[{"data":1,"prerenderedAt":1847},["ShallowReactive",2],{"site-nav-content":3,"hiring-banner-content":177,"blog:\u002Fblog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk":189,"blog-index-copy":683,"blog:\u002Fblog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk:surround":704,"site-cta-content":1828},{"header":4,"productNav":9,"nav":42,"footer":61,"askAI":132,"id":161,"title":162,"archived":163,"authors":164,"badge":164,"body":165,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":173,"relatedHeading":164,"seo":174,"series":164,"sitemap":163,"status":164,"stem":175,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":176},{"productLabel":5,"loginLabel":6,"contactLabel":7,"contactSalesLabel":8},"Product","Log in","Contact","Get started for free",[10,14,18,22,26,30,34,38],{"label":11,"to":12,"description":13},"Overview","\u002Foverview","Seven layers. One closed loop.",{"label":15,"to":16,"description":17},"Conflux","\u002Fproduct\u002Fconflux","Where your team, workstreams, and agents meet.",{"label":19,"to":20,"description":21},"Agent Teams","\u002Fproduct\u002Fagent-teams","Specialist teams - governed from day one.",{"label":23,"to":24,"description":25},"Lifecycle Graph","\u002Fproduct\u002Flifecycle-graph","Intelligence that compounds across every interaction.",{"label":27,"to":28,"description":29},"Company Wiki","\u002Fproduct\u002Fwiki","Playbooks and policies where expertise stays.",{"label":31,"to":32,"description":33},"Workstreams","\u002Fproduct\u002Fworkstreams","From brief to signed-off deliverable on one canvas.",{"label":35,"to":36,"description":37},"Perception Console","\u002Fproduct\u002Fperception","Ask your whole business in plain English.",{"label":39,"to":40,"description":41},"Governance","\u002Fproduct\u002Fgovernance","Frontier AI you can actually sign off on.",[43,46,49,52,55,58],{"label":44,"to":45},"Models","\u002Fmodels",{"label":47,"to":48},"Pricing","\u002Fpricing",{"label":50,"to":51},"Integrations","\u002Fintegrations",{"label":53,"to":54},"Security","\u002Fsecurity",{"label":56,"to":57},"Partners","\u002Fpartners",{"label":59,"to":60},"Insights","\u002Fblog",{"productHeading":5,"companyHeading":62,"resourcesHeading":63,"legalHeading":64,"docsLabel":65,"docsUrl":66,"statementLines":67,"copyright":70,"companyLinks":71,"resourcesLinks":86,"legalLinks":102,"socialLinks":109,"bottomLinks":119},"Company","Resources","Legal","Docs","https:\u002F\u002Fdocs.gonimbus.ai",[68,69],"Stop training someone else's model.","Control your AI.","© 2026 Nimbus Intelligence, Inc. All rights reserved.",[72,73,74,75,76,78,81,84],{"label":47,"to":48},{"label":50,"to":51},{"label":53,"to":54},{"label":59,"to":60},{"label":77,"to":57},"Partner Program",{"label":79,"to":80},"Careers","\u002Fcareers",{"label":82,"to":83},"System status","\u002Fstatus",{"label":7,"to":85},"\u002Fcontact",[87,90,93,96,99],{"label":88,"to":89},"Glossary","\u002Fglossary",{"label":91,"to":92},"Compare","\u002Fcompare",{"label":94,"to":95},"Evaluate","\u002Fevaluate",{"label":97,"to":98},"Problems","\u002Fproblems",{"label":100,"to":101},"Use cases","\u002Fuse-cases",[103,106],{"label":104,"to":105},"Terms of Service","\u002Fterms",{"label":107,"to":108},"Privacy Policy","\u002Fprivacy",[110,113,116],{"label":111,"href":112},"LinkedIn","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fgonimbusai\u002F",{"label":114,"href":115},"X","https:\u002F\u002Fx.com\u002Fgonimbusai",{"label":117,"href":118},"Instagram","https:\u002F\u002Fwww.instagram.com\u002Fgonimbus_ai\u002F",[120,122,124,127,128],{"label":121,"to":105},"Terms",{"label":123,"to":108},"Privacy",{"label":125,"to":126},"Compliance","\u002Fcompliance",{"label":82,"to":83},{"label":129,"to":130,"external":131},"LLMs.txt","\u002Fllms.txt",true,{"text":133,"prompt":134,"platforms":135},"Ask AI about Nimbus","I'm researching enterprise intelligence platforms and want to know how Nimbus combines perception, collaboration, and autonomous agents to drive strategic decision-making. Summarize the highlights from Nimbus's website: https:\u002F\u002Fgonimbus.ai",[136,141,146,151,156],{"name":137,"label":138,"icon":139,"hrefPrefix":140},"chatgpt","ChatGPT","simple-icons:openai","https:\u002F\u002Fchatgpt.com\u002F?prompt=",{"name":142,"label":143,"icon":144,"hrefPrefix":145},"perplexity","Perplexity","mdi:magnify","https:\u002F\u002Fwww.perplexity.ai\u002Fsearch\u002Fnew?q=",{"name":147,"label":148,"icon":149,"hrefPrefix":150},"grok","Grok","simple-icons:x","https:\u002F\u002Fx.com\u002Fi\u002Fgrok?text=",{"name":152,"label":153,"icon":154,"hrefPrefix":155},"claude","Claude","simple-icons:anthropic","https:\u002F\u002Fclaude.ai\u002Fnew?q=",{"name":157,"label":158,"icon":159,"hrefPrefix":160},"google-ai","Google AI","simple-icons:google","https:\u002F\u002Fwww.google.com\u002Fsearch?udm=50&aep=11&q=","content\u002Fshared\u002Fnav.md","Site navigation",false,null,{"type":166,"value":167,"toc":168},"minimark",[],{"title":169,"searchDepth":170,"depth":170,"links":171},"",2,[],"md","\u002Fshared\u002Fnav",{"title":162,"description":169},"shared\u002Fnav","Q7sDe7TuGEwhwUMamyeOxjvGlsUaF3Iay9VTW0KaE_U",{"enabled":163,"message":178,"linkLabel":79,"linkHref":80,"id":179,"title":180,"archived":163,"authors":164,"badge":164,"body":181,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":185,"relatedHeading":164,"seo":186,"series":164,"sitemap":163,"status":164,"stem":187,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":188},"We're hiring! Join the team building the Sentient Enterprise.","content\u002Fshared\u002Fhiring.md","Hiring banner",{"type":166,"value":182,"toc":183},[],{"title":169,"searchDepth":170,"depth":170,"links":184},[],"\u002Fshared\u002Fhiring",{"title":180,"description":169},"shared\u002Fhiring","1zs3boivKda1e-b-hAyuNcmZSKjZUAXmecnwHVgcHzk",{"id":190,"title":191,"archived":163,"authors":192,"badge":197,"body":199,"date":658,"definedTerm":164,"department":164,"description":659,"extension":172,"eyebrow":164,"faqHeader":660,"faqs":663,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":673,"relatedHeading":164,"seo":674,"series":675,"sitemap":131,"status":164,"stem":676,"subhead":164,"tags":677,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":682},"content\u002Fblog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk.md","Why Buying AI Demos Leaves Enterprise Procurement Exposed",[193],{"name":194,"role":195,"to":196},"Zac Radbone","Co-Founder and CCO","https:\u002F\u002Fgonimbus.ai",{"label":198},"Thought Leadership",{"type":166,"value":200,"toc":649},[201,205,208,213,216,230,233,246,313,317,330,337,398,402,405,413,416,419,422,430,492,496,499,502,505,509,512,584,588,591,594,597,601],[202,203,204],"p",{},"Enterprise buying was built for products that sit still. A database has a capacity. A suite has a seat. A security review has a questionnaire that mostly stays true after signature. Generative systems do not sit still. The model behind the demo changes. The vendor’s subprocessors change. The customer’s own staff discover uses the statement of work never named. Procurement, which is supposed to be the adult in the buying process, is still scoring the demo.",[202,206,207],{},"The result is a contract that buys a capability and inherits an operating model by accident. The operating model — who may paste what, what is retained, whether a human must approve a customer-facing sentence, what happens when the vendor’s claim exceeds the product — is where the cost and the liability are. It is rarely the section with the weighting in the scorecard.",[209,210,212],"h2",{"id":211},"what-the-scorecard-rewards","What the scorecard rewards",[202,214,215],{},"A typical AI procurement scores accuracy on a canned set, integration logos, price per seat, and a security packet. Those are not worthless. They are incomplete.",[202,217,218,219,224,225,229],{},"Accuracy on a canned set does not tell you what the system does with your stale policy. ",[220,221,223],"a",{"href":222},"https:\u002F\u002Fwww.cbc.ca\u002Fnews\u002Fcanada\u002Fbritish-columbia\u002Fair-canada-chatbot-lawsuit-1.7116416","Air Canada’s chatbot"," was not failing a benchmark. It was contradicting the company’s own bereavement rule, and ",[220,226,228],{"href":227},"https:\u002F\u002Fwww.canlii.org\u002Fen\u002Fbc\u002Fbccrt\u002Fdoc\u002F2024\u002F2024bccrt149\u002F2024bccrt149.html","the tribunal"," held the company to the contradiction. A buyer who never ran the demo against their own live rule bought a spokesperson.",[202,231,232],{},"Price per seat hides the production meter. Two customers with the same headcount will consume wildly different inference once one of them lets the tool touch real volume. If the contract converts overages into a surprise, finance will meet the tool again as a variance, not as a project. Ask for the unit of work and the ceiling, and ask what the product does when the ceiling is hit. A product that continues and bills is a different risk from a product that stops and records the stop.",[202,234,235,236,240,241,245],{},"The security packet is a snapshot. ",[220,237,239],{"href":238},"https:\u002F\u002Fnewsroom.ibm.com\u002F2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls","IBM’s 2025 findings"," — 97 percent of organisations with an AI-related breach lacking access controls, shadow AI in one in five breaches — describe customers more than they describe vendors. A vendor can be certified and still be deployed, by you, without access control. Procurement’s job is to make the deployment conditions contractual: identity, least privilege, logging, a ban on training on your prompts unless you opt in in writing. ",[220,242,244],{"href":243},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","NIST’s framework"," is a reasonable exhibit to attach. A logo on a slide is not.",[247,248,249,265],"table",{},[250,251,252],"thead",{},[253,254,255,259,262],"tr",{},[256,257,258],"th",{},"What the scorecard weights",[256,260,261],{},"What it does not tell you",[256,263,264],{},"The test that belongs in the RFP",[266,267,268,280,291,302],"tbody",{},[253,269,270,274,277],{},[271,272,273],"td",{},"Accuracy on a canned set",[271,275,276],{},"What the system does with your stale policy",[271,278,279],{},"Run it against the live rule. If it contradicts you, you are buying a spokesperson",[253,281,282,285,288],{},[271,283,284],{},"Integration logos",[271,286,287],{},"Whether a connector can write, and who can cut it off at 9 p.m.",[271,289,290],{},"Read versus write, an owner, and a kill switch",[253,292,293,296,299],{},[271,294,295],{},"Price per seat",[271,297,298],{},"The production meter once the tool touches real volume",[271,300,301],{},"Unit of work, ceiling, and whether hitting the ceiling stops or bills",[253,303,304,307,310],{},[271,305,306],{},"A security packet",[271,308,309],{},"How you will deploy it. Certified vendors are still deployed without access control",[271,311,312],{},"Identity, least privilege, logging, and no training on your prompts unless you opt in in writing",[209,314,316],{"id":315},"claims-are-a-procurement-issue","Claims are a procurement issue",[202,318,319,320,324,325,329],{},"Vendors are under the same pressure as their customers to sound advanced. Some will overshoot. The ",[220,321,323],{"href":322},"https:\u002F\u002Fwww.sec.gov\u002Fnewsroom\u002Fpress-releases\u002F2024-36","SEC’s cases against Delphia and Global Predictions"," were about advisers, not software firms, but the pattern — “AI-driven” as an untrue statement of fact — is one a buyer should assume exists in the market. The ",[220,326,328],{"href":327},"https:\u002F\u002Fwww.ftc.gov\u002Fbusiness-guidance\u002Fblog\u002F2023\u002F02\u002Fkeep-your-ai-claims-check","FTC has told advertisers"," to keep AI claims in check. Translate that into the RFP. Require the bidder to describe, for each headline claim, the feature that implements it today, not on the roadmap. Reserve a right to test that feature on your data before acceptance. If the claim is “human in the loop,” make them show the screen the human sees and the state in which the system is blocked without that human.",[202,331,332,336],{},[220,333,335],{"href":334},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F81230.html","ISO\u002FIEC 42001"," certification, where a vendor has it, is a sign they run a management system. It is not a sign their sales deck is precise. Read the deck against the admin guide.",[247,338,339,352],{},[250,340,341],{},[253,342,343,346,349],{},[256,344,345],{},"Headline claim",[256,347,348],{},"What you require before it scores",[256,350,351],{},"Fail",[266,353,354,365,376,387],{},[253,355,356,359,362],{},[271,357,358],{},"“AI-driven,” “ensures,” “the first”",[271,360,361],{},"The feature that implements it today, not on the roadmap, tested on your data",[271,363,364],{},"The deck describes a roadmap. The admin guide does not",[253,366,367,370,373],{},[271,368,369],{},"“Human in the loop”",[271,371,372],{},"The screen the human sees, and the state in which the system is blocked without them",[271,374,375],{},"The human sees a digest the next morning",[253,377,378,381,384],{},[271,379,380],{},"“Will not invent policy”",[271,382,383],{},"A refusal, in your environment, on your stale document, on purpose",[271,385,386],{},"They cannot refuse. The claim is advertising",[253,388,389,392,395],{},[271,390,391],{},"A management-system certificate",[271,393,394],{},"Hygiene. Still read the deck against the admin guide",[271,396,397],{},"The certificate is asked to stand in for the afternoon you did not spend breaking the product",[209,399,401],{"id":400},"what-a-good-pilot-contract-looks-like","What a good pilot contract looks like",[202,403,404],{},"Procurement’s leverage is highest before signature and almost gone after. Use it to buy a pilot that can fail, not a subscription that can only expand.",[202,406,407,408,412],{},"The pilot has a named job inside your company, not the vendor’s script. One team, one class of work, a frozen baseline from the month before: cycle time, error or reopen rate, and the concessions or rework you already measure. The vendor may help instrument the run. The vendor does not get to define success as “users liked it.” Liking is not a control. ",[220,409,411],{"href":410},"https:\u002F\u002Fwww.mckinsey.com\u002Fcapabilities\u002Fquantumblack\u002Four-insights\u002Fthe-state-of-ai","Most organisations are still piloting",". A pilot that cannot fail is how that sentence stays true for another year.",[202,414,415],{},"The pilot also has a ceiling. Spend, messages, and — if a write exists — the value of the write. Hitting the ceiling stops the run and pages a person. A ceiling that only sends a warning is a suggestion. Put the stop in the order form. Put the owner, a company employee, in the order form too. If the sponsor cannot name the owner, you do not have a deployment. You have a demo with a purchase order.",[202,417,418],{},"Demand the artefacts the demo skipped. Where an answer came from, shown to a non-specialist. What is retained, for how long, in which region. Whether prompts are used to improve a model, and how the enterprise agreement changes that default. How you export prompts, configurations, and logs. How fast a connector that can write can be cut off, and who can cut it off at 9 p.m. These are buying questions you already ask of systems that move money or personal data. The fact that the interface is a conversation does not retire them. A customer-facing answer has already been treated as the company’s answer. Buy the log before you buy the fluency.",[202,420,421],{},"Score claims against the documentation, not against the deck. If the proposal says the system will not invent policy, have the vendor show the refusal in your environment, on your stale document, on purpose. If they cannot refuse, the claim is advertising. Advertising claims about AI are already a regulatory subject. You do not need a novel clause. You need the refusal recorded in the pilot notes, and a warranty that matches what you saw. A management-system certificate can support the vendor’s hygiene. It cannot replace the afternoon you spent trying to make the product break.",[202,423,424,425,429],{},"Finally, price the labour you inherit. Someone must keep the cited policy current, review the class of output that can become a promise, and answer the screenshot. If that labour is not in the business case, send the business case back. Procurement is allowed to be the function that says the saving is not real yet. That is the job. A seat price times a headcount, with no unit of work and no reviewer, is how the company acquires a tool it cannot explain and a bill it cannot attribute. The SEC cases were about public descriptions. An internal description you cannot open is how you get there. The ",[220,426,428],{"href":427},"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=OJ:L_202401689","EU AI Act"," will make some of this documentary duty statutory for higher-risk uses. Buyers who wait for the statute to teach them the questions will pay for the lesson in a tender they cannot score.",[247,431,432,442],{},[250,433,434],{},[253,435,436,439],{},[256,437,438],{},"In the order form",[256,440,441],{},"If it is missing",[266,443,444,452,460,468,476,484],{},[253,445,446,449],{},[271,447,448],{},"One named job, one team, a baseline frozen last month",[271,450,451],{},"The vendor’s script will become the success metric",[253,453,454,457],{},[271,455,456],{},"Cycle time, error or reopen rate, concessions or rework",[271,458,459],{},"“Users liked it” will be the result. Liking is not a control",[253,461,462,465],{},[271,463,464],{},"A ceiling on spend, messages, and the value of any write. Hitting it stops the run",[271,466,467],{},"A warning is a suggestion. A product that continues and bills is a different contract",[253,469,470,473],{},[271,471,472],{},"A company employee as owner",[271,474,475],{},"A demo with a purchase order",[253,477,478,481],{},[271,479,480],{},"Retention, region, training default, export, and who can cut a write connector at 9 p.m.",[271,482,483],{},"You bought fluency and not the log",[253,485,486,489],{},[271,487,488],{},"Labour: who updates the cited rule, who reads the sample, who answers the screenshot",[271,490,491],{},"The saving is not real yet. Send the business case back",[209,493,495],{"id":494},"after-signature-the-scorecard-is-yours","After signature, the scorecard is yours",[202,497,498],{},"The contract does not operate the tool. In the first month, run the job you named, against the baseline you froze, and keep the refusal when the product invents a policy you do not have. If the vendor’s success manager wants to substitute a different job because it demos better, that is a no. You bought a job. A customer-facing answer remains yours when the job is live, which is why the first month is a legal event and not only an onboarding plan.",[202,500,501],{},"Hold the ceiling. If spend or writes blow through it, the run stops. A vendor that treats the ceiling as a notification has sold you a meter, not a control. Escalate that as a contract performance issue, not as a training issue. At the same time, name the internal labour: who updates the cited rule, who reads the sample, who answers the screenshot. If those names are vacant, pause rollout. A vacant name is how a purchase becomes the pile of tools surveys keep finding inside companies that have not scaled.",[202,503,504],{},"When the quarter ends, decide with the scorecard you wrote before you were charmed. Promote, narrow, or stop. Do not let a renewal auto-execute because the purchase order is easier to repeat than to revisit. If you stop, export the configuration and revoke the credentials in the same week. A stopped pilot with a live token is still a system. Claims in the proposal that the documentation does not support should already have been struck. If they survived into the contract, surviving them into the website is how a buying mistake becomes a public one.",[209,506,508],{"id":507},"the-first-month-is-the-contract","The first month is the contract",[202,510,511],{},"Run the named job against the frozen baseline. Keep every refusal. If the vendor swaps in a prettier job, decline. Hold the ceiling as a stop, not a warning. If the internal owner of the cited rule is still unnamed, pause. At the quarter, promote, narrow, or stop, and if you stop, export the configuration and revoke the token the same week. A live token is not a cancelled pilot. Auto-renewal is how a demo becomes a permanent system nobody chose twice. Choose twice. A second signature is the point of having a scorecard. Without it, the renewal is inertia.",[247,513,514,527],{},[250,515,516],{},[253,517,518,521,524],{},[256,519,520],{},"First month",[256,522,523],{},"Hold",[256,525,526],{},"Pause or stop",[266,528,529,540,551,562,573],{},[253,530,531,534,537],{},[271,532,533],{},"The job",[271,535,536],{},"The one named in the order form, against the frozen baseline",[271,538,539],{},"A prettier job the success manager prefers",[253,541,542,545,548],{},[271,543,544],{},"The refusal",[271,546,547],{},"Kept, especially when the product invents a policy you do not have",[271,549,550],{},"A month of fluency and no refusal. You cannot see the control",[253,552,553,556,559],{},[271,554,555],{},"The ceiling",[271,557,558],{},"A stop that pages a person",[271,560,561],{},"A warning, or a bill. That is a meter",[253,563,564,567,570],{},[271,565,566],{},"The names",[271,568,569],{},"Who updates the rule, who reads the sample, who answers the screenshot",[271,571,572],{},"Any vacancy. Rollout waits",[253,574,575,578,581],{},[271,576,577],{},"Quarter end",[271,579,580],{},"Promote, narrow, or stop. A stop exports the configuration and revokes the token the same week",[271,582,583],{},"Auto-renewal. A live token is not a cancelled pilot",[209,585,587],{"id":586},"a-call-to-chief-procurement-officers","A call to chief procurement officers",[202,589,590],{},"You are not late to a technology trend. You are on time for a buying discipline you already know, applied to a product that talks. Make the vendor show the control, not the fluent sample. Make your own sponsor show the owner and the baseline. Refuse seat maths that do not state the unit of work.",[202,592,593],{},"The companies that look sophisticated in this market will not be the ones with the most logos. They will be the ones whose contracts describe the workflow that actually runs on the Tuesday after go-live.",[595,596],"hr",{},[209,598,600],{"id":599},"references","References",[602,603,604,610,615,620,625,630,635,639,644],"ul",{},[605,606,607],"li",{},[220,608,609],{"href":222},"CBC News, Air Canada chatbot liability",[605,611,612],{},[220,613,614],{"href":227},"Moffatt v. Air Canada, 2024 BCCRT 149",[605,616,617],{},[220,618,619],{"href":238},"IBM newsroom, 30 July 2025",[605,621,622],{},[220,623,624],{"href":243},"NIST AI Risk Management Framework",[605,626,627],{},[220,628,629],{"href":322},"U.S. SEC press release 2024-36",[605,631,632],{},[220,633,634],{"href":327},"U.S. FTC, Keep your AI claims in check",[605,636,637],{},[220,638,335],{"href":334},[605,640,641],{},[220,642,643],{"href":410},"McKinsey, The State of AI: Global Survey 2025",[605,645,646],{},[220,647,648],{"href":427},"Regulation (EU) 2024\u002F1689",{"title":169,"searchDepth":170,"depth":170,"links":650},[651,652,653,654,655,656,657],{"id":211,"depth":170,"text":212},{"id":315,"depth":170,"text":316},{"id":400,"depth":170,"text":401},{"id":494,"depth":170,"text":495},{"id":507,"depth":170,"text":508},{"id":586,"depth":170,"text":587},{"id":599,"depth":170,"text":600},"2026-09-22","Why standard RFPs fail to catch systemic AI risk, unowned connectors, and data retention traps, and how to fix your procurement scorecard.",{"eyebrow":661,"title":662},"Short answers","The risk arrives after the RFP",[664,667,670],{"question":665,"answer":666},"What does a typical AI RFP miss?","It asks for features. The risk arrives later as a connector, a retention clause, and a workflow procurement has not seen run.",{"question":668,"answer":669},"What should procurement ask to see?","A real job: which system changes, who signs, what is retained, and what happens when the vendor is removed.",{"question":671,"answer":672},"Why is a demo a poor proxy?","A demo shows the happy path. Operating risk is the path where the assistant is allowed to act.","\u002Fblog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk",{"title":191,"description":659},"insight","blog\u002Fprocurement-is-buying-demos-and-inheriting-operating-risk",[678,679,680,681],"thought-leadership","procurement","vendors","governance","NzCfwEPO5DSKNmZc10mxZ7Hi7Fdvt-lXcthkquVyM1Q",{"hero":684,"id":686,"title":687,"archived":163,"authors":164,"badge":164,"body":688,"date":164,"definedTerm":164,"department":164,"description":692,"extension":172,"eyebrow":693,"faqHeader":164,"faqs":164,"footerBand":694,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":60,"relatedHeading":700,"seo":701,"series":164,"sitemap":131,"status":164,"stem":702,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":703},{"filename":685},"u2221455217_Flat_design_of_a_futuristic_minimalist_landscape__5d589295-cdea-4ea9-a262-be766881accf_1.png","content\u002Fblog\u002Findex.md","Exploring the future of intelligence.",{"type":166,"value":689,"toc":690},[],{"title":169,"searchDepth":170,"depth":170,"links":691},[],"Deep dives into pre-cognitive intelligence, sentient enterprises, and the evolving landscape of AI-driven business transformation.","Latest Research",{"headline":695,"description":696,"primaryLabel":697,"primaryTo":698,"secondaryLabel":699,"secondaryTo":12},"Stay at the frontier.","Subscribe for product updates and new insights.","Subscribe","\u002Fnewsletter","Explore the platform","More research",{"title":687,"description":692},"blog\u002Findex","BFSWGYO9bcTlaulivKYWyg08_DJHsdGg3OC6g_CG1Hw",[705,1212],{"id":706,"title":707,"archived":163,"authors":708,"badge":712,"body":713,"date":658,"definedTerm":164,"department":164,"description":1192,"extension":172,"eyebrow":164,"faqHeader":1193,"faqs":1195,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1205,"relatedHeading":164,"seo":1206,"series":675,"sitemap":131,"status":164,"stem":1207,"subhead":164,"tags":1208,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1211},"content\u002Fblog\u002Fthe-ai-bill-the-board-cannot-explain.md","The Boardroom AI Dilemma: Spending Millions Without an Outcome",[709],{"name":710,"role":711,"to":196},"James Campbell","Co-Founder and CEO",{"label":198},{"type":166,"value":714,"toc":1183},[715,718,725,775,779,782,785,792,796,799,802,809,815,825,875,879,882,885,888,891,963,967,970,978,981,984,1053,1056,1060,1063,1066,1073,1135,1139,1146,1149,1151,1153],[202,716,717],{},"Somewhere between the innovation slide and the cash-flow slide, the AI programme disappears. The board has been told that adoption is broad. The finance committee has been told that the bill is manageable. Neither statement is false. Together they are useless. A company can have assistants in every function and still be unable to say, in one sentence, which jobs consumed the money, which of those jobs changed a number that matters, and which of them should be stopped.",[202,719,720,721,724],{},"That gap is now a governance problem, not a tooling curiosity. ",[220,722,723],{"href":410},"McKinsey’s State of AI survey"," found that 88 percent of respondents say their organisations use AI in at least one business function, up from 78 percent a year earlier, while nearly two-thirds remain in experimentation or piloting and only about a third have begun to scale. Use has become ordinary. Enterprise-level benefit has not. The invoice, meanwhile, does not wait for the operating model to catch up.",[247,726,727,740],{},[250,728,729],{},[253,730,731,734,737],{},[256,732,733],{},"What the board has been told",[256,735,736],{},"What is true",[256,738,739],{},"What is still missing",[266,741,742,753,764],{},[253,743,744,747,750],{},[271,745,746],{},"Adoption is broad",[271,748,749],{},"88 percent use AI in at least one function, up from 78 percent",[271,751,752],{},"Which jobs consumed the money",[253,754,755,758,761],{},[271,756,757],{},"The bill is manageable",[271,759,760],{},"A seat price can be forecast from headcount",[271,762,763],{},"Which of those jobs changed a number that matters",[253,765,766,769,772],{},[271,767,768],{},"The programme is progressing",[271,770,771],{},"Nearly two-thirds are still experimenting or piloting. About a third have begun to scale",[271,773,774],{},"Which jobs should be stopped",[209,776,778],{"id":777},"a-seat-licence-is-not-a-cost-system","A seat licence is not a cost system",[202,780,781],{},"The first distortion is the way vendors price the easy part. A per-user subscription looks like software the company already knows how to buy. It sits next to email and document tools. Procurement can compare it with last year’s collaboration suite. The board can be told that the cost is predictable because the headcount is predictable.",[202,783,784],{},"Production work does not behave like a seat. A quiet analyst and a team running overnight document review do not consume the same inference, the same tool calls, or the same human review. Seat maths hides that difference until a finance partner asks why a “flat” subscription produced a variable cloud bill, a professional-services overrun, and a second product bought because the first one could not write back to the system of record. By then the original business case has been replaced by a stack.",[202,786,787,791],{},[220,788,790],{"href":789},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fworklab\u002Fwork-trend-index\u002Fai-at-work-is-here-now-comes-the-hard-part","Microsoft and LinkedIn’s Work Trend Index"," makes the organisational version of the same point: 75 percent of knowledge workers use generative AI at work and 78 percent of those users bring their own tools. Seventy-nine percent of leaders say their company needs AI to stay competitive, while 60 percent worry that leadership lacks a plan to implement it. Employees are already spending — time, and often a personal subscription — outside the ledger the board approved. The official bill is therefore a lower bound.",[209,793,795],{"id":794},"what-the-board-pack-actually-contains","What the board pack actually contains",[202,797,798],{},"Open a typical pack and the AI section is a narrative: a pilot count, a logo slide, a sentence about productivity. Sometimes a savings claim inherited from a vendor’s case study. What is missing is the thing a capital committee already requires of a plant, a warehouse system, or a sales-compensation change: a unit of work, an owner, and a stop.",[202,800,801],{},"Without those, three failures follow.",[202,803,804,808],{},[805,806,807],"strong",{},"Double counting."," Marketing books the hours an assistant saved drafting campaigns. Operations books the same hours because the campaign brief came out of a shared workspace. Finance adds both to an “AI ROI” appendix. The company congratulates itself on a saving that was never cash.",[202,810,811,814],{},[805,812,813],{},"Invisible rework."," A fluent draft that a manager rewrites is not free. It is labour moved from creation to inspection, often done by a more expensive person, and almost never coded as AI cost. If the inspection fails — a wrong price, a wrong clause, a wrong customer commitment — the cost leaves the AI budget entirely and lands in refunds, credits, or legal.",[202,816,817,820,821,824],{},[805,818,819],{},"The shadow bill."," Personal accounts, departmental credit cards, and “temporary” API keys do not appear in the enterprise agreement. ",[220,822,823],{"href":238},"IBM’s Cost of a Data Breach research"," found that one in five organisations studied reported a breach involving shadow AI, and that high levels of shadow AI were associated with about $670,000 in higher average breach costs. Only 37 percent had policies to manage AI or detect unsanctioned use. A board that has never seen the shadow bill is not conservative. It is uninformed.",[247,826,827,840],{},[250,828,829],{},[253,830,831,834,837],{},[256,832,833],{},"Failure",[256,835,836],{},"How it gets into the pack",[256,838,839],{},"Where the money actually sits",[266,841,842,853,864],{},[253,843,844,847,850],{},[271,845,846],{},"Double counting",[271,848,849],{},"Marketing and operations both book the same hours. Finance adds them",[271,851,852],{},"A saving that was never cash",[253,854,855,858,861],{},[271,856,857],{},"Invisible rework",[271,859,860],{},"The draft looks free. A more expensive person rewrites it",[271,862,863],{},"Inspection, then refunds, credits, or legal if the inspection fails",[253,865,866,869,872],{},[271,867,868],{},"The shadow bill",[271,870,871],{},"Personal accounts, departmental cards, temporary API keys",[271,873,874],{},"Outside the enterprise agreement. About $670,000 on the breach cost where shadow use is high. Only 37 percent can detect it",[209,876,878],{"id":877},"questions-for-a-serious-finance-review","Questions for a serious finance review",[202,880,881],{},"A useful review does not start with the model catalogue. It starts with jobs.",[202,883,884],{},"Which named processes were allowed to use an assistant this quarter? Not “marketing,” but the weekly price-exception memo, the vendor-onboarding pack, the customer-email queue. Who owns each process, and who is allowed to let an output leave the building? What was the ceiling, in money or in steps, and how many runs stopped because the ceiling was hit? A stop is a fact. “We are exploring” is not.",[202,886,887],{},"Then the attribution question: can finance join the inference, the tool calls, and the human approval to the same job identifier that already exists for cost centres? If the answer is a spreadsheet assembled the night before the committee, the company does not have an AI cost system. It has a recollection.",[202,889,890],{},"Then the substitution question: did the spend replace a contractor, a bureau, an outsourced review — or did it sit on top of all three? Leaders are right to be suspicious of savings that do not show up as a cancelled purchase order. McKinsey’s survey is blunt about the distance between use and scale: most organisations have not embedded AI deeply enough into workflows to realise material enterprise-level benefits. A bill that arrives before the workflow changes is not an investment. It is a pilot with a standing order.",[247,892,893,906],{},[250,894,895],{},[253,896,897,900,903],{},[256,898,899],{},"Ask this",[256,901,902],{},"A serious answer",[256,904,905],{},"Not an answer",[266,907,908,919,930,941,952],{},[253,909,910,913,916],{},[271,911,912],{},"Which named processes used an assistant?",[271,914,915],{},"The weekly price-exception memo, the vendor-onboarding pack, the customer-email queue",[271,917,918],{},"“Marketing”",[253,920,921,924,927],{},[271,922,923],{},"Who owns it, and who may let an output leave?",[271,925,926],{},"Two names",[271,928,929],{},"A platform team",[253,931,932,935,938],{},[271,933,934],{},"What was the ceiling, and how many runs stopped?",[271,936,937],{},"A number of stops",[271,939,940],{},"“We are exploring”",[253,942,943,946,949],{},[271,944,945],{},"Can finance join inference, tool calls, and approval to a cost-centre job?",[271,947,948],{},"The same identifier the ledger already uses",[271,950,951],{},"A spreadsheet assembled the night before",[253,953,954,957,960],{},[271,955,956],{},"Did the spend replace a contractor, a bureau, or an outsourced review?",[271,958,959],{},"A cancelled purchase order",[271,961,962],{},"A vendor case study sitting on top of all three",[209,964,966],{"id":965},"what-to-put-in-front-of-the-committee-next-quarter","What to put in front of the committee next quarter",[202,968,969],{},"Pick five jobs, not fifty tools. For each, name the owner, the system of record that may be read, the class of change that may be proposed, and the person who must sign before anything is written. Put a ceiling on the run. Record the refusals. If a job cannot name those four things, it is not ready for production spend, however impressive the demo.",[202,971,972,973,977],{},"Separate the sanctioned path from the personal one. ",[220,974,976],{"href":975},"https:\u002F\u002Fwww.cnbc.com\u002F2023\u002F05\u002F02\u002Fsamsung-bans-use-of-ai-like-chatgpt-for-staff-after-misuse-of-chatbot.html","Samsung’s decision"," to restrict generative tools on company machines, after staff uploaded sensitive material, is the blunt version. The durable version is a path employees will actually use, because a ban that people route around on their phones is a policy and not a control. Microsoft’s finding that most AI users already bring their own tools is the evidence. The official system has to be good enough that the personal subscription is no longer the path of least resistance.",[202,979,980],{},"Report the bill in the language of work. Not “AI spend versus last year,” but spend and stops by job, with the human owner beside the number. A director can challenge a job. A director cannot challenge a platform abstraction.",[202,982,983],{},"Finally, retire claims you cannot reconstruct. If the business case says a function will run with fewer contractors, show the contractor line. If it says customer commitments are faster, show the refusal rate and the complaint rate beside the cycle time. Speed without those companions is how a fluent assistant becomes a liability the finance committee meets later, under a different heading.",[247,985,986,1011],{},[250,987,988],{},[253,989,990,993,996,999,1002,1005,1008],{},[256,991,992],{},"Job",[256,994,995],{},"Owner",[256,997,998],{},"System that may be read",[256,1000,1001],{},"Change that may be proposed",[256,1003,1004],{},"Who signs before anything is written",[256,1006,1007],{},"Ceiling",[256,1009,1010],{},"Refusals this month",[266,1012,1013,1036],{},[253,1014,1015,1018,1021,1024,1027,1030,1033],{},[271,1016,1017],{},"One sentence a customer would recognise",[271,1019,1020],{},"A person",[271,1022,1023],{},"Named",[271,1025,1026],{},"A class, not “whatever the model suggests”",[271,1028,1029],{},"A person, before it leaves",[271,1031,1032],{},"Money or steps. A hit stops the run",[271,1034,1035],{},"A number. Zero means you bought fluency without a control",[253,1037,1038,1041,1043,1045,1047,1049,1051],{},[271,1039,1040],{},"Four more, then stop",[271,1042],{},[271,1044],{},[271,1046],{},[271,1048],{},[271,1050],{},[271,1052],{},[202,1054,1055],{},"A blank cell means the job is not ready for production spend.",[209,1057,1059],{"id":1058},"one-invoice-read-properly","One invoice, read properly",[202,1061,1062],{},"Pull last month’s invoice for the largest assistant the company pays for. Do not start with the total. Start with the lines. If the lines are only seats, or only tokens, you do not yet have a bill you can explain. You have a consumption total. Ask the owner — if there is one — to map the largest lines to jobs: which team, which work, which system of record was read, whether anything was sent or posted, what ceiling would have stopped it. The lines that cannot be mapped are the lines to freeze at renewal. A freeze is a management act. A variance explanation that says “adoption was strong” is not.",[202,1064,1065],{},"Then put the personal spend beside it. Expense reports, corporate cards, and the tools people buy because the official one was slow to arrive. Most people who use AI at work bring their own. Those subscriptions are small. The work done inside them is not on your invoice and not in your log. The board does not need a lecture on shadow IT. It needs two numbers: sanctioned spend you can tie to a job, and a pulse on unsanctioned use that touches customers, code, or unpublished figures. The breach research is why the second number matters: incidents involving shadow AI were common in the studied set, and heavy shadow use lined up with higher cost.",[202,1067,1068,1069,1072],{},"Finally, match the invoice to the claim. If a business case said contractors would fall, show the contractor line. If it said the assistant does not invent policy, show a refusal from the month you are paying for. A month with spend and no refusals is a month you bought fluency without a control. ",[220,1070,1071],{"href":322},"Public companies and regulated advisers have already been sanctioned"," for describing capabilities they could not demonstrate. A private board should want the same demonstration before it approves the renewal. The demonstration fits on a page: five jobs, five owners, spend, stops, and one result against a baseline. Widespread use is not that page. The page is how use becomes something a director can govern.",[247,1074,1075,1085],{},[250,1076,1077],{},[253,1078,1079,1082],{},[256,1080,1081],{},"Start here",[256,1083,1084],{},"Freeze at renewal if",[266,1086,1087,1095,1103,1111,1119,1127],{},[253,1088,1089,1092],{},[271,1090,1091],{},"The largest lines, not the total",[271,1093,1094],{},"They are only seats or tokens, and nobody can name the job",[253,1096,1097,1100],{},[271,1098,1099],{},"Team, work, system of record read, whether anything was sent or posted, the ceiling",[271,1101,1102],{},"The owner cannot map the line",[253,1104,1105,1108],{},[271,1106,1107],{},"Sanctioned spend tied to a job",[271,1109,1110],{},"The only figure is a platform total",[253,1112,1113,1116],{},[271,1114,1115],{},"A pulse on unsanctioned use that touches customers, code, or unpublished figures",[271,1117,1118],{},"You have the enterprise invoice and not the personal one. The official bill is a lower bound",[253,1120,1121,1124],{},[271,1122,1123],{},"The contractor line, if the case said contractors would fall",[271,1125,1126],{},"The case is still in the pack and the line did not move",[253,1128,1129,1132],{},[271,1130,1131],{},"One refusal from the month you are paying for",[271,1133,1134],{},"Spend with no refusals",[209,1136,1138],{"id":1137},"a-call-to-finance-chairs-and-chief-financial-officers","A call to finance chairs and chief financial officers",[202,1140,1141,1142,1145],{},"The board does not need another vision deck. It needs an AI bill it can explain to itself: which jobs, which owners, which ceilings, which stops, which claims have been withdrawn because the evidence was not there. ",[220,1143,1144],{"href":243},"NIST’s AI Risk Management Framework"," puts the same idea in public language — govern, map, measure, manage — but the framework does not close the books. Finance does.",[202,1147,1148],{},"Companies that keep treating AI as a seat product will keep approving spend they cannot attribute and discovering risk they did not budget. Companies that attach the spend to named work will find that the interesting argument is no longer whether to “do AI.” It is which jobs are worth the next increment of money, and which should be turned off. That is a conversation boards already know how to have. The work now is to make the AI programme fit it.",[595,1150],{},[209,1152,600],{"id":599},[602,1154,1155,1159,1164,1169,1174,1179],{},[605,1156,1157],{},[220,1158,643],{"href":410},[605,1160,1161],{},[220,1162,1163],{"href":789},"Microsoft and LinkedIn, 2024 Work Trend Index",[605,1165,1166],{},[220,1167,1168],{"href":238},"IBM, Cost of a Data Breach research release, 30 July 2025",[605,1170,1171],{},[220,1172,1173],{"href":322},"U.S. SEC, charges regarding false AI statements, 18 March 2024",[605,1175,1176],{},[220,1177,1178],{"href":975},"CNBC, Samsung restricts generative AI tools after misuse",[605,1180,1181],{},[220,1182,624],{"href":243},{"title":169,"searchDepth":170,"depth":170,"links":1184},[1185,1186,1187,1188,1189,1190,1191],{"id":777,"depth":170,"text":778},{"id":794,"depth":170,"text":795},{"id":877,"depth":170,"text":878},{"id":965,"depth":170,"text":966},{"id":1058,"depth":170,"text":1059},{"id":1137,"depth":170,"text":1138},{"id":599,"depth":170,"text":600},"Why boards struggle to tie soaring API invoices to specific business outcomes, and how to implement job-level AI cost attribution.",{"eyebrow":661,"title":1194},"Spend the board can attribute",[1196,1199,1202],{"question":1197,"answer":1198},"Why can boards not explain the AI bill?","Usage is everywhere and the invoice is not tied to a job, a team, or an outcome.",{"question":1200,"answer":1201},"What should finance be able to say?","Which work consumed the spend, what the ceiling was, and what would have been refused if the ceiling had been hit.",{"question":1203,"answer":1204},"Is a seat price that explanation?","No. A seat describes a login. It does not describe the run.","\u002Fblog\u002Fthe-ai-bill-the-board-cannot-explain",{"title":707,"description":1192},"blog\u002Fthe-ai-bill-the-board-cannot-explain",[678,1209,1210,681],"enterprise-ai","finance","eDcWOg3g9KIgpuuE88NBGZVEEteWXNu4SbHlbbKo66Y",{"id":1213,"title":1214,"archived":163,"authors":1215,"badge":1218,"body":1219,"date":658,"definedTerm":164,"department":164,"description":1808,"extension":172,"eyebrow":164,"faqHeader":1809,"faqs":1811,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1821,"relatedHeading":164,"seo":1822,"series":675,"sitemap":131,"status":164,"stem":1823,"subhead":164,"tags":1824,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1827},"content\u002Fblog\u002Fnon-human-user-access-control.md","The Access Control Blindspot: Unmonitored Non-Human AI Agents",[1216],{"name":1217,"to":196},"Nimbus Research",{"label":198},{"type":166,"value":1220,"toc":1797},[1221,1224,1231,1235,1238,1246,1257,1329,1333,1336,1342,1348,1354,1360,1432,1436,1439,1442,1449,1456,1460,1463,1466,1474,1482,1536,1540,1547,1550,1558,1562,1571,1574,1580,1642,1646,1652,1676,1679,1741,1745,1748,1751,1753,1755],[202,1222,1223],{},"Security programmes spent years making a simple idea stick. A person joins, moves, or leaves, and their access follows. Privileged access is rare, time-bounded, and reviewed. A shared administrator password is an audit finding, not a convenience. Then a pilot needed a connector “so the demo would work,” and a token was minted with rights no employee in that team possesses. The token does not go on leave. It does not fail a performance review. It sits in a secret store and calls the billing system whenever a prompt tells it to.",[202,1225,1226,1227,1230],{},"That token is a non-human user. Treat it as one. The next costly incidents in this area will not require anyone to steal a model’s weights. They will be ordinary privilege problems: too much scope, no owner, a prompt that can aim the scope. ",[220,1228,1229],{"href":238},"IBM’s 2025 research"," already reads that way. Thirteen percent of organisations reported a breach involving an AI model or application. Of those, 97 percent lacked proper AI access controls. Sixty percent of the AI-related incidents compromised data and 31 percent caused operational disruption. The common path ran through the supply chain of apps, APIs, and plugins. One in five organisations reported a breach involving shadow AI. This is joiner-mover-leaver, skipped, wearing a new headline.",[209,1232,1234],{"id":1233},"the-superuser-that-was-never-hired","The superuser that was never hired",[202,1236,1237],{},"A human superuser is uncomfortable on purpose. The account is named. Someone recertifies it. Break-glass use is logged and reviewed. An agent superuser is created in the opposite mood. The pilot is on Thursday’s agenda. The narrow role would take a ticket. The shared write credential is faster, and “temporary” is written in a chat rather than as an expiry in the identity system. By the following week the credential has been copied into a second experiment, because copying is easier than requesting. Two jobs, one identity, no owner.",[202,1239,1240,1241,1245],{},"The blast radius is the product of that identity and whatever text can influence the run. ",[220,1242,1244],{"href":1243},"https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F","OWASP’s account of tool abuse and indirect prompt injection"," describes the class. A customer thread, a PDF, a web page the agent was told to read, contains an instruction to ignore a limit, widen a permission, or send a promise. If the token can do the thing, the model’s helpfulness is not a defence. Untrusted content authorised a transaction. You already forbid that pattern for email rules that auto-forward wires. The natural-language interface is not an exception.",[202,1247,1248,1249,1252,1253,1256],{},"Shadow use widens the same problem from a different direction. ",[220,1250,1251],{"href":789},"Most AI users bring their own tools",". A personal chatbot cannot post to your ledger. A person can paste what it drafted into a system they can post to, after the sensitive context has already left. ",[220,1254,1255],{"href":975},"Samsung’s restriction"," after source code was uploaded is the intellectual-property case of a missing sanctioned identity: people used a tool that would accept the file because the official path would not. Only 37 percent of organisations in the IBM study had policies to manage or detect that kind of use. A policy that cannot see the token and cannot see the phone is not an identity programme.",[247,1258,1259,1272],{},[250,1260,1261],{},[253,1262,1263,1266,1269],{},[256,1264,1265],{},"Human privileged user",[256,1267,1268],{},"Non-human run, as usually deployed",[256,1270,1271],{},"What parity requires",[266,1273,1274,1285,1296,1307,1318],{},[253,1275,1276,1279,1282],{},[271,1277,1278],{},"Named person",[271,1280,1281],{},"Shared “pilot-admin”",[271,1283,1284],{},"An identity per job",[253,1286,1287,1290,1293],{},[271,1288,1289],{},"Joins, moves, leaves",[271,1291,1292],{},"Lives until someone remembers the secret",[271,1294,1295],{},"Expiry, and revocation when the workstream ends or the sponsor leaves",[253,1297,1298,1301,1304],{},[271,1299,1300],{},"Recertified",[271,1302,1303],{},"“Temporary,” in a chat",[271,1305,1306],{},"A date in the identity system",[253,1308,1309,1312,1315],{},[271,1310,1311],{},"Least privilege is an argument you have already had",[271,1313,1314],{},"Write on whatever the demo needed",[271,1316,1317],{},"Read by default. Write is a separate grant",[253,1319,1320,1323,1326],{},[271,1321,1322],{},"Break-glass is logged",[271,1324,1325],{},"The model retries the tool call",[271,1327,1328],{},"The payload, the refusal, and the person who released a write",[209,1330,1332],{"id":1331},"joiner-mover-leaver-for-a-run","Joiner, mover, leaver for a run",[202,1334,1335],{},"Apply the process you already trust. Do not invent a parallel universe called “AI identity” that the IAM team never sees.",[202,1337,1338,1341],{},[805,1339,1340],{},"Joiner."," The identity is created when a workstream is allowed to execute, not when a vendor is purchased. It can read the systems that job needs, in the scope of the people who own the job. It cannot read the HR file because a finance team was curious, and it cannot pay because support wanted to “close the loop.” Connector scope is the joiner form. If the form says administrator, send it back.",[202,1343,1344,1347],{},[805,1345,1346],{},"Mover."," When the job changes — a new class of record, a new system — the scope changes by request, not by copying yesterday’s secret into today’s environment. The approver of a write scope is not the pilot’s sponsor. Sponsors are paid to make Thursday’s demo. Approvers are paid to refuse.",[202,1349,1350,1353],{},[805,1351,1352],{},"Leaver."," When the workstream ends, the sponsor changes roles, or the review says stop, the identity dies the same week. A stopped pilot with a live token is still a user. “Continue to explore” without an owner is how temporary becomes the account named in the incident report.",[202,1355,1356,1357,1359],{},"Recertify on a calendar, the way you recertify human privilege. Bring one refused write to the review: the payload, the identity that lacked the scope, the person who would have had to release it. If you cannot bring it, the control is a sentence in a standard. ",[220,1358,244],{"href":243}," and every prior access-control standard already say least privilege. The agent programme abandons it because a single company-wide token demos better. The demo is the blast radius.",[247,1361,1362,1375],{},[250,1363,1364],{},[253,1365,1366,1369,1372],{},[256,1367,1368],{},"Event",[256,1370,1371],{},"Human process you already run",[256,1373,1374],{},"The same event for a run",[266,1376,1377,1388,1399,1410,1421],{},[253,1378,1379,1382,1385],{},[271,1380,1381],{},"Start",[271,1383,1384],{},"Account created against a role",[271,1386,1387],{},"Identity created against one workstream’s connector list",[253,1389,1390,1393,1396],{},[271,1391,1392],{},"Change of job",[271,1394,1395],{},"Access recertified or cut",[271,1397,1398],{},"Write scope requested again. The old token is not copied",[253,1400,1401,1404,1407],{},[271,1402,1403],{},"End",[271,1405,1406],{},"Account disabled on the leaving date",[271,1408,1409],{},"Token revoked when the workstream stops or the owner leaves",[253,1411,1412,1415,1418],{},[271,1413,1414],{},"Review",[271,1416,1417],{},"Show privileged use",[271,1419,1420],{},"Show a refused write, or explain why none exists",[253,1422,1423,1426,1429],{},[271,1424,1425],{},"Emergency",[271,1427,1428],{},"Break-glass, then review",[271,1430,1431],{},"A time-bounded grant, then revocation. Not a standing admin",[209,1433,1435],{"id":1434},"read-and-write-are-different-products","Read and write are different products",[202,1437,1438],{},"The architectural line is the same line finance already understands between viewing a ledger and posting to it. Read access lets a run ground a draft in records the operator could have opened. Write access changes the record other people trust. Collapse them and every prompt is a potential posting.",[202,1440,1441],{},"Read-only as a default is what makes an agent usable rather than what makes it timid. Teams get speed on the draft. Security gets a token that cannot move money while a researcher is still learning the failure modes. When a write is justified, it is a named class of object, a quoted payload, and a human release. The release is stored with the rule version. Retries do not get to invent a second side effect. A ceiling on value or on steps stops the run and records the stop. A ceiling that only notifies has not constrained anything.",[202,1443,1444,1445,1448],{},"Segment by job. The recruiting team’s run does not hold the payments connector. Finance does not hold the employee file. This is dull, and it is the difference between a contained mistake and an incident that crosses domains. ",[220,1446,1447],{"href":427},"The EU AI Act"," will require, for some systems, oversight that can interrupt them. Interruptibility is a property of the token and the gate, not of the model card.",[202,1450,1451,1452,1455],{},"Test it the way you test a payments change. Take a realistic inbound message and try to push the run into a tool it should not call, and into a write above its ceiling. If either succeeds, file a defect with an owner. Do not file a lesson learned. ",[220,1453,1454],{"href":327},"A governance claim that a human is in the loop, while the token posts alone, is the kind of description regulators have already disliked in other clothes",".",[209,1457,1459],{"id":1458},"privileged-access-applied-to-a-connector","Privileged access, applied to a connector",[202,1461,1462],{},"Privileged access management exists because a standing administrator is how a small mistake becomes a large incident. Checkout, use, return, review. The privileged action is rare on purpose. A connector violates that pattern the moment it can write whenever a run happens to be awake. “The integration is connected” is not a control. It is a standing grant, often broader than any employee in the sponsoring team, created so a workshop could finish on time.",[202,1464,1465],{},"The privileged action for an agent is a payload, not a role that lasts all quarter. A person checks out the right to release one credit, one email, one journal line. The release covers that payload. It expires. Someone looks at it afterward, the way break-glass use is looked at. The model does not receive a durable role called operator that includes payments, outbound mail, and the employee file because all three appeared in the integration catalogue on the same afternoon.",[202,1467,1468,1469,1473],{},"Specialist swarms make least privilege specific, and they create a new way to lose it. The finance pass holds a ledger read. The policy pass holds the playbook. Neither holds the mail connector. That split is real only if the coordinator’s own token is narrower than the union of the specialists. If the orchestrator can call every tool any sub-agent can call, the diagram shows separation and the identity system shows one superuser. ",[220,1470,1472],{"href":1471},"\u002Fblog\u002Frbac-for-enterprise-ai\u002F","Role design for people"," already refuses that pattern. Non-human roles inherit the same refusal. Scope is per workstream and per connector, and a copied environment file is an incident in waiting.",[202,1475,1476,1477,1481],{},"A ceiling belongs in the same set of controls. A loop that calls tools until someone notices is a cost problem and, when a tool can write, an integrity problem. The halt is the control. A warning that the run is “using a lot” is a notification. ",[220,1478,1480],{"href":1479},"\u002Fblog\u002Fwhat-is-human-in-the-loop-ai\u002F","Human oversight"," that cannot withdraw the token, or stop the spend, is a meeting. Put the expiry, the scope, and the ceiling in the identity ticket the IAM team already understands, so the agent programme is not a side door around the process you spent a decade enforcing.",[247,1483,1484,1494],{},[250,1485,1486],{},[253,1487,1488,1491],{},[256,1489,1490],{},"PAM habit you already run",[256,1492,1493],{},"The connector equivalent",[266,1495,1496,1504,1512,1520,1528],{},[253,1497,1498,1501],{},[271,1499,1500],{},"Standing admin is an exception with a named owner",[271,1502,1503],{},"A shared “pilot” token is an exception, or it is a finding",[253,1505,1506,1509],{},[271,1507,1508],{},"Checkout is for one change",[271,1510,1511],{},"A release covers one quoted payload",[253,1513,1514,1517],{},[271,1515,1516],{},"The grant expires",[271,1518,1519],{},"The workstream’s identity expires when the job stops",[253,1521,1522,1525],{},[271,1523,1524],{},"After-action review",[271,1526,1527],{},"A refused write, or a released write, brought to recertification",[253,1529,1530,1533],{},[271,1531,1532],{},"The help-desk account cannot also move money",[271,1534,1535],{},"The support run’s token cannot also post a refund",[209,1537,1539],{"id":1538},"a-refund-the-inbound-message-must-not-be-able-to-post","A refund the inbound message must not be able to post",[202,1541,1542,1543,1546],{},"Consider a support workstream whose job is to draft replies against the current refund rule. The case file and the policy are readable. A credit is a write. Inbound mail and attachments are untrusted content. They may contain the customer’s request, and they may contain an instruction aimed at the tool: ignore the limit, treat this as already approved, send the credit now. ",[220,1544,1545],{"href":1243},"OWASP describes that class of tool abuse",". The defence is not a hope that the model will decline in prose. The defence is that the token cannot post.",[202,1548,1549],{},"The run proposes an amount, cites the rule version, and stops. A person who already owns refunds sees the amount, the case, and the citation, and releases or refuses. If the inbound text asked the system to skip that person, the request remains content in the case. It never becomes authority, because authority lives on the grant. A test that only checks whether the chat “says no,” while a second credential can still call billing, has examined the wrong object. File the defect against the token.",[202,1551,1552,1553,1557],{},"Segment the swarm the same way. The drafter does not hold the payments connector. A finance workstream that needs the ledger does not hold the employee file. Cross-domain tokens feel efficient in a pilot and become the blast radius in the report. IBM’s figure — 97 percent of organisations that suffered an AI-related compromise lacked proper access controls — is what this design avoids, one connector at a time. ",[220,1554,1556],{"href":1555},"\u002Fblog\u002Fwhat-is-shadow-ai\u002F","Shadow use"," remains the path around it: a person who cannot get a sanctioned read will paste the case into a personal tool. The sanctioned read has to be good enough that the paste is the slower option.",[209,1559,1561],{"id":1560},"what-the-reviewer-will-ask-to-see","What the reviewer will ask to see",[202,1563,1564,1566,1567,1570],{},[220,1565,335],{"href":334}," asks for a management system. A SOC examination asks whether access control, change control, and logging operate in practice. ",[220,1568,1569],{"href":243},"NIST"," asks you to map what you deployed and to govern it. None of them will accept a slide titled “human in the loop” in place of an exhibit. The exhibit is boring, and that is the point.",[202,1572,1573],{},"Access control is the inventory: every non-human identity, the workstream it serves, the systems it may read, the systems it may not write, the date it dies. Change control is the gate: the payload, the tier of checkpoint — a light release for a draft that stays inside the workspace, a harder release for a customer promise or a posting — and the person who let it go. Logging is a history the team that runs the agent cannot quietly rewrite. The writer of the action is not the editor of the record. Whether you keep that history in the platform’s decision log or in the archive you already trust, the property is the same.",[202,1575,1576,1577,1579],{},"The ",[220,1578,428],{"href":427}," adds, for systems that fall in scope, an obligation that people can oversee and interrupt. Interruptibility is a property you can demonstrate: here is the token, here is how it is withdrawn, here is a run that stopped. A model card does not demonstrate it. Bring the withdrawn token from a pilot you actually ended. If the pilot ended in a slide and the secret is still valid, the management system is a document.",[247,1581,1582,1592],{},[250,1583,1584],{},[253,1585,1586,1589],{},[256,1587,1588],{},"Control the questionnaire names",[256,1590,1591],{},"The artefact that answers it",[266,1593,1594,1602,1610,1618,1626,1634],{},[253,1595,1596,1599],{},[271,1597,1598],{},"Least privilege",[271,1600,1601],{},"Connector scope per workstream, read separated from write",[253,1603,1604,1607],{},[271,1605,1606],{},"Joiner-mover-leaver",[271,1608,1609],{},"Create, recertify, and revoke on the same calendar as human privilege",[253,1611,1612,1615],{},[271,1613,1614],{},"Change management",[271,1616,1617],{},"A released payload with a person and a rule version",[253,1619,1620,1623],{},[271,1621,1622],{},"Logging and integrity",[271,1624,1625],{},"A decision history the run cannot edit",[253,1627,1628,1631],{},[271,1629,1630],{},"Oversight that can interrupt",[271,1632,1633],{},"A ceiling and a revocation that have fired at least once",[253,1635,1636,1639],{},[271,1637,1638],{},"Acceptable use of shadow tools",[271,1640,1641],{},"A measured pulse, and a sanctioned path people prefer",[209,1643,1645],{"id":1644},"what-an-auditor-can-be-shown","What an auditor can be shown",[202,1647,1648,1649,1651],{},"Standards do not replace the artefact. They tell you which artefact will be asked for. ",[220,1650,335],{"href":334}," asks for a management system around AI. SOC reports ask whether access control and change control operate. NIST asks you to map and govern what you deployed. A package that satisfies the question, rather than the binder, contains:",[602,1653,1654,1657,1660,1663,1666,1669],{},[605,1655,1656],{},"The inventory of non-human identities and the workstream each serves.",[605,1658,1659],{},"The connector scope, read or write, and the expiry.",[605,1661,1662],{},"A sample refusal, with the payload that did not leave.",[605,1664,1665],{},"A sample release, with the person, the rule version, and the system that changed.",[605,1667,1668],{},"Evidence that a stopped pilot lost its token.",[605,1670,1671,1672,1675],{},"Evidence that personal-account use of customer data, code, and unpublished numbers is measured, not assumed away. ",[220,1673,1674],{"href":789},"The Work Trend Index"," makes a blanket “approved tools only” statement difficult to defend if you have not looked.",[202,1677,1678],{},"The lifecycle record is what joins these. An identity without a trail of actions is a user you cannot investigate. A trail that can be edited by the same token it describes is not a trail. Immutability here means the practical kind: the team that runs the agent cannot silently rewrite yesterday’s approval. Whether that is enforced by the platform’s own log or by your existing archive, the property you need is that the story of the write cannot be changed by the writer.",[247,1680,1681,1691],{},[250,1682,1683],{},[253,1684,1685,1688],{},[256,1686,1687],{},"Ask",[256,1689,1690],{},"A complete exhibit",[266,1692,1693,1701,1709,1717,1725,1733],{},[253,1694,1695,1698],{},[271,1696,1697],{},"Who can change a record?",[271,1699,1700],{},"A list of non-human identities, not “the AI platform”",[253,1702,1703,1706],{},[271,1704,1705],{},"How much can they do?",[271,1707,1708],{},"Read or write, per system, with an expiry",[253,1710,1711,1714],{},[271,1712,1713],{},"Show me a control that fired",[271,1715,1716],{},"One refused payload",[253,1718,1719,1722],{},[271,1720,1721],{},"Show me a change that was allowed",[271,1723,1724],{},"The payload, the person, the rule version",[253,1726,1727,1730],{},[271,1728,1729],{},"What happened to the pilot you stopped?",[271,1731,1732],{},"The token is gone",[253,1734,1735,1738],{},[271,1736,1737],{},"What about the phone?",[271,1739,1740],{},"A pulse, not a proxy log that went quiet",[209,1742,1744],{"id":1743},"a-call-to-chief-information-security-officers","A call to chief information security officers",[202,1746,1747],{},"Stop leading with the chatbot domain you might block. Lead with credentials. An assistant that can write is a privileged user. Put it through joiner-mover-leaver, recertify it, and demand a refused transaction the way you would of a human superuser. Give employees a sanctioned read path that can see the files they are already allowed to see, or they will paste those files into an identity you do not control.",[202,1749,1750],{},"The 2025 pattern is not mysterious. Access was broad. Oversight was thin. Shadow use filled the gap. Narrow the token. Log the action. Expire the identity. The fact that the user speaks in prompts does not make a superuser acceptable.",[595,1752],{},[209,1754,600],{"id":599},[602,1756,1757,1761,1767,1772,1776,1781,1785,1789,1793],{},[605,1758,1759],{},[220,1760,619],{"href":238},[605,1762,1763],{},[220,1764,1766],{"href":1765},"https:\u002F\u002Fwww.ibm.com\u002Freports\u002Fdata-breach","IBM, Cost of a Data Breach",[605,1768,1769],{},[220,1770,1771],{"href":1243},"OWASP Top 10 for LLM Applications",[605,1773,1774],{},[220,1775,1163],{"href":789},[605,1777,1778],{},[220,1779,1780],{"href":975},"CNBC, Samsung restricts generative AI after misuse",[605,1782,1783],{},[220,1784,624],{"href":243},[605,1786,1787],{},[220,1788,648],{"href":427},[605,1790,1791],{},[220,1792,335],{"href":334},[605,1794,1795],{},[220,1796,634],{"href":327},{"title":169,"searchDepth":170,"depth":170,"links":1798},[1799,1800,1801,1802,1803,1804,1805,1806,1807],{"id":1233,"depth":170,"text":1234},{"id":1331,"depth":170,"text":1332},{"id":1434,"depth":170,"text":1435},{"id":1458,"depth":170,"text":1459},{"id":1538,"depth":170,"text":1539},{"id":1560,"depth":170,"text":1561},{"id":1644,"depth":170,"text":1645},{"id":1743,"depth":170,"text":1744},{"id":599,"depth":170,"text":600},"Traditional identity access management was built for people. How to govern API keys, tokens, and privileges for non-human AI users.",{"eyebrow":661,"title":1810},"Agents are users with tokens",[1812,1815,1818],{"question":1813,"answer":1814},"Why does joiner-mover-leaver fail for agents?","It was built for people. An agent run is a privileged user with a token, no performance review, and often no expiry.",{"question":1816,"answer":1817},"What is the breach pattern?","Access. The model is rarely stolen. The token is used.",{"question":1819,"answer":1820},"What should access control cover?","Which non-human identity may call which system, for how long, and what happens to the token when the job ends.","\u002Fblog\u002Fnon-human-user-access-control",{"title":1214,"description":1808},"blog\u002Fnon-human-user-access-control",[678,1825,1826,681],"security","identity","SwY3uGaW2bq4S07eBQza3nt16Hfqs0ZgYfjxujcPaJU",{"fold":1829,"id":1833,"title":1834,"archived":163,"authors":164,"badge":164,"body":1835,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":1839,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1843,"relatedHeading":164,"seo":1844,"series":164,"sitemap":163,"status":164,"stem":1845,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1846},{"headline":1830,"description":1831,"primaryLabel":8,"primaryTo":1832,"secondaryLabel":699,"secondaryTo":12},"Run frontier AI your business actually owns.","Governed workstreams, 3,000+ integrations, and a proprietary knowledge graph. Start on Free.","\u002Fsignup?plan=free","content\u002Fshared\u002Fcta.md","Site CTAs",{"type":166,"value":1836,"toc":1837},[],{"title":169,"searchDepth":170,"depth":170,"links":1838},[],{"headline":1840,"description":1841,"primaryLabel":8,"primaryTo":1832,"secondaryLabel":1842,"secondaryTo":85},"See what governed AI looks like on your stack.","Connect your tools, run a workstream, and keep every decision on your ledger. Start on Free.","Talk to our team","\u002Fshared\u002Fcta",{"title":1834,"description":169},"shared\u002Fcta","eYqahyaPnbp8GKrWpoORbZdtmkWmgHr5F61ZHOnb8sY",1791647061498]