Free.","\u002Fsignup?plan=free","content\u002Fshared\u002Fcta.md","Site CTAs",{"type":166,"value":1781,"toc":1782},[],{"title":169,"searchDepth":170,"depth":170,"links":1783},[],{"headline":1785,"description":1786,"primaryLabel":8,"primaryTo":1777,"secondaryLabel":1787,"secondaryTo":85},"See what governed AI looks like on your stack.","Connect your tools, run a workstream, and keep every decision on your ledger. Start on Free.","Talk to our team","\u002Fshared\u002Fcta",{"title":1779,"description":169},"shared\u002Fcta","eYqahyaPnbp8GKrWpoORbZdtmkWmgHr5F61ZHOnb8sY",1791647061256]