Why I Am Writing This

I have been thinking about analogy since 2005, longer than I have been thinking about most things professionally.

At the time, I was working as a researcher in Québec City, trying to build a system that could assist creative professionals in finding visual inspiration. The technical problem was tractable. But solving it required first answering a question I had not expected: what is creativity, actually? Not as a personality trait or a cultural value, but as a cognitive mechanism.

The answer I arrived at led to an architecture, a patent specification, and a set of ideas that I could not discuss publicly for fifteen years due to contractual obligations.

By the time those constraints lifted, the world had changed considerably. LLMs had appeared, AI had become a public conversation, and the organizations I was working with were exhibiting exactly the pathologies I had been thinking about. I finally had both the freedom and the context to say so.

This essay is where those two threads meet.

The solutions to most organizational problems already exist. They were developed in other domains, under a different name.

Analogy versus Metaphor: A Distinction That Matters

There is a common confusion between metaphor and analogy that matters more than it might appear. A decorative metaphor makes an idea accessible; it creates recognition, sometimes resonance. A structural analogy reveals a real correspondence between two systems: it diagnoses, and it points toward solutions. The difference is epistemological, not stylistic.

Saying “an organization is like an organism” is a metaphor. It invites a certain way of seeing. Demonstrating that the mechanism of cellular apoptosis and the dysfunction of project management share exactly the same causal structure (a local unit disconnected from systemic feedback, optimizing for its own survival at the cost of the whole) is a structural analogy. The first inspires; the second diagnoses.

The core formulation is this: human creativity is combinatorial, not generative ex nihilo. The only way to produce something genuinely new within a bounded experiential space is to discover a structural correspondence between two distant domains that are already known. Novelty is a function of semantic distance between domains. Utility is a function of the match with the problem and with the evaluator’s own criteria.

This formulation connects to a tradition of research in cognitive science that has approached the same question with more formal rigor. Dedre Gentner’s structure-mapping theory (1983) established that what gets mapped in an analogy is not object attributes but relational structure: the causal and functional architecture of a domain, independent of its surface content. Douglas Hofstadter and Emmanuel Sander, in Surfaces and Essences (2013), argued that analogy is not a special cognitive operation but the very engine of thought, the mechanism by which every act of categorization and understanding operates. Arthur Koestler, in The Act of Creation (1964), called the productive collision of two incompatible frames of reference “bisociation,” the mechanism behind both humor and discovery.

What this research tradition establishes, and what the diagnostic method proposed here builds on, is that structural correspondence is the operative criterion. The question is not whether “these domains feel similar” but whether “these domains share the same relational architecture.” The implication for organizational diagnosis is direct: the value of an analogy is structural rather than rhetorical, and it can be evaluated as such.

A Taxonomy of Analogical Domains

Not all distant domains are equivalent as diagnostic tools, and not all combinations of domains are equally powerful. The patent specification formalized a taxonomy for a metaphor-based search system, and that taxonomy maps directly onto the diagnostic method proposed here.

Three types of relationships between analogical domains matter:

Alternative domains cover the same structural dimension of the problem. They are interchangeable: selecting one or the other yields the same diagnostic contribution. Using both is redundant. They compete rather than combine.

Complementary domains cover distinct structural dimensions of the problem. They are combinable, and their combination produces a structural coverage that neither achieves alone. This is where the power of the method concentrates: finding two or three domains that together cover all dimensions of the problem.

Linked domains are complementary domains that also share an internal overlap with each other. That coherence strengthens the combination and makes it more than the sum of its parts.

The selection criterion for a strong set of analogical domains is therefore maximum structural coverage with maximum internal coherence, not quantity. Three well-chosen complementary domains with strong internal links produce a richer diagnostic than ten loosely related ones.

This taxonomy disciplines the method. Without it, analogical reasoning risks becoming what it seeks to transcend: the accumulation of decorative metaphors that feel illuminating without actually diagnosing anything.

The Constraint of the Judge

A structurally rigorous analogy is not automatically an adopted solution. Its value is co-constructed between the structural correspondence and the human evaluator who receives it.

The 2005 theory was precise on this point: utility is a function of the match with the problem and with the evaluator’s own criteria. For organizational diagnostics, this introduces a constraint that the method cannot dissolve but can make visible: the judges of a proposed solution are often precisely the people whose reward system is aligned with the status quo that the solution diagnoses.

A chief risk officer evaluating a proposal to extend project manager accountability beyond delivery dates is simultaneously the person whose career was built on the existing governance model. A board reviewing a recommendation to shift from process-driven to principle-driven governance is the same board that approved the processes now being questioned.

The method does not resolve this. What it does is name it with precision, which is the first condition for treating it. It also shifts the framing: the resistance is structurally predictable rather than irrational. That means it can be anticipated and designed around, and sometimes dissolved by finding the frame in which the solution resonates with the judge’s own criteria.

This is itself an analogical problem: finding the presentation of the solution that achieves maximum structural coverage of the judge’s own conceptual framework. The method recurses.

The Demonstration: Project Management and the Short Horizon

The Observation

A technology asset with a multi-year lifecycle is managed through a sequence of fixed-budget, fixed-date projects. Each project team is constituted for the duration of the project and evaluated on its ability to deliver within its commitments. Decisions are made to protect delivery dates and budget envelopes, and those decisions degrade the asset over the longer term. The team’s focus has shifted from the organization’s interest to the project’s success, which are not the same thing.

The pathology is consistent and well-recognized by practitioners. What is less well-understood is its causal structure, and therefore what kinds of interventions might actually address it rather than merely managing its symptoms.

Applying the Taxonomy: Three Complementary Domains

The search for analogical domains begins with a structural characterization of the dysfunction: a local unit optimizes for its own constraints, producing decisions whose costs are externalized to the larger system and to the future. The local unit has no mechanism to perceive or weight these externalized costs. Its reward system reinforces the optimization.

Domain 1, Biology (apoptosis): the mechanism

A cancer cell is not malfunctioning within its own frame of reference. It is optimizing perfectly for its own reproduction, which is precisely what makes it pathological for the organism. What is absent is apoptosis: the signal received from the organism that tells the cell when to stop reproducing, when to sacrifice itself for the integrity of the whole. Cancer is cellular disconnection rather than cellular rebellion: the rupture of the feedback channel through which the organism communicates systemic state to its constituent units.

The project team is in the structurally identical situation. It is not irresponsible by nature; it is disconnected from the signals that would allow it to integrate the systemic impact of its decisions. The organizational system has not built the equivalent of apoptosis, the mechanism by which a local unit receives information about what its decisions cost the larger whole.

What this domain contributes: the dimension of mechanism. The pathology is architectural, not motivational. The solution direction is not better incentives alone but the construction of a feedback channel.

Taxonomy check: this domain covers the mechanism dimension. It does not address who bears responsibility for the effects, nor why the disconnection is individually rational.

Domain 2, Law (deferred responsibility): the governance gap

Law has progressively recognized that retrospective responsibility is insufficient when effects are diffuse and temporally distant. The evolution from simple liability to fiduciary duty, from shareholder primacy to stakeholder obligation, from individual fault to systemic accountability, represents a legal tradition grappling with exactly the problem at hand: how to assign responsibility for effects that materialize outside the perimeter and after the horizon of the actor who caused them.

The project manager’s perimeter of responsibility does not correspond to the perimeter of impact of their decisions. That is a governance design problem rather than a competence problem, and law has spent two centuries developing frameworks for precisely this mismatch.

What this domain contributes: the dimension of governance. It reframes the question from “how do we motivate better behavior” to “how do we design a responsibility structure whose perimeter matches the impact perimeter of the decisions being made.”

Taxonomy check: complementary to biology. Biology covers mechanism; law covers governance. Their structural dimensions are distinct, so they combine instead of competing.

Domain 3, Neuroeconomics (reward systems): the deep cause

The human brain discounts the future at a high rate: a certain reward today is structurally worth more than an uncertain consequence in eighteen months. This is a cognitive architecture, not a character flaw. And organizational reward systems, when they encode short evaluation horizons, amplify this natural discounting rather than counteracting it.

Nassim Taleb’s skin in the game formulates the structural response: the person who makes the decision must bear a portion of the risk of its future consequences, as an alignment mechanism rather than a punitive measure. When the decision-maker’s long-term interest is structurally coupled to the long-term consequences of their decisions, the cognitive discounting of the future is partially corrected by the system design.

What this domain contributes: the dimension of deep cause. The disconnection is not merely architectural (biology) or ungoverned (law); it is also individually rational given the reward structure.

Taxonomy check: linked to biology. Both neuroeconomics and biology address adaptive mechanisms, one at the cellular level and one at the cognitive level. This internal overlap strengthens the coherence of the combination without making them redundant. Together, all three domains cover: mechanism + governance + deep cause.

The Synthetic Diagnostic

The local unit is disconnected from systemic feedback (biology). The organizational system has no mechanism to assign it responsibility for its deferred effects (law). And its reward system gives it no reason to seek reconnection (neuroeconomics). Each domain alone produces a partial diagnosis. Together, they produce a complete one.

Solution Directions: What the Source Domains Suggest

The biological analogy suggests constructing a systemic feedback channel: a technology asset health metric that follows the project manager after delivery, visible to them during the project as a forward-looking indicator of the consequences their decisions are accumulating.

The legal analogy suggests redefining the responsibility perimeter. The next team that inherits the asset should have a formal mechanism to evaluate and record the state in which they received it, and that evaluation should be part of the delivering team’s record. Accountability extends to the handoff instead of ending at the launch.

The neuroeconomic analogy suggests realigning the reward system with the asset’s horizon rather than the project’s: evaluating the project manager’s performance at 24 months post-delivery, weighted toward asset quality indicators, as incentive alignment rather than punishment.

These three solution directions are as complementary as the domains that generated them. Each addresses a dimension the others do not, and their combination amounts to a governance redesign rather than a management improvement.

What the Method Does, and What It Does Not

The method produces precise diagnostics and solution directions that the source domains have already explored. It does not produce turnkey solutions: the transposition to the specific organizational context remains a work of judgment that the method cannot replace.

What it avoids: reinventing wheels that other domains have already manufactured, and remaining imprisoned in the managerial vocabulary that masks the real structure of the problem. A problem named in managerial terms produces managerial solutions. The same problem named in biological, legal, and neuroeconomic terms produces a radically different solution space.

The method also has direct implications for agentic AI systems. An agent that reasons purely by similarity, retrieving the nearest known pattern and applying it, is executing the organizational equivalent of process-following. An agent capable of structural analogy (identifying correspondence across distant domains, composing complementary representations, evaluating coverage rather than proximity) would be executing something closer to genuine reasoning. In AI systems, the gap between similarity and analogy is the gap between a sophisticated retrieval engine and a system capable of diagnosis.

Organizations do not lack solutions. They lack the ability to recognize them across domains.

The method remains constant. The domains change. And each time, the question is the same: what is the structural correspondence, who has already solved this problem, and what does that suggest here?

If the pathologies of organizations have already been solved (in biology, in law, in physics, in software design), what are we waiting for to transpose those solutions? And what does it say about our field that we keep reinventing the same diagnoses without looking next door?

Gabriel Mailhot
Software Architect and Software Engineering Quality Advisor
Series: Structural Analogy as an Organizational Diagnostic

The first three articles in this series examined specific symptoms: the instability of the People-Process-Tools model under high human variability, the strategic liability of tool positioning in a fast-moving AI market, and the asymmetric risk that regulated organizations are structurally failing to measure. This fourth article steps back to name the underlying condition, the diagnosis from which those symptoms follow.

AI is not just a technological disruption. It is an organizational architecture disruption.

A Mismatch That Went Unnoticed Until Now

For most of the industrial and information age, there was a comfortable relationship between the pace of technological change and the pace of organizational adaptation. Technology evolved, but slowly enough that organizations could absorb each shift, stabilize their processes around it, and build institutional knowledge before the next wave arrived. The lag between technological possibility and organizational practice was an inconvenience, not a structural threat.

That relationship has inverted. For the first time in the history of organized work, the speed of technological evolution is structurally outpacing the speed of organizational adaptation. Rather than a temporary disruption caused by one particularly fast technology cycle, this is a change of regime: a permanent shift in the relative velocities of technological change and organizational response.

The evidence is visible in every domain. Organizations complete a tool evaluation cycle and find the market has already moved. They design a training program for a capability that AI has partially automated by the time the program launches. They build processes around a set of constraints that are redefined by regulatory guidance six months later. The gap is widening rather than closing, and the organizational models built for a slower world are showing the strain.

Why Processes Were the Right Answer, and What They Assumed

Consider what processes actually are, and why they represented such a powerful organizational technology for so long. Beyond being a list of steps, a process is an encoded solution to a recurring problem, a crystallization of organizational learning into a repeatable, transferable, auditable form. When an organization documents a process, it is converting tacit knowledge into institutional memory, individual judgment into scalable behavior.

This is genuinely valuable, and it rests on three assumptions that held for most of the twentieth century and well into the twenty-first: that the problem being solved is sufficiently stable to justify encoding, that the conditions under which the process operates will remain predictable enough for the steps to stay valid, and that repeatability is itself a source of value (doing the same thing reliably, at scale, is better than improvising every time).

AI attacks all three assumptions simultaneously. It renders stable problems unstable by continuously shifting what is technically possible and economically rational. It introduces permanent uncertainty into operating conditions. And it transforms repeatability from an asset into a fragility: the ability to execute the same steps reliably becomes a liability when those steps are precisely what needs to change.

Processes are not so much wrong as misaligned, optimized for a world that is receding faster than most organizations have recognized.

Processes Are Becoming Legacy Systems

In technology, we use the term ’legacy system’ to describe something specific: not a system that is broken, but a system that was built for a set of constraints that no longer match the environment in which it now operates. A legacy system can be technically functional, even well-maintained. What makes it legacy is the growing gap between its underlying assumptions and current reality.

This is precisely the condition of process-driven organizational architectures in the face of AI-driven technological turbulence. The processes themselves may be executing correctly. The people following them may be doing so diligently. The problem is architectural. The way the organization governs work (through predefined steps, stable roles, documented procedures, sequential approvals) was designed for a world of slower change, and that world is no longer the operating environment.

The recognition is uncomfortable because process-driven governance is deeply embedded in how organizations understand accountability, compliance, and quality. Audits verify process adherence. Performance frameworks reward process execution. Regulatory frameworks often mandate specific processes. Saying that processes are becoming legacy systems does not mean that accountability, compliance, and quality no longer matter. It means that the mechanism through which they have been achieved is reaching the limits of its fitness for purpose.

Principle-Driven Systems as the Architectural Response

If processes assume stability, principles assume change. This is the essential distinction, and it points toward a different architecture for organizational governance.

A principle defines what must be true: the quality threshold that cannot be compromised, the constraint that is non-negotiable, the outcome that must be achieved. It does not prescribe how. It governs by results rather than by steps. Teams operating under a principle-driven system follow guardrails and pursue defined objectives, but they adapt their methods continuously as the environment evolves, while the principle itself stays stable.

This is not a novel idea in theory. Agile movements, outcome-based management, and mission-command doctrine in military organizations have all pointed in this direction. What is new is the urgency and the mechanism. The urgency comes from the acceleration of technological change. The mechanism comes from agentic AI architectures: systems that are natively coupled to objectives and constraints rather than to specific tools or procedures, and that can adapt to changing operating conditions without requiring the governance layer to be redesigned every time the tooling shifts.

Agentic architectures are not simply a more efficient way to execute processes. They are an architectural alternative to them, embedding adaptability at the level of the system itself rather than relying on human judgment to compensate for procedural rigidity.

Consider a concrete illustration. A logistics team operating under a process-driven model has a documented approval workflow for any change to its supply chain routing tools, a cycle that takes weeks and requires sign-off from architecture, security, and procurement. When a new AI-powered routing tool becomes available, the process triggers in full, regardless of how minor the change. Under a principle-driven model, the governing constraint is different: “all routing decisions must maintain delivery reliability above X%, cost variance below Y%, and full auditability.” An agent operating under those principles can evaluate and adopt a new routing tool autonomously, because what is being governed is the outcome rather than the mechanism. The principle holds, and the approval cycle dissolves.

The shift from process-driven to principle-driven governance is therefore primarily an architectural decision rather than a technology one. It concerns where stability should live in an organization. In a world of permanent technological turbulence, the answer is that stability must live in principles and outcomes, not in procedures and tools.

Organizations Must Be Engineered for Technological Turbulence

None of this argues for improvisation, or for abandoning the rigor that processes have historically provided. The argument is that rigor itself must be rearchitected. The question to settle is what to govern and at what level of abstraction, not whether to govern.

The organizations that handle the coming decade well will not be the ones that execute their current processes better, but the ones that have made a deliberate architectural choice: to invest in stable, well-defined principles rather than brittle, step-by-step procedures; to build agentic systems capable of working with continuously shifting tooling; and to develop adaptive governance frameworks that measure outcomes rather than adherence.

Engineering an organization for technological turbulence means building a particular kind of resilience. Bouncing back from disruption is one form of it; being structurally designed to absorb continuous change without losing coherence is another. The distinction matters, because the first is a recovery capability and the second is an architectural property.

The organizations that possess this property will not be immune to the challenges of an AI-accelerated environment. But they will face those challenges with a structural advantage: the ability to adapt their methods while holding their principles constant, and to absorb technological change as a normal operating condition rather than as an exceptional disruption.

Gabriel Mailhot
Software Architect and Software Engineering Quality Advisor
Series: Organizational Engineering for the AI Era

A Time-Tested Model Confronting an Unprecedented Context

The People, Process, Tools (PPT) model has shaped technology governance for decades. Its founding premise rests on the stability of human capital: skilled individuals, carrying a shared culture, apply defined processes using adapted tools. In its mature form, this model has always recognized that processes and tools encode organizational knowledge, with the human dimension serving as the activation vector.

But in an environment defined by high resource turnover, systematic reliance on external consultants, and the proliferation of teams assembled for short-term needs, that premise of stability no longer holds. The PPT model remains theoretically valid. What is in question is whether it can operate effectively when its human pillar is structurally unstable.

The ‘People’ Pillar as an Unstable Variable

When resource turnover is high, organizational knowledge disperses instead of accumulating. Every departure takes with it decision-making context, tacit practices, and domain understanding that formal artifacts only partially capture. Internal culture loses its coherence when a significant proportion of contributors operates within a temporary horizon. Practices imported from outside, heterogeneous by nature, complicate governance and introduce variability that neither documented processes nor available tools can adequately contain.

Under these conditions, structuring quality around a constantly renewing pool of human expertise exposes the organization to real risks: operational discontinuity, practice drift, and erosion of technological maturity. What this calls for is a shift in ratio, not an inversion of the model. The human factor remains central, but it can no longer serve as the sole foundation.

Repositioning the Foundation: Processes, Tools, and Platform Engineering

Faced with this reality, it becomes necessary to shift the model’s foundation toward elements that remain constant: processes, tools, and now the platform. This reconfiguration does not marginalize the human role; it relieves it of a responsibility it can no longer bear alone in a context of high variability. Individuals stop being the source of coherence and become its beneficiaries: they join a structured environment that guides them from day one, regardless of their background.

The natural evolution of this approach is platformization. An internal platform encodes organizational knowledge in a reusable ecosystem of normalized pipelines, pre-configured environments, project templates, automated controls, and standardized practices. It substitutes a human memory that erodes with turnover for an integrated, persistent operational memory.

That said, this approach is demanding. Building and maintaining a quality internal platform requires a competent, stable, and well-governed team. The structural irony is real: to reduce dependence on interchangeable individuals, you create an infrastructure that requires highly specialized individuals over the long term. Many organizations underestimate this cost. A poorly designed or poorly governed platform can become an even greater obstacle than having no platform at all. This repositioning is no magic solution but a long-term investment, with its own governance requirements.

Artificial Intelligence as a Lever and as a Responsibility

The integration of artificial intelligence represents a significant acceleration of this logic. Within a heavily tooled system, AI can transform static processes into adaptive mechanisms: automated code analysis, test generation, continuous review, technical drift detection, and domain knowledge assistance. These capabilities reduce dependence on individual expertise and strengthen the system’s resilience against team turnover.

However, it would be inaccurate to present AI as a frictionless solution. Its effective deployment raises several challenges:

• AI system governance (prompt engineering, continuous output evaluation, data lineage management, bias monitoring) itself creates dependence on specialized competencies (MLOps, LLMOps, Platform AI) that are often rare and expensive.
• AI shifts human dependencies; it does not eliminate them. It generates new layers of specialization, often more demanding than those it replaces.
• The cognitive debt risk is real: junior profiles who become overly reliant on AI suggestions may develop impoverished reasoning, undermining precisely the human capital the system seeks to make less critical.

An organization that adopts AI as a pillar of its quality engineering must simultaneously invest in the governance of that pillar. Without it, you are simply substituting one fragility for another.

Scope of Application and Model Limitations

This repositioning is particularly well-suited to high-variability organizations: fast-growing scale-ups, technology consulting firms, product teams with a significant proportion of contractors, or IT service delivery environments. In these contexts, platformization and AI augmentation represent high-ROI levers for operational resilience.

In high-criticality domains such as aerospace, healthcare, heavily regulated finance, and critical infrastructure, this logic must be applied with considerable care. Individual accountability and accumulated expertise remain non-substitutable pillars in these fields. Automation and standardization can play a supporting role, but they cannot render the human factor ‘interchangeable’ without introducing risks of a fundamentally different nature.

A Hybrid Model for an Asymmetric Environment

The repositioning proposed here aims to rebalance the PPT model rather than invert it. In an environment where human variability has become the norm, operational excellence rests on an asymmetric combination: a solid platform infrastructure, processes that enforce coherence, and well-governed AI that increases resilience. As an indispensable complement, it also needs a core of highly skilled individuals who maintain and evolve the system and embody its vision.

This model does not guarantee excellence on its own. It creates the structural conditions under which excellence becomes reproducible and less dependent on the luck of individual trajectories. What you gain is predictability. You do not eliminate the need for exceptional people; their role concentrates where it is least substitutable, in judgment, innovation, and governance of the system itself.

Gabriel Mailhot
Software Architect and Software Engineering Quality Advisor
Series: Organizational Engineering for the AI Era

In a previous article, I argued that the People-Process-Tools model needs to be rebalanced toward platform engineering in contexts of high resource variability. This article extends that argument one step further: in a world where AI is redefining the available tools every few months, even the ‘Tools’ layer of that platform deserves to be rethought.

The Paradox of Tool Positioning

In large organizations, the process of selecting, evaluating, approving, and deploying a new tool is rarely a lightweight exercise. Between security reviews, architecture assessments, procurement cycles, integration planning, and training programs, the full lifecycle from initial evaluation to production readiness commonly spans six to eighteen months. For highly regulated environments, that timeline can extend further.

This investment was once rational. When technology moved slowly, the cost of a rigorous positioning process was amortized over years of standardized usage. The approved tool became part of the organizational fabric, embedded in workflows, documentation, onboarding paths, and institutional memory.

That calculus has changed. The current cycle of AI-driven tool evolution is measured not in years but in months, sometimes weeks. By the time an organization completes its positioning process for a given tool, the competitive situation may have shifted, the tool itself may have been substantially transformed, and a new generation of alternatives may have emerged. The organization ends up optimized for a world that no longer exists.

Why This Was Rational, and Why It No Longer Is

It would be unfair to dismiss tool positioning processes as bureaucratic excess. They exist for legitimate reasons: security and compliance requirements, interoperability constraints, support and vendor stability considerations, and the very real cost of fragmented tooling across teams. These concerns have not disappeared.

What has changed is the nature of the coupling between an organization and its tools. In a slower-moving environment, investing deeply in a specific tool (building expertise, integrations, and institutional knowledge around it) generated durable returns. That depth was an asset.

In today’s environment, that same depth increasingly functions as a liability. Deep coupling to a specific tool creates switching costs that slow adaptation. Institutional knowledge built around a particular interface or workflow becomes obsolete as AI transforms the tools themselves. The more thoroughly an organization has embedded a tool into its operating fabric, the more painful the inevitable transition becomes.

The issue lies less in the tools themselves than in the strategic weight organizations assign to tool selection. When tool positioning is treated as a long-horizon strategic commitment, the organization assumes a stability that the environment no longer provides.

The Pivot: From Tools to Principles

If tools are no longer a stable strategic variable, what is? I would argue for principles: the articulation of expected behaviors, quality standards, operational constraints, and governance guardrails that define how work should be conducted, independently of which tool happens to be executing it.

This shift goes deeper than it may initially appear. Principle-driven governance asks organizations to invest in defining what good looks like (what outcomes are expected, what boundaries must be respected, what quality thresholds must be met) rather than prescribing the specific mechanism through which those outcomes are achieved. The principle is stable; the tooling that enacts it is fluid.

Consider the difference between these two governance postures:

Tool-centric: “All code reviews must be conducted using platform X, following workflow Y.”

Principle-centric: “All code changes must demonstrate coverage above threshold T, pass static analysis at severity level S, and include a human review sign-off before merging.”

The second posture is tool-agnostic. It can be enacted by a human reviewer, a CI/CD pipeline, an AI-assisted review agent, or any combination thereof. As tooling evolves, the principle remains intact. Only the mechanism of enactment changes, and that change becomes an optimization rather than a disruption.

Agentic Architectures as a Tooling Abstraction Layer

This is precisely where agentic AI architectures become strategically relevant, as a structural response to tooling volatility and not merely as a productivity lever.

A well-designed agent is coupled to an objective, a set of constraints, and a definition of acceptable outputs, rather than to a specific tool. Given those parameters, the agent selects, orchestrates, and adapts its tooling dynamically. The tool becomes an implementation detail, visible to the agent but invisible to the governance layer.

In a multi-agent architecture, this abstraction scales. Individual agents can specialize (one handling code analysis, another managing test generation, another monitoring technical debt), each operating against the same set of organizational principles while independently managing their tooling layer. As new, more capable tools emerge, the agents can incorporate them without requiring a governance review of the tool itself. What gets reviewed is whether the agent’s outputs continue to satisfy the principles.

This represents a meaningful inversion of the traditional governance model. Rather than controlling quality by controlling tools, the organization controls quality by controlling outcomes. The locus of governance shifts from inputs to outputs, from “what tool are you using” to “are the results meeting the standard.”

The implications for large organizations are significant. Tool evaluation cycles shorten dramatically. Shadow tooling, a persistent governance challenge in organizations with slow approval processes, largely dissolves as a concern: if the agent is producing compliant outputs, the underlying tooling becomes an operational detail rather than a governance risk.

Limits and Conditions for Success

This architecture relocates governance complexity rather than eliminating it. Several challenges deserve honest acknowledgment.

Defining good principles is harder than it appears. Principle-driven governance requires organizations to articulate, with precision, what they actually care about. Vague principles produce inconsistent agent behavior. Overly rigid principles reproduce the brittleness of tool-centric governance in a different form. Getting the level of abstraction right requires significant organizational investment and ongoing calibration.

Output evaluation at scale is a partially unsolved problem. For well-defined, measurable outcomes such as test coverage, static analysis scores, or deployment frequency, this is tractable. For more qualitative dimensions like architectural coherence, domain appropriateness, and long-term maintainability, it remains genuinely difficult.

Agent maturity remains a limiting factor. Current agentic systems are capable and improving rapidly, but they are not infallible. Human oversight, particularly for high-stakes decisions, cannot be fully removed from the loop, at least not yet.

Regulated environments require special treatment. In domains where regulatory compliance is tied to specific tools, processes, or audit trails, the fluidity of agentic tooling introduces compliance risks that cannot be resolved through principle-definition alone.

A Governance Model Built for the Speed of Change

The organizations best equipped for the current period of technological acceleration are not necessarily those with the best tools. They are those with the clearest principles, along with the architectural flexibility to let those principles be enacted by whatever mechanisms become available.

This is a direct extension of the argument made in the first article of this series. If the People-Process-Tools model needs to be rebalanced toward platform and process in a context of human variability, then the tooling layer of that platform needs to be rebalanced toward principles and agents in a context of technological volatility.

The strategic question for technology leaders has shifted from “which tools should we standardize on” to “which principles are non-negotiable, and how do we build systems, human and agentic, that reliably enact them, regardless of what the tooling landscape looks like six months from now.”

Gabriel Mailhot
Software Architect and Software Engineering Quality Advisor
Series: Organizational Engineering for the AI Era

The first two articles in this series examined how to rebalance technology governance toward platform engineering in contexts of high human variability, and why tool positioning is becoming a strategic liability in a world of accelerating AI. This third article steps back from the technical layer to address a more basic challenge: the organizational resistance that makes any of these transformations genuinely difficult, and the asymmetric risk of not moving fast enough.

Organizations have spent decades building systems to control technological risk. They have not built systems to detect technological irrelevance.

An Organization Does Not Have Processes: It Is Its Processes

There is a common way of framing organizational change that sounds reasonable but is misleading: the idea that an organization has processes, in the same way it has office space or software licenses, assets that can be evaluated, updated, or replaced through a sufficiently deliberate management decision.

The reality is more unsettling. An organization does not merely possess its processes. In a meaningful sense, it is its processes. They define how decisions get made, how work gets coordinated, how risk gets assessed, how value gets delivered. They encode the accumulated responses to past failures, regulatory pressures, and hard-learned lessons. Rather than a layer sitting on top of the organization, they are its operating identity.

This is the central insight behind Allen Holub’s work on systems of work: you cannot remove or change one element without affecting the entire system, and the system will actively resist changes that threaten its coherence, pulling the organization back toward its previous state. Organizational resistance to change is therefore not a failure of leadership courage or a deficit of innovation culture; it is the system functioning exactly as designed. The challenge is not to overcome that resistance through force of will, but to understand which parts of the system need to transform, and how to do so without collapsing the coherence that holds everything together.

AI Is Not Waiting at the Door: It Is Already Inside

Regulated organizations (financial institutions, healthcare systems, energy companies, public sector bodies, legal and professional services firms) have historically managed technological adoption through deliberate, controlled processes. This was rational. In a stable technological environment, moving carefully reduced integration risk, ensured regulatory compliance, and preserved operational continuity.

That posture is increasingly misaligned with the current moment. AI does not present itself as a discrete technology that organizations can choose to evaluate and adopt on their own timeline. It is infiltrating through every layer of operations: the productivity tools individual contributors are already using, the platforms vendors are embedding AI capabilities into, the competitors who are quietly compressing delivery timelines and cost structures, the talent market where expectations about AI-augmented work are shifting rapidly.

In financial institutions, the question is no longer whether AI will affect credit risk modeling, fraud detection, regulatory reporting, or client-facing services. It already does, whether through internal adoption or through the competitive and regulatory environment that surrounds the institution. The relevant question has shifted from should we adopt AI? to at what rate are our current processes becoming a competitive and operational disadvantage, and are we measuring that rate?

The Asymmetry of Risk That Does Not Appear in Governance Reports

This is the most structurally important challenge for regulated organizations, and it is one that their governance frameworks are poorly designed to surface.

The risk of moving too fast with AI is visible and auditable. It manifests as compliance failures, model risk incidents, data governance violations, operational disruptions. It appears in risk committee reports, regulatory examinations, and audit findings. Regulated organizations have spent decades building sophisticated machinery to detect, quantify, and contain exactly this type of risk, and they are genuinely good at it.

The risk of not moving fast enough is structurally different. It is diffuse, cumulative, and largely invisible to conventional risk measurement frameworks. It does not generate an incident or trigger a regulatory finding. It accumulates silently as a widening gap between the organization’s operational capabilities and those of its environment: competitors, technology providers, talent expectations, and eventually regulators themselves.

By the time this second type of risk becomes visible, it typically manifests not as a discrete event but as a condition: an inability to attract engineering talent with relevant AI skills, a growing gap in delivery speed relative to competitors, a technological debt so deep that transformation becomes structurally prohibitive.

Consider a concrete illustration. A major bank’s regulatory reporting process relies on manual data consolidation across legacy systems. The cycle takes three to four weeks per quarter, absorbs dozens of analyst hours, and produces results that are already partially stale by the time they reach the board. An AI-augmented equivalent could compress that cycle to days, reduce error rates, and free the analysts for higher-judgment work. The risk of implementing such a system is visible and manageable (model validation, auditability, change management). The risk of not implementing it accumulates invisibly: mounting operational cost, growing talent frustration, and an expanding gap relative to institutions that have already made the transition. The first risk has a line in the risk register; the second does not.

The asymmetry is this: the governance machinery of regulated organizations is optimized for the first type of risk and structurally blind to the second.

Regulation as Constraint, and as Underestimated Lever

In conversations about AI adoption in regulated industries, regulatory constraints are frequently invoked as the primary justification for caution. This framing is not wrong; regulatory constraints are real and consequential.

But it is increasingly incomplete, and in some cases it has become a rhetorical convenience that obscures something less comfortable: the pace of adoption is often constrained less by regulation than by organizational inertia dressed in regulatory language.

Regulators themselves are not standing still. Financial supervisory authorities, including the AMF, OSFI, the European Banking Authority, and others, are actively developing AI governance frameworks, publishing guidance on responsible AI use, and in some cases explicitly encouraging institutions to build AI capabilities in areas such as real-time compliance monitoring, fraud detection, and operational risk management. The implicit message from regulators is not “wait until we have figured this out” but “develop the governance maturity to use these tools responsibly.”

An organization that waits for the regulatory framework to be fully stabilized before investing in AI capabilities is making a specific bet: that the cost of early compliance investment outweighs the cost of late adoption. In a faster-moving environment, that bet is becoming harder to justify.

Regulation, properly understood, is a constraint on the speed and form of AI adoption, not a justification for its absence.

Navigating the Transition: Changing Without Breaking

The response to this challenge is not a wholesale transformation that attempts to change everything at once. Holub’s insight about systems of work applies with particular force here: an organization that tries to revolutionize its entire operating model in response to an external pressure is as likely to collapse its coherence as to improve its capabilities.

This requires organizations to develop a capability that is itself relatively new: the ability to map their own processes according to their strategic value in an AI-augmented environment. Not all rigidity is equivalent. Some processes derive their value precisely from their stability and resistance to change: regulatory compliance mechanisms, audit trails, risk controls, fiduciary obligations. These are not candidates for AI-driven transformation. They are anchors that must be protected even as the surrounding system evolves.

Other processes derive value from their efficiency and adaptability: knowledge management, delivery pipelines, onboarding, tooling, internal reporting, operational monitoring. These are precisely the areas where AI augmentation offers the highest return, and where the cost of inaction is accumulating most rapidly. Treating them with the same conservatism as core compliance processes is a category error, not prudent risk management.

The practical implication is a dual governance posture: rigorous protection of the processes whose value is their stability, combined with active transformation of the processes whose value is their performance. The organizations that handle this transition most effectively will be those that can hold both imperatives simultaneously, and resist the temptation to use the first as cover for avoiding the second.

This is not a call to abandon prudence, but to redefine where prudence actually applies.

Gabriel Mailhot
Software Architect and Software Engineering Quality Advisor
Series: Organizational Engineering for the AI Era