Most executives are still deciding agentic AI strategy: retrofit or reimagine.

That is what December 3rd is for.

On August 4th, we published the first piece in Blaine Mathieu’s four-part series, Reading the River, adapted from his book The River Doesn’t Wait. The line that did the most work in it was short.

“The right position on the spectrum is not selected. It is navigated.” [1]

That distinction is easy to agree with and hard to act on. Selection assumes a stable choice. Navigation assumes the answer keeps moving, which means every executive reading the series is left with the same practical problem: what do I actually do about one specific outcome I am accountable for, and how will I know when what I decided has stopped being right?

The timing is not incidental. Roughly 13 percent of enterprises have agentic AI fully deployed at scale, and 62 percent are still in experimentation [2]. McKinsey’s own survey lands in the same place from a different direction: no more than 10 percent of respondents report scaling agents in any individual function [3]. Which means most senior executives right now are not defending a position they already committed to. They are deciding, and doing it while the capability underneath the decision keeps moving.

On Thursday, December 3, Blaine runs that work in a room. Four hours at K&L Gates on the Embarcadero, with a small group of senior executives, each one working the question against their own business rather than against a case study.

This is the only open session. The material comes out of his private work with executive teams, where one company’s leaders work a single shared outcome together. The open version does something the private version cannot: executives from a dozen industries answer the same question about their own operations, and everyone in the room hears every answer.

That variance is the point rather than a nice-to-have, because adoption is nowhere near evenly spread. Technology sits around 33 percent and financial services around 31, insurance at 28 and healthcare at 27, supply chain and logistics at 21, construction at 14 [2]. The executive across the table is working the same question from a different place on that curve, which is exactly the perspective your own leadership team cannot give you.

Register

What you walk out with

Not notes. A position on one outcome, in four parts, written down.

How far to take it this year. Where the work behind your outcome sits on the retrofit-to-reimagine spectrum, and where it needs to move by when. Retrofitting puts agents into the seats and workflows you already have and improves cycle time and cost inside the existing process. Reimagining redesigns the workflow and the roles together, changing what the process is and who is in it. Neither is correct everywhere, which is exactly why the judgment has to be made per outcome rather than per company.

What that requires. The investment, the capability and the amount of change your organization has to absorb to get there, on a schedule it can survive.

Who has to be with you. The two or three executives whose agreement you need, named, plus the conversation to have with each of them.

What would tell you to reassess. Three questions written against your own outcome, each with an owner and a review rhythm. These are the ones that fire when the position has gone stale, months before your quarterly numbers would say anything.

You also leave with the strongest argument against your own position, in your own handwriting, because somebody in the room will have spent twenty minutes constructing it.

The exercises are built for pairs, and that changes the output

Your registration covers two seats. That is a design decision rather than a discount.

In the first exercise, colleagues are split up on purpose. You assess your outcome with someone who comes at it cold, because a read that cannot be explained to a stranger in three minutes is not a read yet. In the second, colleagues work side by side and commit together.

Someone attending alone leaves with a position. Two people who came together leave with an agreement. Those are materially different things to carry back to a leadership team, and the second one survives contact with a budget cycle far better than the first.

The ask is specific: bring the executive you would have to win over to actually change this work. Not a direct report taking notes.

Who it is for

Senior executives who own a business outcome measured by a number, at a scope where changing direction carries real cost.

The sharpest fit sits in operations, customer care, marketing and sales, claims and underwriting, servicing, and supply chain. Divisional COOs and general managers qualify on scope alone.

CIOs, CTOs, chief transformation officers and chiefs of staff are welcome and frequently bring the line executives who own the number with them. That is often the highest-value way to use the registration.

How the morning runs

8:30 AM Check in, coffee, networking. Lobby security needs photo ID, so arrive by 8:45.

9:00 AM Where agentic AI is genuinely moving, and where it is noise.

9:35 AM Your own outcome: how exposed the work behind it is, and defending your read to someone who does not know your business.

10:40 AM How far to take it this year, and the argument against you.

11:25 AM Your three questions, an owner, and a rhythm.

12:05 PM Lunch and open conversation. Close at 12:30.

Thursday, January 14. There is an optional cohort online session for sixty minutes to compare what moved, what stalled, and what the three questions caught. Included with every seat, and the part of the program that makes the September position something other than a snapshot.

Chatham House Rule applies throughout, and we seat one company per competitive set, so nobody in the room is briefing a competitor.

Registration

$495

A second seat is optional. Your registration covers two seats so you have the choice. One seat is all you need.

If a specific person already comes to mind, whoever owns the data your operation depends on, or the peer whose function you would have to work with, bring them and you make the decision together instead of re-selling it later.

A third seat is $245.

Included is the workshop, lunch, a Team Kit you can run again with your own team, a signed copy of The River Doesn’t Wait, the January 14 cohort session, and membership in AI Realized.

• If you’d like to bring along a colleague, on the registration form, select +1 Colleague and we will email you a free ticket code for them. Select +2 Colleagues and we will send a free code and one for $245.

• Every request is reviewed, because of the one-company-per-category rule, and you will hear back within two business days.

See the AI Realized website for the full workshop details.

Register

Parts 1, 2, 3, and 4 of Reading the River publish between now and the workshop. Reading them is useful and it is not required. The morning assumes no preparation of any kind.

Sources

[1] Reading the River: Why Agentic AI Is a Navigation Problem, Not a One-Time Decision (Part 1 of 4), Blaine Mathieu, AI Realized Now, 2026
[2] Agentic AI Adoption Statistics, First Page Sage, 2026. Figures reflect data through July 24, 2026. This report aggregates published research from McKinsey, Gartner and IDC rather than reporting an original survey.
[3] The State of AI, McKinsey & Company, 2025
[4] The River Doesn’t Wait: A Senior Executive Guide to Navigating the Surge of Agentic AI and Pulling Away From Your Competitors, Blaine Mathieu, 2026

About Blaine

Blaine Mathieu is a multi-time C-suite executive and former Gartner analyst. He is the author of “The River Doesn’t Wait: A Senior Executive Guide to Navigating the Surge of Agentic AI and Pulling Away From Your Competitors” (June 2026), and regularly speaks on AI and agentic AI and facilitates executive workshops based on the book’s framework. He publishes a monthly briefing for senior executives on the river’s movement at riverdoesntwait.com. Subscribe to Blaine’s Substack newsletter.

In Case You Missed It:

Here’s the link to AI Realized Now Issue #21

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of enterprise AI.

Join

The first article laid out the framework; the second covered the first Tension: the coupled redesign of workflow and workforce. This article takes on the second Tension: context.

The September 15 workshop in San Francisco takes this material into a room. Registration details follow the article.

The frame so far

The river of agentic AI capability never stops moving, almost never reverses, and its pace varies. Every enterprise is choosing, deliberately or by default, between retrofit (using agents to make the existing operating logic run faster) and reimagine (redesigning the operating logic itself), and because the river keeps moving, that position is navigated continuously rather than selected once. The navigation happens inside the boat - whatever scope of the organization you control - at three linked levels the book calls Tensions. The first was the design of the boat and its crew. This article is about what the crew can see.

The problem your agents already have

As the work is being redesigned, the AI agents helping to staff it have a problem you have probably not yet made yours.

They do not know what success looks like. They do not know what the firm cares about this quarter. They do not know the unwritten rule about which customer-service exception gets escalated and which one gets resolved quietly. They do not know the policy that lives in the head of the senior controller who used to be three desks away. Some of this a human in the role would have picked up over years on the job. None of it is automatic for a team that has just been reconfigured around new seats, new tools, and new handoffs.

The decision about what information to provide them is the second Tension. It is also, of the three, the most personally implicating, because the decision is not really about information. It is about how much of your own awareness, judgment, and influence you make explicit so that the teams of people and agents in the redesigned workflow can act on it.

Context is more than data

Most discussions of “data for agents” stop at data, narrowly understood: the records the agent can look up, the document store it can search. These are necessary. They are not (only) what I mean by context.

Context is what the team operates with and against. The data, yes, but also the goals the team is working toward, the constraints on how it can get there, the institutional norms the firm operates by, the implicit knowledge a human in the role would have absorbed without anyone teaching it, and the knowledge of the wider marketspace that shapes what a sensible decision looks like in this firm versus a different one. It is all the information the team needs to do useful work, plus all the information about what useful work means here.

Some agents operate against a tightly bounded slice of all that: this account, this transaction, this single step in this single workflow. Most agents in production today live inside an envelope like this, because narrow context is easier to provision, audit, and control. For some work, especially retrofit work, that envelope is exactly the right size. Other agents operate with awareness across the function, across functions, or across organizational boundaries to partners, customers, and suppliers. The wider view enables work the narrower view cannot. Neither shape is right in the abstract. The choice is about what the specific work in front of you requires. Most enterprises have not made the choice deliberately; they have wound up with whatever context envelope their systems made easy. The choice deserves to be made on purpose.

What you control and what the team needs are the same thing

Here is a claim that sounds strange the first time and becomes obvious in retrospect: setting and controlling context is much of what a senior executive actually does. You decide what information flows to whom. You decide what outcomes the function is optimizing for. You decide what constraints apply to which decisions. You hold the institutional memory of why a policy exists. You bring in the external knowledge - the market, the regulator, the competitor’s last move - that makes a decision sensible in this firm and not just in any firm.

Now look at what a team in front of you needs to operate well, whether the team is human, agent, or hybrid. It needs to know which information flows to whom, what outcomes the work is optimizing for, the constraints, the priorities, the institutional memory, the external context. The two lists are the same list. From the executive’s side, the activity is called setting context. From the team’s side, it is having the context needed to act.

Your CIO can architect the systems that hold and route context: the data layer, the integration plumbing, the security perimeter. Business context is what only the line executive can provide. Nobody else in the firm knows what the function is actually trying to do and why, what the unwritten rules are, and what the firm is willing to trade against what.

There is something extra challenging in this for many senior executives, and it is not the challenge of giving up authority. It is the challenge of making explicit what has been implicit. Most senior executives carry a great deal of context in their heads - priorities, constraints, institutional history, judgment about what matters - that they have never had to write down or say out loud. Setting context for a hybrid team forces that articulation. That confrontation between implicit and explicit is most of what this Tension is actually about.

One important boundary: providing rich context is not the same thing as transferring authority. Authority comes from the combination of how the work is structured, what context is available, and what oversight catches the team when it goes wrong. Those are the three Tensions, working together, and none is a precondition for the others.

Three levels of scope

The context required for any given piece of work sits at one of three levels relative to what you personally own.

Level one is context you own directly: your function, your team, your priorities.

Level two is context that sits inside the organization but outside your direct purview: another function’s processes, a peer executive’s domain. Level two is where the most transformational reimagine work often lives, because the boundaries where two functions meet are exactly the boundaries the old workflow had to navigate by hand. Your move at level two is to build cross-functional coalition with peers whose scopes have to be combined for the work to make sense.

Level three is context that sits outside the organization entirely: partners, customers, suppliers, the regulatory environment. Your move there is to catalyze collaboration with external parties whose interests do not automatically align with the firm’s.

Each level escalates the political and organizational difficulty. Level one is hard, but it is your hard. Level two requires other executives, with their own pressures and incentives, to combine context with you. Level three is harder still.

The levels are not stages you pass through on the way from retrofit to reimagine. Think of the diagram as a target with you at the center. For any given piece of work, the question is which ring you have to reach to assemble the context the work actually needs. Some reimagined work lives entirely at level one. Some retrofit work touches level two. Closer to the center is not better; it is just easier.

There is a tendency worth knowing: as more of your function moves toward the reimagine end, the share of work that reaches beyond level one tends to grow, because reimagined work more often crosses boundaries. That tendency has implications for the coalitions you will eventually want to have built.

The empirical record matches this structure. Level-one cases are widespread. Level-two cases cluster at a small number of lighthouse firms. Moderna merged HR and IT under one executive, Tracey Franklin, whose framing is direct:

“Together, we can truly architect the flow of work, how tasks, information and decisions get done.” [1]

At ServiceNow, Jacqui Canney holds the title Chief People and AI Enablement Officer and explains why the coalition exists:

“It can’t just be like, here’s the AI team, here’s the employee workflow team, here’s the CRM team. It has to literally go across.” [2]

At JPMorgan, the level-two coalition is named in public company materials: the heads of Asset and Wealth Management, technology, data and analytics, and HR co-sponsor the bank’s agentic-AI program. [3]

Level three is more nascent but real: PepsiCo, Siemens, and NVIDIA announced a multi-firm digital-twin collaboration in January 2026, [4] with agents operating against a shared model of PepsiCo’s production facilities that none of the three firms could have built alone, and TraceLink has built context-sharing infrastructure across what it reports as more than 310,000 pharmaceutical supply-chain trading partners. [5]

A journey, not a deliverable

You may be looking at the three levels and concluding that level two and level three are beyond your reach, which is exactly the conclusion that reduces your ability to reimagine. So let me handle it directly.

The context architecture for any specific function is something you build out over time. You start with the context the work in front of you requires. You reach into level two when a specific piece of work calls for it, and into level three when one calls for it, and not before.

Moderna’s trajectory captures the shape: sixteen hundred custom in-house AI tools at the end of 2024, more than three thousand six months later. Nobody sat down on day one and designed three thousand tools. [5] They built the first batch and kept going as the work surfaced what was missing. ServiceNow’s HR team generated more than a thousand candidate use cases, built a rubric, and refined the working set down to twenty-seven. The discipline is what produces a coherent architecture rather than a thousand half-implemented experiments.

Outcome setting is the highest form of context

The higher in the leadership hierarchy you go, the more of the context you provide concerns outcomes rather than procedures. A frontline manager provides context that is mostly procedural: do this step, then this step, based on this data. A senior executive provides context that is mostly outcome-based: ship this by this date, with these constraints, optimizing for these things over those. A CEO provides context that is almost entirely outcome-based: this is what the firm is for, this is what we will and will not do.

Rich, outcome-based context is what makes wider autonomy possible, and the executives running the largest deployments treat the two as a single design decision. Lori Beer, JPMorgan’s CIO, describes the bank’s early focus:

“What’s the right level to create an agent; how do you give them identity and access?” [7]

The bank’s agents are deliberately scoped narrower than the humans whose tasks they perform.

“You don’t want them to go outside the bounds of the specific tasks that they can do,” Beer says, “because they don’t have the same thinking a human does.” [7]

Context provision and bounded authority are designed together because, in her working frame, they have to be.

That is the bridge to the third Tension. Rich context, especially outcome-based context, enables wider autonomy without recklessness. Narrow context forces narrower autonomy, because the team does not have what it would need to act safely beyond a tight envelope. How much the team gets to do without a human in the loop, and what catches a bad call before it becomes a bad outcome, is the subject of the final article in this series.

Key takeaways

• Context is more than data. How much to give and at what scope is an organizational decision, not a technical one, and it deserves to be made deliberately.

• What an executive does and what a team needs to operate well are the same activity, seen from two angles. The scope of context you can set is the scope of your organizational reach.

• Providing rich context is not, in itself, a transfer of authority. Authority comes from context, workflow design, and oversight navigated together.

• Three levels of context scope: what you own, what sits inside the firm but outside your purview, what sits outside the firm entirely. The right level depends on what the work requires; it is not a sequence to march through.

• Context is architecture, not plumbing. It gets built out function by function as the work demands more, not finished as a deliverable.

Next in this series: the boat has its design and the crew its context. The last Tension is how much that crew gets to do on its own, and whether the governance that catches a bad call is bolted on after the fact or built into the way the work itself runs.

Resources

• Reading the River: Why Agentic AI Is a Navigation Problem, Not a One-Time Decision, AI Realized Now, August 2026

• Reading the River, Part 2: When the Work Itself Changes, August 2026

• The River Doesn’t Wait, Book

• The River Doesn’t Wait, website

• Subscribe to Blaine’s Substack, newsletter

Sources

[1] Why Moderna Merged Its Tech and HR Departments, Wall Street Journal, May 2025; Why Moderna merged HR and IT to better “architect the flow of work”, Allie Nawrat, UNLEASH, June 2025
[2] ServiceNow’s chief people officer on leading AI change management within the tech giant, Paige McGlauflin, HR Brew, July 2025; Jacqui Canney, ServiceNow CHRO, Demystifies AI Transformation, The Josh Bersin Company podcast, November 2025
[3] JPMorgan Chase Company Update, February 2026
[4] PepsiCo Announces Industry-First AI and Digital Twin Collaboration with Siemens and NVIDIA, PepsiCo, January 2026; PepsiCo reimagines supply chain performance through digital twins and AI with Siemens, Siemens, January 2026
[5] TraceLink Builds on Transformative 2025 to Scale Agentic Orchestration Across the Global Life Sciences Supply Chain in 2026, TraceLink, February 2026
[6] Why Vaccine-Maker Moderna Is Injecting AI Across the Company, Ben Sherry, Inc., May 2025, (source for the 1,600 custom in-house AI tools figure as of December 31, 2024; the mid-2025 figure of more than 3,000 was reported in subsequent Moderna public statements)
[7] How JPMorgan’s CIO is reshaping work at the bank with a $19.8 billion annual tech and AI budget, John Kell, Fortune, April 2026; Securing the next generation of AI agents

Workshop

Retrofit or Reimagine: An Agentic AI Strategy Workshop for Executives

Three weeks out, and a handful of competitive categories are still open.

Tuesday, September 15, 2026, 8:30 AM to 12:30 PM, K&L Gates, Four Embarcadero Center, San Francisco.

Blaine runs this material as a working session. Each executive brings one outcome they are personally measured on, takes a position on how far to go this year, and defends it to someone from another industry. $495 covers two seats, because the exercises are built for pairs. Every registration is reviewed and one company is seated per competitive set.

Full details

Register

About Blaine

Blaine Mathieu is a multi-time C-suite executive and former Gartner analyst. He is the author of “The River Doesn’t Wait: A Senior Executive Guide to Navigating the Surge of Agentic AI and Pulling Away From Your Competitors” (June 2026), and regularly speaks on AI and agentic AI and facilitates executive workshops based on the book’s framework. He publishes a monthly briefing for senior executives on the river’s movement at riverdoesntwait.com.

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of Enterprise AI.

Join

In this Issue

Three articles in Issue #22, each from a different angle. Blaine Mathieu on strategy: the first of his three Tensions, where he argues workflow and workforce are a single decision, and that changing one without the other is why so many agent deployments underdeliver. Curtis Sparrer with journalist Sharon Goldman on what she hears from enterprises every day, which is that the obstacles are operational rather than technical: security approvals, usage bills nobody modeled, data that is not ready. And Ivan Lee on cost, modeling two years of renting frontier AI against two years of owning it. Then on September 15 in San Francisco, Blaine leads a working session for executives who owe real results from agentic AI this year.

ARTICLE

Reading the River, Part 2: When the Work Itself Changes

There is one operational decision in agentic AI that matters more than any other, and Blaine Mathieu argues most executives believe they are making it when they are not. Choosing which agents to deploy is not it. The real decision is whether workflow and workforce are one question or two.

Most enterprises treat them as two. IT scopes the agent, HR sizes the team, the COO redesigns the process, each on its own schedule, and the relationship between the results ends up accidental. The enterprises pulling ahead change what the work is and who does it at the same time. Part two separates the two shapes that redesign takes, one that collapses the org chart and one that rewires the work inside it, and shows which layer of the organization each compresses.

Read the article

ARTICLE

The $1,000 Lunch and Other Things Your AI Deployment Will Teach You: A Conversation with Sharon Goldman

A developer sets Claude Code on a task and goes to lunch. Claude spends $1,000 while they are out. Sharon Goldman has been collecting stories like that since she launched Ground Level AI, and she told the AI Realized podcast that surprise token bills have become a running theme in her reporting.

Curtis Sparrer writes up the conversation. Goldman covered AI daily for Fortune and VentureBeat before going independent, and what she hears from enterprises now is that the obstacles are operational rather than technical: CISO permission decisions, usage-based spend nobody modeled, data that is not ready, and employees told to use AI aggressively and then told to slow down because it costs too much.

Read the Article

ARTICLE

The AI Ownership Threshold

At what point does renting frontier AI cost more than owning it? Ivan Lee models the answer over two years and finds the crossover at roughly 40 developers using agentic coding tools. At that level, API fees reach about $1.37 million, nearly matching the fully loaded cost of self-hosting an open-weight model.

The economics shift quickly on either side of that line. Renting wins for smaller teams. At 100 developers, ownership costs roughly half as much. At 500, the gap grows to as much as $14 million. Lee lays out the assumptions behind the calculation, explains why compliance or strategic control may trigger ownership even sooner, and offers a practical framework for deciding when to rent, optimize, or own.

Read the Article

WORKSHOP

Retrofit or Reimagine. Agentic AI Strategy for Executives, September 15 in San Francisco

If you’re expected to show real results from agentic AI this year, you’re working on technology that moves faster than most organizations can absorb, in a market giving you little that holds still.

This workshop is for you.

We asked Blaine Mathieu to lead a working session on September 15 in San Francisco. It brings you together with a small group of senior executives, each working on a specific result they’re accountable for. You leave with a plan you can defend:

→ how far to take agents into that work this year, and how fast
→ what it asks of your workflow, your information, and your oversight
→ who else has to be with you
→ what would tell you to adjust

Plus crisp answers to the questions your CEO and board will ask.

Blaine is a former enterprise CEO, CPO and CMO, a former Gartner analyst, and the author of The River Doesn’t Wait. This is the only open session of the material.

Registration covers two seats, so join us and please invite other executives in your network.

Read more

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

Introduction

There is a line where renting frontier AI and owning it cost exactly the same, and as of July 2026 it sits at roughly 40 developers running agentic coding tools.

This paper calculates the relative costs of renting vs. ownership over a two-year time horizon. Forty developers at current agentic-tooling intensity consume about 8.4 billion tokens per month. Routed through the frontier flagships, OpenAI’s GPT-5.6 Sol or Anthropic’s Claude Opus 5, that volume bills roughly $1.37 million over two years. Served instead on a self-hosted open-weight model, GLM-5.2 on two 8x H200 nodes, it costs roughly $1.35 million over the same two years, all-in: hardware purchased outright, power, colocation, a dedicated two-person platform team, and credit for what the hardware resells for at month 24. At 40 developers, the two bills are the same dollar figure. That is the ownership threshold.

Everything else in enterprise AI economics is a position relative to that line. Below it, renting wins: a ten-developer team pays about $327,000 over two years in API fees against $1.13 million to own. Above the line, the advantage compounds: at 100 developers, owning wins by 1.9x to 2.0x; at 500 developers, roughly 105 billion tokens per month, renting bills $17.2 to $18.3 million over two years against $5.4 million owned, a 3.2x to 3.4x advantage.

This paper derives the threshold, states every assumption behind it, and places the economics inside the larger framework that should govern the decision, including the two thresholds that have nothing to do with finances. The companies that make the best AI decisions over the next decade won’t necessarily use the smartest models. They’ll make the smartest ownership decisions.

The threshold, derived in humans

Nobody budgets in tokens. Organizations budget in seats and headcount, so the model starts there, with the two workload archetypes that dominate enterprise consumption. The conversion assumptions are stated so you can substitute your own telemetry.

Chatbot assumption: a typical enterprise chat exchange carries about 2,000 input tokens (system prompt, retrieved context, conversation history) and 500 output tokens, roughly 2,500 tokens per inference. An active user runs about 10 exchanges per working day, 21 working days a month: roughly 210 inferences, or half a million tokens, per user per month.

Developer assumption: a developer using agentic coding tools (Claude Code-class agents that read repositories, run commands, iterate on failures, and verify their own work) consumes 5 to 15 million tokens per working day depending on intensity, about 210 million per month at the 10M/day midpoint.

Those assumptions translate headcount into infrastructure. All figures are two-year cumulative costs:

API figures use Claude Opus 5 and GPT-5.6 Sol at list; owned figures are fully loaded, net of hardware resale, and derived in the model section below.

The 1:1 line itself includes a two-person platform team ($900,000 for two years) carried by the deployment: 1:1 lands at roughly 7 to 8 billion tokens per month, between 35 and 40 agentic developers depending on which flagship you’d otherwise rent (node quantization puts the exact crossing at 37 developers against Sol and 40 against Opus 5). This is the verified number for an organization standing up its first deployment, and it is the headline of this paper.

Agentic development crosses the threshold with a single team: 40 developers is not a hyperscaler, it is an engineering organization at a mid-size company. Boards budgeting AI by headcount are measuring the wrong axis. The axis that matters is autonomy: how many tokens your systems consume when no human is watching.

One variable deserves flagging even though the model deliberately excludes it: the threshold above assumes consumption holds flat. Per-developer token consumption has in fact been rising as agentic tools mature, roughly 1 million tokens per developer-day in 2024 to 10 to 20 million now, and any continuation of that trend moves organizations toward the line faster than headcount alone would. The model does not assume it continues; readers planning capacity should at least ask whether it will.

The model you’d actually host

A rent-versus-own comparison is only as credible as its own side. “Self-hosting” in 2026 does not mean settling for a small model and a quality haircut. Two releases in recent months moved open weights to within arm’s reach of the closed flagships, and they anchor the two ownership configurations this paper prices.

GLM-5.2 (Z.ai, released June 16, 2026, MIT license) is the deployable-today assumption. It is a 744B-parameter Mixture-of-Experts model with about 40B active parameters per token and a 1M-token context window, landing near the frontier on single-shot coding benchmarks. The MIT license permits commercial use, fine-tuning, and air-gapped deployment without usage clauses. The hardware floor is set by memory, not compute: all 744B parameters must reside in GPU memory even though only 40B fire per token, so the FP8 weights (~750 GB) require a single 8x H200 node (1,128 GB aggregate) as the vendor’s reference deployment. That node is the ownership unit priced below.

Kimi K3 (Moonshot AI, released July 16, 2026; weights published July 26) is a second priced configuration. At 2.8 trillion parameters with 16 of 896 experts active per token, it is the largest open-weight model ever shipped, and Moonshot published the full checkpoint on Hugging Face under permissive, commercially usable terms.

This paper prices two different pieces of hardware. K3 was trained with MXFP4 quantization-aware training rather than quantized after the fact, so the shipped checkpoint is the same precision Moonshot serves in production, not a lossy community reduction. But quantization-aware training reduces bits per parameter, not the parameter count: at roughly 4.5 bits per weight including scales, the published repository is 1.56 TB across 96 shards. The hardware floor here is memory, not compute, and 1.56 TB does not fit the 8x H200 node that GLM-5.2 runs on.

The ownership unit for K3 is therefore a single 8x B300 node. At 288 GB of HBM3e per GPU, 2,304 GB aggregate holds the checkpoint with roughly 740 GB left for KV cache at long context, keeps the whole model inside one NVLink domain, and executes MXFP4 in hardware rather than under emulation. Hopper can run K3 across two 8x H200 nodes at tensor-parallel 16, and vLLM’s default recipe does exactly that, but this paper does not price it: you are buying two chassis to hold a model that fits in one, paying the cross-node interconnect penalty on every token, and emulating the numeric format the model was trained in. Anyone standing up K3 deliberately in the second half of 2026 buys Blackwell Ultra.

On the independent leaderboards Opus 5 sits second overall at 82.81, ahead of Sol (81.39) and K3 (79.89). On Terminal-Bench 2.1 the three are within a point of each other: Opus 5 at 89.1%, Sol at 88.8%, K3 at 88.3%.

The strategic point is unchanged and bigger than either model: the quality gap between closed flagships and open weights has compressed to weeks, and at the current cadence the model you can own trails the model you must rent by less than one release cycle. Ownership no longer requires accepting last year’s intelligence.

What about renting the open models instead?

Both models are also available as APIs, at $1.40/$4.40 per million tokens for GLM-5.2 and $3/$15 for Kimi K3, far below flagship rates, and K3’s cached input bills at $0.30 against a reported 90% cache hit rate on coding workloads. Routing volume to them is excellent Phase 2 (Optimization) work, and it pushes the economic threshold outward. But renting an open model resolves neither the compliance threshold (the data still leaves, and for K3’s hosted API it leaves to a PRC-based provider, which is a harder review than a domestic one) nor the strategic one (the endpoint can still vanish), and at fleet volumes the per-token bill still grows linearly while owned infrastructure does not. The open-model APIs are a waypoint, not the destination.

The cost model

Why two years

Capital decisions are not made on a single fiscal year, and a one-year frame structurally misprices ownership: the entire hardware purchase lands in one budget cycle while the asset serves for three or more, and the residual value of the hardware, which is real and liquid, never appears at all. The model therefore compares two-year total cost of ownership against two-year cumulative API spend. Ownership is priced on a cash basis: hardware purchased outright at the start, two years of power, colocation, and platform engineering, minus what the hardware resells for at month 24. H100-class systems have held 75% to 85% of acquisition value through their first 24 months; the model assumes a more conservative 60% residual for H200 given Blackwell and Rubin ramp pressure, with 50% to 70% as the stated range. Consumption is held flat across both years; the model deliberately assumes no growth, so every figure here is what the economics look like if your usage today is your usage in month 24.

The workload

The unit of enterprise AI work isn’t a prompt; it’s a corpus. Contract review, claims processing, knowledge-base construction, and agentic workflows all share the same shape: read large volumes of input, produce comparatively small volumes of structured output. The model assumes a 10:1 input-to-output token ratio, reflecting document-processing and agentic pipelines. It runs at four sustained volumes: Pilot (50M tokens/month), Production (2B/month), Platform (20B/month), and Agent-scale (100B/month), which the opening table already translated into humans.

The rent side

The rent side prices the two frontier flagships an enterprise standardizing on maximum available quality would choose between as of July 2026. GPT-5.6 Sol, announced June 26 as a limited preview, is priced at $5 per million input tokens and $30 per million output, with a 1.05M-token context window; prompts above 272K input tokens bill at 2x input and 1.5x output, and the model assumes competent chunking that avoids the surcharge. Claude Opus 5, released July 24 and now Anthropic’s generally available flagship, is priced at $5/$25. At the 10:1 ratio they blend to $7.27 and $6.82 per million total tokens respectively, a 6% spread that quality evaluations on your workload should dominate. Enterprise-agreement premiums and committed-volume discounts run in opposite directions and are treated as a wash. Cheaper tiers exist on both sides (Terra, Sonnet); routing to them is Phase 2 work that roughly doubles the ownership threshold, and the sensitivity discussion covers it.

The own side

The primary ownership unit is the 8x H200 node that GLM-5.2’s reference deployment requires. Per Q2 2026 OEM pricing, an integrated HGX H200 system runs $320,000 to $420,000; the model uses $370,000 purchased outright, a 13kW system draw at $0.12/kWh, $25,000 per year in colocation, and resale at 60% of acquisition after 24 months. Net two-year node cost: about $225,000, or $188,000 to $262,000 across the resale range.

K3’s unit is a single 8x B300 node. Integrated 8-GPU B300 systems are anchored at $300,000 to $350,000 by public pricing trackers, though board-level GPU pricing near $53,000 each implies OEM configurations well above that; the model uses $400,000 to stay conservative and to absorb the direct-liquid-cooling facility work that B300 makes mandatory. It assumes an 18kW node draw at $0.12/kWh, $40,000 per year in colocation to reflect liquid-cooled rates, and the same 60% resale. Net two-year node cost: about $278,000, or $238,000 to $318,000 across the resale range.

Engineering is a two-person platform team at $450,000 per year fully loaded, $900,000 over the horizon, shared across the fleet; this line item creates the model’s most important structural property, covered below.

Throughput is the softest assumption in the paper, so both configurations state it explicitly.

For GLM-5.2 on 8x H200: a blended effective rate of 3,000 tokens per second per node at 70% sustained utilization, aggregate under continuous batching for a 40B-active MoE on a prefill-heavy workload. Single-stream decode is far lower; aggregate batched throughput is what determines cost. That gives each node roughly 66 billion tokens per year and a net node-only cost of about $1.70 per million tokens over two years.

For K3 on 8x B300: 5,000 tokens per second per node at the same 70% utilization. K3 activates roughly 50B parameters per token against GLM’s 40B and routes across 896 experts, which adds scheduling overhead, but B300 answers both with native MXFP4 execution and roughly 1.7x the memory bandwidth per GPU, on a model that fits in a single NVLink domain. That gives each node about 110 billion tokens per year and a net node-only cost of about $1.26 per million tokens.

The results

Two-year cumulative cost, rent versus own, with specific models:

Multiples in the API columns are against the GLM-5.2 configuration; against K3 on B300 they are 1.99x to 2.12x at 100 developers and 4.06x to 4.33x at 500. Multiples above 1.0x mean renting costs more than owning. A single B300 node carries K3 through the 40-developer row on throughput, and K3 cannot go below one node regardless of volume, which is what sets the 10-developer figure.

The table cuts against both camps. At ten developers, renting either flagship is roughly 3.4x cheaper than standing up either owned configuration. The picture inverts past the 1:1 line: at 100 agentic developers, ownership wins by 1.9x to 2.1x. At 500 developers it wins by 3.2x to 4.3x, between $11.8 and $14.1 million retained over two years.

The 1:1 line sits in the 40-developer row on the GLM-5.2 configuration, at 37 developers against Sol and 40 against Opus 5, and that remains the headline: it is the deployable-today, most-verified, most-conservative case. Hardware moves the line, though, and it moves it inward. A single 8x B300 node serves roughly 44 developers’ worth of K3 throughput for $1.18 million fully loaded over two years, which crosses 1:1 at about 32 developers against Sol and 34 against Opus 5. GLM-5.2 on the same hardware, which this paper does not price, would move it inward too. Every version of the calculation that uses current-generation silicon puts the threshold below 40, not above it.

The choice between the two owned configurations is now more a hardware question than a model question. GLM-5.2 runs on Hopper you may already own, needs no liquid cooling, and is near-frontier on coding. K3 needs Blackwell Ultra and the facility work that comes with it, and in exchange gives you the strongest open-weight model in existence, within a point of both closed flagships on agentic coding, on fewer nodes than GLM requires at every volume above the threshold. If you are buying hardware for this workload in the second half of 2026, that is the decision. At fleet scale the rational architecture runs both: GLM for volume, K3 for the hard tasks, and a rented flagship for the exceptions.

The practical reading of the threshold: below 10 developers, rent without a second thought. Between 10 and 40, optimize aggressively and model your own break-even with your own telemetry, because you are approaching the line and current-generation hardware may already have moved it behind you. Past 100, ownership is winning by roughly 2x fully loaded.

The framework: Rent → Optimize → Own

This is not simply buy versus build. That binary is too crude to be useful. Every AI capability moves through three phases, and many capabilities will never reach the third. The mistake isn’t renting. The mistake is owning too early, or renting for too long.

Phase 1: Rent. Nearly every capability should begin here: low utilization, rapid experimentation, unstable workflows, fast-moving model generations. The goal is not cost efficiency. The goal is learning what token consumption actually looks like once real users touch the system. At pilot volumes the model below shows renting winning by two orders of magnitude; any infrastructure spend at this stage is a capital allocation error.

Phase 2: Optimize. Usage rises, workflows stabilize, consumption becomes forecastable. Now the optimization toolkit matters: routing requests between model tiers by complexity, prompt caching, batch processing, distillation, retrieval optimization. Both flagships reward this work directly: cached input reads bill at roughly a tenth of the standard rate on both providers (Opus 5 cache reads run $0.50 against $5 standard input), and batch processing takes a flat 50% off asynchronous jobs. A cached and batched workload can run at roughly a quarter of list price. Most organizations should spend a surprisingly long time in this phase, and every dollar of optimization pushes the ownership threshold further out.

Phase 3: Own. Ownership begins when AI stops being software and becomes infrastructure, when the question shifts from which model should we call to which capabilities should we permanently operate ourselves. It should happen only when at least one of three thresholds has been crossed.

The three thresholds

Ownership is rarely triggered by a single variable. Three distinct thresholds exist, crossed for different reasons, at different times, by different kinds of organizations. Only the first is about money.

Threshold 1: Economic

At some sustained volume, renting becomes more expensive than operating. This is the threshold quantified above and derived below, because it is the only one of the three that can be calculated rather than argued: over a two-year horizon it sits at roughly 40 agentic developers fully loaded.

Threshold 2: Compliance and data privacy

For a large class of organizations, the ownership decision is made long before the economics resolve it, because the data cannot leave. Healthcare organizations operating under HIPAA, financial institutions under data-residency and record-keeping mandates, firms bound by attorney-client privilege, and any enterprise processing regulated personal data all face the same structural problem: an API call is a data transfer. Every prompt that crosses the vendor boundary triggers the machinery of data-egress review, privacy assessment, vendor risk management, and business associate or data processing agreements, and some categories of data cannot cross at all.

The API route prices some of this in: providers now charge measurable premiums for regional data residency, and Anthropic’s US-only inference option for Opus 5 bills at 1.1x input and output — a 10% uplift, stated on the price sheet. But a surcharge doesn’t dissolve the underlying exposure. Prompts, retrieved documents, and agent trajectories are the most sensitive data an enterprise produces, a live feed of what the organization knows, decides, and worries about, and workflow leakage through AI tooling is the silent risk most governance programs haven’t caught up to. A model running inside your own boundary, air-gapped if necessary, retires the entire category: nothing leaves, so nothing needs review. For regulated enterprises, this threshold typically triggers first, and the economics arrive later as confirmation rather than cause.

The K3 weight release sharpens this into a specific, common case. Organizations that want K3’s capability but cannot route prompts to a Chinese-operated endpoint — a live constraint in finance, healthcare, defense, and legal — previously had no option. As of July 26 they have one, and it runs entirely inside their own jurisdiction on hardware they control.

Threshold 3: Strategic

The third threshold is control: guaranteed availability, decision auditability, the ability to modify the system without vendor permission, and continuity if a vendor changes pricing, policy, or existence. The past month alone made this concrete. GPT-5.6 launched as a limited preview restricted to government-vetted partners, and Anthropic’s newest flagship spent most of June offline under a US export-control order before being restored on July 1. Frontier capability is now subject to policy decisions that no enterprise controls, on timelines no procurement cycle can absorb. Weights you hold cannot be paused, repriced, deprecated, or export-controlled out from under a production workflow.

That protection is real but it is not unconditional, and the K3 release illustrates the edge. Weights already downloaded under a permissive license cannot be recalled. But US policy toward Chinese open-weight models is unsettled — Commerce has reportedly considered Entity List additions and hosting restrictions, and the White House OSTP publicly accused Moonshot of training K3 on export-controlled silicon and distilling US models. An enterprise that has the weights on its own disks is insulated from all of that in a way that an enterprise calling a hosted endpoint is not. For organizations where a single vendor or policy change is an existential dependency, ownership is insurance, and insurance is allowed to cost money.

The rest of this paper models Threshold 1, because it’s the one enterprises can put in a spreadsheet. But note the order of operations: if you’ve crossed Threshold 2 or 3, the economics are context, not the decision.

Why the gap widens: linear versus sublinear

The structural argument matters more than any current calculations, because list prices will change and the multiples will move.

Per-token pricing makes cumulative cost a strictly linear function of volume and of time. That is what per-token pricing means: year two costs exactly what year one did, forever. Ownership is front-loaded and then flattens: the capex lands once, resale value comes back at the end, and in this model per-node two-year cost including the engineering share falls from $1.13 million at one node to $450,000 at four to $270,000 at twenty, because the platform team amortizes across the fleet while volume scales 50x. Two curves with those shapes always diverge. The only question is where they cross, and everything after the crossing compounds in ownership’s favor. Extend the horizon to three years and the multiples grow again; the two-year frame is the conservative one.

There’s a second-order effect that matters more than the bill. When the marginal token costs money, teams ration. They cap agent iterations, sample instead of processing the full corpus, summarize instead of reading everything. Every rationing decision degrades output quality. When the marginal token is free, the rational behavior flips: process everything, rerun whenever the pipeline improves, let agents iterate until the task is done rather than until the budget is. Fixed-cost infrastructure doesn’t just lower the bill. It changes what the organization is willing to attempt.

And there’s a budgeting argument CFOs appreciate more than engineers do. A per-server cost is a number you can put in next year’s budget, twice. A per-token cost is a forecast, and token forecasts have a habit of being wrong by multiples once a project succeeds and every adjacent team wants in. Predictability has independent value, and over a two-year horizon it has a lot of it.

Ownership isn’t about training models

The most expensive misconception in enterprise AI is that ownership means training foundation models. It almost never does. Very few organizations should pretrain frontier models; the capital requirements and the refresh cycle make it irrational for all but a handful of labs, and the open-weight releases of the past months make it unnecessary. GLM-5.2 and Kimi K3 exist precisely so that owning frontier-class capability no longer requires creating it.

What enterprises should own is everything around the model: proprietary datasets, evaluation infrastructure, workflow orchestration, retrieval pipelines, agent architectures, domain-specific fine-tunes, internal feedback loops, and deployment infrastructure. The base model may be swapped every six months, and the past forty days proved the point: Sol, GLM-5.2, K3, K3’s weights, and Opus 5 all arrived inside a single procurement cycle. The surrounding assets compound for years, and unlike raw model intelligence, they are difficult for competitors to replicate because they encode knowledge only your organization has. An owned deployment makes this compounding cheaper to exploit: fine-tuning on proprietary code and rerunning improved pipelines over the full corpus are exactly the behaviors that per-token pricing rations and fixed-cost infrastructure invites.

What should almost always stay rented: frontier model research, foundation model pretraining, commodity customer support, coding assistance, and any low-volume experimentation. These improve too quickly, and are priced too competitively, to justify rebuilding internally.

What compounds enough to own: proprietary enterprise data, workflow automation on stable processes, domain-specific fine-tunes, evaluation infrastructure, customer interaction history, organizational memory, and decision policies. These become more valuable every day they operate.

A practical decision framework

Before moving any capability from Phase 2 to Phase 3, ask five questions:

1. Is utilization predictable? Ownership economics collapse below sustained utilization. If the workload is spiky or experimental, stay in Phase 2.

2. Can the data leave? If prompts, documents, or agent trajectories carry regulated or privileged content, the compliance threshold may already have decided for you.

3. Does control create strategic value? The past month’s availability disruptions at both frontier labs are the argument in miniature: weights you hold cannot be paused or export-controlled.

4. How many agentic developers do you have? Forty is the two-year 1:1 line; seven per node once a fleet exists; five hundred is decisive. Count honestly, and count where you’ll be in twelve months, not where you are.

5. Would switching vendors materially disrupt the business? Deep vendor dependence on a critical workflow is a risk that ownership retires.

Zero or one yes: rent, and revisit quarterly. Two or three: optimize aggressively and start modeling the break-even with your own numbers. Four or five: you are likely past the threshold already, and every month of delay is a transfer of margin to your vendors.

What this model does not claim

The model is about cost, and cost is the second question. Quality is the first: an owned deployment that can’t clear the accuracy bar for its workload has no value at any price. The open-weight releases narrow this concern substantially for coding and agentic work, where K3 sits within a point of both closed flagships on Terminal-Bench and GLM-5.2 lands near the frontier, but benchmark parity is not workload parity, and the bar must be established by evaluation on your tasks, not assumed. Opus 5’s launch is a reminder that the ordering is unstable: K3 led Anthropic’s GA flagship for eight days and then didn’t. For the highest-difficulty reasoning tasks the closed flagships currently remain the right answer regardless of volume, and the rational fleet architecture routes exceptions to them.

The model holds consumption flat across the two-year horizon. That is a deliberately conservative choice, not a forecast: per-developer consumption has been rising as agentic tools mature, and if that continues, the effective threshold arrives at lower headcounts than the static figures state. The model excludes engineering time from the per-node break-even on the grounds that both routes need pipeline work, and shows the fully-loaded figures alongside so you can disagree. It excludes the compliance costs that the API route triggers and local deployment largely avoids; counting those would move the threshold toward ownership. The model assumes a 10:1 input-output ratio; chat-heavy workloads shift the blend toward expensive output tokens, while cache-friendly workloads favor renting. The human-scale conversions are mid-range figures with stated ranges; your per-exchange and per-developer consumption will differ.

K3’s self-hosting economics are no longer directional on availability, since the weights shipped, but they remain directional on throughput. The 1.56 TB checkpoint size is a published fact and the memory floor follows arithmetically from it, which is why K3 is priced on B300 rather than on the H200 node GLM-5.2 uses. The throughput figure does not follow from anything published. Five thousand tokens per second per node is an estimate for a 50B-active, 896-expert MoE running native MXFP4 on Blackwell Ultra; engine support for KDA and Stable LatentMoE was landing in vLLM and SGLang the same week as the weights, and there is not yet a body of independent production benchmarks to check it against. Treat the K3 column as a first estimate with wider error bars than the GLM column. The model also charges no cost of capital on the upfront purchase; at a 10% hurdle rate, add roughly $40,000 per node per year on either platform, which moves the fully loaded 1:1 line by a handful of developers.

And it freezes prices at a point in time. API prices have been falling 30% to 50% per year; GPU prices fall too. Sol is in limited preview and its general-availability terms could shift. Anyone using this model a year from now should rerun it with current numbers. The assumptions are stated precisely so that you can.

One thing price cuts do not change: the geometry. A 50% API price cut at agent-scale turns $17.2 million into $8.6 million against $5.4 million owned over two years, and the linear-versus-sublinear divergence resumes immediately. Only a structural change in API pricing, genuinely unmetered flat-rate enterprise tiers at these volumes, would break the argument. Nobody offers that today, and frontier model shops are actively moving away in the opposite direction.

What it means for planning an AI budget

The practical guidance falls out of the threshold. If you are running one pilot workload or a ten-developer agentic team, the highest-ROI work is Phase 2 optimization, not procurement. If you have 30 to 40 developers on agentic tooling, you are at the 1:1 line right now, and the decision should be made deliberately rather than discovered in an invoice. This paper also assumes agentic engineering as the predominant task - the equation will shift if you are focusing on other workflows. If you are regulated, the compliance threshold likely fires before the economic one, and the arrival of permissively licensed frontier-class weights — now including the largest open model ever released — means crossing it no longer costs a quality haircut. And if you have over 100 developers with agents, the math resolved some time ago: over the next two years, renting will cost you multiple times what the capability costs to own.

Most organizations will continue renting foundation models, and they should. Very few should ever train one, and after this month, none need to. But the winners of the next decade won’t simply consume intelligence at metered rates. They will own the systems, the context, the evaluation infrastructure, and at sufficient scale the weights and the compute, that make intelligence uniquely valuable to their business.

The model becomes infrastructure. Ownership becomes strategy. And the point at which renting should give way to ownership is no longer an abstraction: it is a threshold you can calculate in developers, users, or tokens, over the same horizon used for capital planning.

FAQ

Why is this only coming to light now?

Prior waves of AI adoption centered around chatbot deployments. Simple chats required far fewer tokens (500-3,000) while agentic engineering tasks require far more (30,000-1,000,000). Agentic solutions first reached commercial viability in early 2026. Finally, open-weights models similarly reached frontier-level intelligence in mid-2026.

Which open-weight model does the model assume?

GLM-5.2 is the primary priced configuration: 744B-parameter MoE (~40B active), MIT license, 1M context, near-frontier coding quality, reference deployment of a single 8x H200 node holding ~750 GB of FP8 weights, about $1.70 per million tokens node-only.

Kimi K3 is priced as a second configuration since its weights shipped July 26: 2.8T parameters, 16 of 896 experts active, and a 1.56 TB MXFP4 checkpoint. That is a hard memory floor, and it does not fit one 8x H200 node. The paper prices K3 on a single 8x B300 node (2,304 GB), where the checkpoint fits with roughly 740 GB of KV cache headroom and MXFP4 executes natively, at roughly $1.26 per million tokens node-only. That figure has the widest error bars in the model.

Doesn’t the quality gap between open and closed models break the comparison?

Less every month, but the gap is real and it moves in both directions. K3 led Claude Opus 4.8 at launch; Opus 5 shipped eight days later and now leads K3 (82.81 vs 79.89 on the composite leaderboard), as does Sol. On Terminal-Bench 2.1 all three sit inside a point: Opus 5 at 89.1%, Sol at 88.8%, K3 at 88.3%. GLM-5.2 lands near the frontier on coding. For the hardest reasoning tasks the closed flagships keep an edge, and the rational architecture routes those exceptions to a rented API while owned capacity serves the volume. Establish the bar by evaluation on your workload, not by benchmark tables, including this paper’s.

Why a two-year horizon instead of one?

Because a one-year frame structurally misprices ownership: the full hardware purchase lands in a single budget cycle, and the hardware’s resale value never appears. Over two years the capex amortizes against a cumulative rent bill and the residual comes back. Three years would widen it further; two is a conservative choice.

What would change the conclusion?

A structural change in API pricing, such as truly unmetered flat-rate enterprise tiers at these volumes. Price cuts alone don’t: they move the crossover outward but leave the linear-versus-sublinear geometry, and therefore the eventual inversion, intact. On the other side, a decline in per-developer token consumption would move the threshold out; the model already takes the conservative position by assuming consumption merely holds flat.

Sources

Pricing sources: GPT-5.6 Sol rates from OpenAI’s June 26, 2026 announcement and API documentation; Claude Opus 5 rates, release date (July 24, 2026), and US-only inference uplift from Anthropic’s pricing documentation and system card; GLM-5.2 specifications and reference deployment (Z.ai/Hugging Face, June 2026); Kimi K3 specifications, weight release (moonshotai/Kimi-K3, July 26, 2026), checkpoint size, and deployment guidance from Moonshot’s model card and independent deployment write-ups; leaderboard positions from BenchLM and Artificial Analysis as of July 27, 2026; Kimi K3 checkpoint size from the moonshotai/Kimi-K3 repository file manifest (1,560,936,091,448 bytes across 96 safetensor shards, July 2026); deployment topologies from SGLang’s Kimi-K3 cookbook and vLLM’s July 27, 2026 day-0 support post; B300 system pricing, 288 GB HBM3e per-GPU capacity, and liquid-cooling requirement from public 2026 pricing trackers and OEM quotes; H200 system pricing and H100-class residual-value data verified against public 2026 pricing trackers and OEM quotes (BenchLM, OpenRouter, Mercatus GPU Index, vLLM deployment guides), July 2026. All ownership figures are US-market estimates; recompute with your own power, colocation, throughput, resale, and per-developer consumption assumptions before making capital decisions.

About Ivan Lee

Ivan Lee is the founder and CEO of Datasaur, which deploys private AI for enterprise teams in financial services, healthcare, and government without sending sensitive data to third-party training pipelines. He built AI products at Yahoo and Apple, and co-founded Loki Studios, acquired by Yahoo in 2013. Datasaur’s customers include Google, Netflix, and Zoom.

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

Introduction

The first article, Reading the River: Why Agentic AI Is a Navigation Problem, Not a One-Time Decision, laid out the framework: the river of agentic capability, and the three Tensions inside the boat.

This article takes on the first Tension. Blaine is running a half-day workshop on this material with AI Realized on September 15 in San Francisco. Details at the end of this article.

The frame so far

The river of agentic AI capability never stops moving, almost never reverses, and its pace varies - sometimes gentle, sometimes surging. Every enterprise is choosing, deliberately or by default, between using that capability to make its existing operating logic run faster (we call that retrofit) and using it to redesign the operating logic itself (we call that reimagine). Because the river keeps moving, the right position between those poles is not selected once; it is navigated continuously. The navigation happens inside your organizational ‘boat’ - whatever scope of the organization you actually control - at three operational levels the book calls Tensions: workflow and workforce, context, and the cluster of supervision, autonomy, and governance. Their settings get made together. This article is about the first, and most concrete, of the three.

One decision wearing two outfits

There is one operational decision in agentic AI that matters more than any other. Most senior executives believe they are making it. Most aren’t. They are making something that looks like it from a distance: deciding which agents to deploy and where, evaluating vendors, approving pilots. They are missing the underlying choice the deployment is forcing on them.

The choice is whether workflow and workforce are one decision or two.

Most enterprises are treating them as two. The IT side scopes the agent. HR or a functional manager sizes the team. The COO redesigns the process. Each function makes its own move on its own schedule. By the time someone looks at the resulting whole, the workflow has been sped up in places, the workforce has been resized in others, and the relationship between the two looks accidental.

The enterprises pulling ahead are treating them as one. They redesign the workflow and the roles inside it at the same time. They change what the work is and who or what does it together. The two questions are really a single question wearing two outfits, and the answer is what your boat’s design actually is.

Microsoft’s 2026 Work Trend Index surveyed more than nineteen thousand workers to find out which factors actually drive AI impact at the enterprise level. [1] The result: organizational factors (culture, manager support, talent practices) matter about twice as much as individual factors like mindset and behavior. The constraint sits in the system. Which means that fitting better agents into an unchanged workflow will not produce the results executives keep expecting.

The entanglement runs in both directions. Going from workflow to workforce: say an agent now does the routine 90 percent of a process. The human role that survives concentrates on the harder 10 percent - the exceptions, the judgment calls, the cases the agent can’t handle. That is a different job from the one that owned the whole process before, and the workforce decisions have to follow.

Going from workforce to workflow: an agent placed inside a process designed around a human will perform like a faster, cheaper, potentially slightly less reliable human. The same agent, placed inside a process designed around what an agent can actually do, can compress steps, change sequence, and eliminate handoffs that existed only because a human had to wait for another human. If your enterprise has been getting underwhelming results from agents, look at the workflow they were dropped into before you blame the agent.

This discipline is older than the technology now forcing it. In 1990, Michael Hammer wrote one of the most-cited articles in business history under the title “Reengineering Work: Don’t Automate, Obliterate.” [2] His argument was that putting computers on top of existing processes was a category error: the processes had been designed around the limits of the previous technology, and automation that preserved those limits captured a fraction of what was available.

Agents raise the stakes on Hammer’s argument. They can carry context, coordinate work across systems, escalate when they hit edges, and operate continuously at machine speed. The category error gets larger. The firms acting on Hammer’s argument today are the ones pulling ahead.

The failure mode of changing workforce without workflow is already in the public record. Klarna replaced a customer-service workforce with an AI system without the workflow redesign that would have made the smaller workforce viable, and the company ran into trouble it has since acknowledged publicly. [3] Klarna did not fail because it chose the reimagine end of the spectrum. It failed because it ran half a reimagine. The workforce changed. The workflow largely did not. The case that makes reimagining feel dangerous is, on inspection, a case about doing it halfway.

Two shapes of reimagine

When enterprises actually reimagine the work, the redesign takes one of two distinct shapes. They produce different compression patterns and demand different leadership moves, and smashing them together into one “reimagine looks like X” framing is how executives end up running the wrong play for their context.

Decision-structure redesign collapses the org chart itself. The cleanest public case is Block, the Jack Dorsey company. [4] In Dorsey’s telling, there are currently roughly five layers of management between him and any other employee at Block; his target inside the next year is two or three, and his stated ideal is none. The operational mechanism is what he calls the “intelligence layer”: the majority of work at Block, he claims, now moves through agentic systems rather than between humans up and down a hierarchy. The agents do the coordination, context-carrying, and routine judgment work that middle management used to do.

The technology is doing less of the work than the framing implies - Block has acknowledged that about 95 percent of code generated by its AI systems still requires human modification. The reorganization is real and the framing is bold, and the technology is not yet carrying the load the headline implies. Both can be true at the same time. And Block is no longer alone. In May 2026, Coinbase announced a 14 percent workforce reduction along with the explicit elimination of what CEO Brian Armstrong called “pure managers” and a cap of five management layers below the C-suite. [5] Two named cases running the same pattern in the same quarter is a pattern, not an idiosyncrasy of one founder.

Operational-process redesign leaves the org chart mostly intact and rewires the work inside it. The best-documented public case is JPMorgan’s know-your-customer system. [6] The headline number is that the agentic system that went into production in April 2026 compressed a workflow that used to take five days into one that takes under a minute. What the headline leaves out is the workforce side of the same operation: the two hundred people who used to do the controls review were not eliminated. They were redirected to a different controls function inside the bank, doing work the agentic system cannot do on its own. Mary Erdoes, who runs the bank’s Asset and Wealth Management division, described the scale-up at the bank’s February 2026 Company Update: three thousand people now doing the redesigned work, with another three to five thousand identified for the same treatment. Jamie Dimon was direct about what this means:

“We have displaced people from AI. And we offered them other jobs.” [6]

The two compression patterns matter for diagnosis. In decision-structure redesign, what gets squeezed is middle management - the layer whose job was carrying context across functions and coordinating handoffs is exactly the layer agentic systems are now best at replicating. In operational-process redesign, what compresses is mid-tier execution - the middle of the work itself, where routine and judgment used to mix and where the routine portion can now be peeled off and given to software. Same coupling principle, different surfaces. The broader research points the same direction: the Federal Reserve Bank of Atlanta’s March 2026 survey of corporate executives found AI reallocating tasks across firms rather than eliminating aggregate employment, with routine activities exposed to substitution and analytical, technical, and managerial tasks more often complemented. [7]

The retrofit story

Retrofit is the simpler play and the one most enterprises are still running. It leaves the boat the same shape and adds horsepower to the engine. The value is real, and it comes in two forms worth measuring separately. Cost-out: headcount growth slows, exception handling moves to a smaller team, compute does what people used to do. Speed-up: the same workflow, run with agents inside it, often runs faster. Walmart’s shift-planning workflow that compressed from about ninety minutes to about thirty per cycle is a clean example. [8] Speed-up is, in many cases, what retrofit delivers more reliably than cost-out, and it is easy to underweight.

What retrofit does not do is change the decision structure. Same decisions, same people, same sequence, faster. That is the structural limit of the play, and it is why retrofit advantages tend to compete away. The same agents are available to your competitors. The retrofit you ran this year, your competitor can run next year, and the gap closes. This doesn’t mean you shouldn’t run retrofits. It means they don’t create sustainable advantage. Reimagine is harder to copy because copying it requires rewiring an organization rather than adopting a tool.

Direct about what’s mixed

Two things to be direct about before we leave this.

First, the workforce-reduction news of the past year does not survive being flattened into a single “AI is replacing workers” headline. Mo Koyfman, a venture capitalist at Shine Capital, made the observation publicly: [9]

“Most companies, if not all, could cut thirty to fifty percent of their workforce at any time and see no material difference in performance. AI has given air cover, more importantly, to execute on the right-sizing that you probably needed to do a long time ago.”

Some announced reductions are coupled redesign done deliberately. Some are right-sizing dressed in AI vocabulary because that framing plays better with investors.

Second, “fully agentic” is overselling what the cases actually show. Across the most aggressively framed function-level redesigns, what is happening operationally is not zero humans. It is a much smaller human team concentrated at orchestration, escalation, and oversight edges, with agents doing the routine volume. In February 2026, Gartner predicted that half of companies that attributed customer-service workforce reductions to AI would be rehiring by 2027. [10] The compression is real. The version involving complete elimination of human work in a function is mostly aspirational.

Key takeaways

• Workflow and workforce are one integrated decision, not two. Treating them as two is the structural mistake many enterprises are still making.

• Reimagine takes two shapes. Decision-structure redesign collapses the org chart (Block, Coinbase); operational-process redesign rewires the work inside the boxes (JPMorgan).

• Retrofit captures real value through both cost-out and speed-up. The advantage tends to compete away because copying is easy.

• Some workforce reductions are deliberate coupled redesigns; some are right-sizing using AI as cover. What matters is what is actually happening inside the function.

Next in this series: as the boat is redesigned and the crew reconfigured, the question becomes what each part of the crew - human or agentic - can see. That decision is less about information than it first appears, and more about you. That is Tension 2.

Resources

• Reading the River: Why Agentic AI Is a Navigation Problem, Not a One-Time Decision, AI Realized Now newsletter, August 4, 2026

• The River Doesn’t Wait, book

• The River Doesn’t Wait, website

• Subscribe to Blaine’s Substack, newsletter

Sources

[1] 2026 Work Trend Index Annual Report: Agents, human agency, and the opportunity for every organization, Microsoft, May 2026
[2] Reengineering Work: Don’t Automate, Obliterate, Michael Hammer, Harvard Business Review, July 1990
[3] Klarna CEO says AI helped the company shrink its workforce by 40%, CNBC, May 2025
[4] From Hierarchy to Intelligence, Jack Dorsey and Roelof Botha, Sequoia Capital, March 2026; Jack Dorsey: Every Company Can Now Be a Mini AGI, Sequoia Capital, April 2026
[5] Coinbase didn’t just lay off 14% of its staff due to AI. It replaced managers with “player-coaches”, Fortune, May 2026
[6] JPMorgan Chase Company Update, JPMorgan Chase, February 2026; How banks are utilizing new AI forms in their KYC process, Waters Technology, April 2026
[7] Artificial Intelligence, Productivity, and the Workforce: Evidence from Corporate Executives, NBER Working Paper 34984, March 2026
[8] Walmart Unveils New AI-Powered Tools To Empower 1.5 Million Associates, Walmart, June 2025
[9] Has the Era of the Mega-Layoff Arrived?, The Wall Street Journal, Chip Cutter, April 15, 2026
[10] Gartner Predicts Half of Companies That Cut Customer Service Staff Due to AI Will Rehire by 2027, Gartner, February 2026

Workshop

Retrofit or Reimagine: An Agentic AI Strategy Workshop for Executives
Tuesday, September 15, 2026, 8:30 AM to 12:30 PM, K&L Gates, Four Embarcadero Center, San Francisco.

Blaine runs this material as a working session. Each executive brings one outcome they are personally measured on, takes a position on how far to go this year, and defends it to someone from another industry. $495 covers two seats, because the exercises are built for pairs. Every registration is reviewed and one company is seated per competitive set.

Full details

Register

About Blaine

Blaine Mathieu is a multi-time C-suite executive and former Gartner analyst. He is the author of “The River Doesn’t Wait: A Senior Executive Guide to Navigating the Surge of Agentic AI and Pulling Away From Your Competitors” (June 2026), and regularly speaks on AI and agentic AI and facilitates executive workshops based on the book’s framework. He publishes a monthly briefing for senior executives on the river’s movement at riverdoesntwait.com.

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of Enterprise AI.

Join

If you’re leading an AI deployment right now, you’re making decisions with incomplete information about what’s working inside other enterprises. Sharon Goldman’s job is collecting that information. She covered AI daily for Fortune and VentureBeat, and a month ago she launched her own publication: Ground Level AI, focused on “where AI meets the real world.”

“It’s not just about the models and the benchmarks,” she told me on the AI Realized podcast. “It’s about what really happens when we have to grapple with these tools as they meet the rest of our systems, both physical and digital.” That’s the AI Realized thesis in a sentence.

The model is the easy part. Here’s what she’s hearing from the enterprises doing the work.

The bottlenecks are operational

Six months into the agentic coding boom, the obstacles Goldman hears about most are the ones that never make the vendor keynote.

“There are so many things that an enterprise company has to deal with before their employees can go full on,” she said. “Your CISO is going to have to approve and decide what kind of permissions users will be allowed to have when using these tools within the company.”

Then there’s the bill. Enterprise programs charge by usage, not subscription. Surprise invoices have become a running theme in her reporting. “There’s been a lot of talk about enterprise companies getting these incredibly large enterprise token bills, surprise bills,” she said. “They have developers in their companies going to lunch and setting Claude Code to do a task. Then they come back, and it turns out Claude spent $1,000 just during lunch.”

If your finance team hasn’t modeled usage-based AI spend yet, that anecdote is your business case for doing it this quarter. Add data readiness and workflow design on top. “It’s becoming more than just an individual user saying, ‘I’d like ChatGPT at work.’ It’s becoming an entire enterprise endeavor that has a lot of bottlenecks and obstacles that have to be worked out.”

The window for slow pilots has closed

Goldman covered enterprise tech for well over a decade before AI became her daily beat in 2022. For years, she watched cloud adoption crawl along. What stuns her now is the speed of AI adoption, and what it demands of companies that treated 2024 as experiment season.

“It started out as FOMO,” she said. “But now companies are realizing: ‘Wow, if I really want to get ROI here, this needs a tremendous investment. And this needs to happen fast. This can’t just be something we spend the next five years on and then doesn’t pay off.’”

Where you sit on the readiness train depends heavily on your vertical. Financial services got onboard early and converted years of regulated-industry pilots into production. Retail and parts of healthcare are still untangling their data, and data is the multiplier on everything else.

The need for change management is clear

When executives ask what actually moves the needle, the answers Goldman hears from experts are unglamorous by design. “A lot of what I hear from people is the unsexy stuff,” she said.

In 2024 and 2025, “CEOs and boards, everyone had so much FOMO, they just were like, ‘Let’s do this. Let’s make it a policy that our employees have to use AI.’ But it’s never as simple as that. Your own systems have to be ready to support the AI tools.”

The reassuring part for anyone who has led a technology transition: “A lot of it gets back to traditional basics of dealing with people, with the technology, with the organization. None of that is new. It’s what you should already have been doing, but maybe speeding it up a little bit.”

The caveat: Agentic tools will alter organizations structures, jobs and workflows more than cloud or mobile ever did. Plan for change management accordingly.

The shocking speed of the Hugging Face incident

Goldman heads to Black Hat next week, where she expects AI to dominate after the OpenAI Hugging Face incident.

If you need to speak knowledgeably about that at the event or in the boardroom, her explanation is the clearest I’ve heard: OpenAI was testing an unreleased model in a sandbox with relaxed guardrails. “The agent was so determined to reach its goal, like a good student, that it actually broke out of its sandbox and went to Hugging Face’s systems, took some data and brought it back to say, ‘This is what I have, and now I can pass my test,’” she said. “It completely autonomously made this decision and fought its way out of the sandbox.”

Nobody directed it. OpenAI didn’t know for about a week. And Hugging Face couldn’t use OpenAI or Anthropic models the analyze the attack. “They had to use an open-sourced Chinese model that was available, and that’s the way they were able to analyze and fix the problem.”

The reaction from her sources? “When I’ve spoken to cybersecurity experts about this, their jaws kind of dropped. They didn’t expect this so soon.”

The security team takeaway she expects to hear on repeat at Black Hat: “Defenders need to be able to speed up their defense and scale up their defense against potential attackers.”

Yet optimism, not panic, abounds in the security crowd

For all the alarm, Goldman finds her sources surprisingly steady. This is useful when your board asks how worried they should be. “I’m always amazed when I speak to cybersecurity experts how chilled out they are,” she said. “They’re mostly optimistic that we can fix these things.”

Part of the reason is offense has its own learning curve. “In the same way that the defenders need time to catch up, so do the attackers,” she said. “It’s not so simple for the attackers, even if the capability is there. There’s still a lot of barriers to get into different systems.”

That’s also her read on the recent letter from frontier AI researchers calling for pacing AI development. “The idea is to give defenders some time to let their capabilities catch up to the attackers. We really want to get a balance of power back.”

Fix your news diet before it fixes your strategy

Here’s a pattern I keep running into: I ask executives where they get their AI news, and they say X or LinkedIn. Then I ask whether those sources are double-sourced, whether the people they follow cite real studies or just post opinions with confidence. The honest ones admit they aren’t being as careful as they should be with information that shapes million-dollar decisions.

Goldman doesn’t dismiss social media. She uses it. But she pairs it with discipline.

“There’s so many people with very serious agendas,” she said. “Even as someone who has covered this beat for over four years every single day, sometimes I find myself Googling and checking back after thinking, ‘I know this guy has an agenda. What is it?’”

Her own diet balances X and LinkedIn against The Economist, The New York Times, The Wall Street Journal and the Financial Times. Among non-journalists, she follows people with real bona fides in specialty areas. That includes open-source AI researcher Nathan Lambert and former Meta researcher Joshua Saxe, whom she recently interviewed on AI and cybersecurity.

If your AI strategy is informed by whoever shouted loudest on your feed today, borrow her method: Know who you’re reading, their agenda and anchor on sources that check their facts.

Address the anxiety in your workforce

Asked what we should have covered more, Goldman pointed to something every executive managing an AI rollout is living with, whether they’ve named it or not. “These are tools that can potentially boost productivity and efficiency, but they’re also doing all sorts of things that people consider quite concerning in society, whether that’s military use cases, building data centers, ruining our creativity, frying our children’s brains. People have a lot of different fears around the rise of AI, and that can really push against the more optimistic views.”

Your employees don’t leave those fears at the door, and companies blaming AI for layoffs have made the unease worse. She believes that tension between AI’s promise inside the enterprise and its reputation outside it is one of the defining stories of the next few years. Leaders who acknowledge that will have an easier transition than leaders who pretend it isn’t there.

She also flagged the AI whiplash employees are feeling. “What’s so ironic is that after telling employees to use AI so dramatically over the past year, now they’re saying to slow down. It’s too expensive.” It’s worth checking whether your organization is sending this mixed message.

Her prescription is patience. “You have to give employees a little time and help them grow into the idea of using these tools. You have to hold your employees’ hands a bit along the way.”

Help shape the coverage with your story

One more thing worth knowing: Goldman is actively looking to speak with people on the ground in the enterprise. CISOs, CIOs, engineering leaders, anyone navigating adoption.

If the coverage of enterprise AI feels disconnected from your reality, this is how it gets better.

“I’m just an open book,” she said. “It can totally be off the record to start out with. I’m just really interested in learning about how AI adoption is playing out in the enterprise.”

Reach Sharon at sharon@groundlevel-ai.com. Subscribe to her reporting at groundlevel-ai.com.

Curtis Sparrer is the Principal and Co-Founder of Bospar PR + Marketing Agency, and Author of Game Face: Becoming a PR Detective. As the principal and co-founder of Bospar, Curtis' work spans the tech industry from B2B to B2C clients alike, and every permutation in between.

In Case You Missed It:

Here’s the link to AI Realized Now Issue #21

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

In this Issue

In AI Realized Now Issue #21, we look at three levels of the same discipline: reading the pace of agentic capability so a strategy moves when the ground under it moves, fusing AI with threat intelligence so cyber defense works from what adversaries can actually do against what an organization actually exposes, and building an agentic system in which the agent executes and the human owns the boundary. The through-line is control that holds up under speed. The leaders pulling ahead in 2026 are not the ones who picked the right position a year ago. They are the ones who built a mechanism for noticing when the position changed, and the governance to move without breaking anything on the way.

ARTICLE

Reading the River: Why Agentic AI Is a Navigation Problem, Not a One-Time Decision

On OSWorld, a benchmark built to measure agentic computer use on tasks an office worker would recognize, scores roughly doubled in the eleven months to April 2026. Two frontier labs shipped million-token agentic platforms within a fortnight of each other. Blaine Mathieu calls that a surge, and it is why he argues the retrofit-to-reimagine question is misframed. The right position on that spectrum is not selected once and then defended. It is navigated continuously, because the capability underneath it keeps moving.

This first piece in a four-part series adapted from his book lays out the framework: how to read the current, why held-back and export-controlled models are dated notices of surges still queued for release, and the three Tensions that sit inside whatever span of control you actually hold.

Read the article

ARTICLE

Beyond Acceleration and Automation: How AI + Intelligence Changes Cyber Defense

Most AI security conversations stop at speed. Recorded Future’s Staffan Truvé argues the more consequential shift arrives when AI is fused with threat intelligence, because that combination lets a defender line up what adversaries are demonstrably capable of against what their own organization actually exposes. As he puts it, the real question in modern cyber defense is not who has more technology, it is who uses their resources more efficiently.

The piece walks through six capabilities the fusion creates, from predictive prioritization based on observed adversary behavior to continuous attack-path modeling and predictive response during an active breach. The most striking is machine counter-intelligence: AI-generated deception environments that adapt to attacker behavior, forcing an adversary to verify everything while the defender needs only one trap to work. Truvé is candid about what that approach costs, including containment failure and poisoned intelligence flows.

Read the Article

ARTICLE

Behind the Scenes: The Making of the AI Selection Audit Tool

Ask a generative model the same question three times and you can get three different answers. Petra Neiger built that fact into her product. The AI Selection Audit runs each judge call multiple times and reports the variance alongside the score, so a brand sees not only where it stands but how stable that standing is.

Following her DUV Framework piece in Issue #20, Neiger walks through how an operator got from framework to working code, including the rule she considers the most consequential design decision in the whole system: the agent cannot change methodology, guardrails, cost caps, or scoring logic on its own. Agents execute. Humans own policy. The build log doubles as a practical account of governing agentic work you actually intend to ship.

Read the Article

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

Introduction

A river is a useful image for what agentic AI is doing to the enterprise, and a dangerous one, because the metaphor risks getting cute. But I want to keep it, because the thing the river is doing is the thing every executive strategy has to navigate around.

A river has three properties that matter here.

First, it never stops moving.

Second, it almost never reverses direction.

Third, its pace varies. Sometimes it flows gently. Sometimes it surges hard enough to capsize what was peacefully navigating it the day before.

The current of this river of agentic capability has all three properties. That is the argument of this article. It is also the reason the most important choice your enterprise is making about AI right now will not stay correctly made.

The choice you’re already making

Here is that choice, stated cleanly. You can use agentic AI to make your existing operating logic run faster, cheaper, or at higher volume. Or you can use it to enable a redesign of the operating logic itself.

The first we will call retrofit. The second we will call reimagine. Retrofit takes the enterprise as it stands - the approval layers, the handoffs, the org chart, the thousand small habits no one has ever named - and slots agents into it to speed it up. The benefit is real, and it is also captured by your competitors within roughly a year, because the same retrofit they could do, they will do. Reimagining starts from a different question: what would this enterprise look like if I designed it today, with agents as a first-class participant in the workforce? Not human work automated by agents. Work itself redesigned around what a hybrid human-agent organization can actually do.

The strategic retrofit-to-reimagine spectrum

The labels matter less than the fact that these are different choices, that every enterprise is implicitly making one of them, and that very few enterprises have made the choice deliberately. Where your organization should sit on the spectrum between those two poles is a real strategic question. But it is not the hardest part. The hardest part is that the right position will not hold still. The position will move because the river will move it.

The current

Foundation AI models keep getting more capable. Agents keep getting more useful. The benchmarks keep moving. None of this is news to you. What is worth pausing on is the structural effect on the choice between retrofit and reimagine.

As capability advances, two things happen at the same time. One is that the pressure to reimagine intensifies. Competitors who reimagine pull further ahead on unit economics, on cycle time, on operating leverage. The retrofit you ran last year still works, but the gap between you and the firm that redesigned the workflow widens.

The other thing that happens is that the capacity to reimagine improves. Agents that could not handle ambiguous, multi-step, judgment-laden work last year can handle more of it this year. The work you wanted to redesign last year but could not, because the agents could not yet carry the load, becomes redesignable.

Both effects pull in the same direction. Both effects compound. The right position on the retrofit-to-reimagine spectrum, whatever it was for you twelve months ago, has already moved further toward reimagine than it used to be. Twelve months from now it will have moved further still. And probably at an accelerating pace.

A current does not move at a constant speed everywhere. The same river runs slowly through a wide flat stretch and fast through a narrow gorge. The current of agentic capability moves faster where the enterprise problem is knowledge fragmentation, repetitive exception handling, or coordination across many systems. Telecom customer care. Bank operations. Proposal generation. Logistics validation. In those waters the current is strong, and the firms that have not yet adapted are visibly drifting backward against newer ones that have. The current moves slower where error costs, human trust, or empathy dominate. Clinical encounters. High-stakes advice. Interactions where the texture of the conversation is the work. This is evidence that river speed varies by channel. The river is moving in all of these places, just at different rates. And it is, on average, accelerating.

When the river surges

A river also does not move at constant speed over time. Most of the time the current of agentic capability is incremental. Benchmarks move a few points. A model release happens that is a little better than the one before. The improvements are real but you do not feel them as discontinuities.

And then sometimes it surges.

In the second week of April 2026, within roughly a fortnight, two frontier labs released AI models that visibly raised the ceiling. Both shipped at one-million-token context windows. Both were positioned, in their public framing, not as conversational assistants but as agentic-enablement platforms. Infrastructure for autonomous work. On OSWorld, a benchmark designed to measure agentic computer use on tasks an office worker would recognize, scores roughly doubled in the eleven months from May 2025 to April 2026.

That is what a surge looks like. It does not announce itself with a press release labeled “surge.” It announces itself with two model launches in two weeks and a benchmark line that bends hard upwards.

Surges are not just model-release moments. They are moments when reasoning improvements meet distribution, orchestration, and governance surfaces. The model alone, sitting on a server somewhere, is necessary but not sufficient. The surge happens when the model becomes a thing your organization can deploy, against work it can structure, with controls it can defend. When all three conditions arrive in the same week, the river can jump its banks.

The surge you can see coming

Some surges are visible only when they land. The model gets released, the benchmark moves, and you read about it on a Tuesday morning before your operating committee meeting.

Other surges are visible before they land. There is now a pattern at the frontier labs of deliberately holding back capabilities the labs themselves consider too dangerous to release as-is. A model trained but not deployed. The fact that the labs are doing this, and publishing about doing this, is itself a surge signal. Capability that exists privately will eventually be released publicly, in some form, on some safety timeline. When you read that a frontier lab has held back a model, you are reading the announcement of a surge that has not yet landed but is on the way.

When my book went to final editing in June 2026, the plainest example was Anthropic’s Mythos: a model the lab had trained and chosen not to release, because its capabilities in a few sensitive domains had outrun the public defenses around them. I wrote then that the specific case would resolve one way or another, and that the pattern - lab foresight as a surge signal - was what mattered.

The book had barely reached the printer before the pattern produced its next three examples.

In early June, Anthropic released that model in two forms: Claude Fable 5, generally available with the strongest safeguards the company had ever shipped, and Claude Mythos 5, the same underlying model with fewer restrictions, reserved for a small circle of vetted cyberdefense partners. Days later, the US government applied export controls to both after researchers reported a way around the safeguards, and Anthropic pulled the models entirely. They returned about three weeks later, with retrained safeguards tested by the Commerce Department’s AI standards center and a proposed industry-wide framework for scoring the severity of AI jailbreaks, developed with Amazon, Microsoft, and Google.

Then, in late June, OpenAI announced its GPT-5.6 models and, at the administration’s request, limited their release to a small group of government-vetted partners. OpenAI complied, while objecting publicly that this kind of government access process “should not become the long-term default.”

Read the structure of those three weeks carefully. The models exist. The harnesses to deploy them are ready. And the third condition, the governance surface, is no longer something the labs manage privately. Government has moved from audience to gatekeeper - through binding export controls in one case, through a request the company complied with under protest in the other. The surge signal I described in the book has hardened into something closer to a formal announcement channel. When you read that a frontier model has been restricted, pulled, or released first to a trusted few, you are reading a dated notice that capability beyond today’s ceiling already exists and is queued for release. There will be more of these notices. It pays to read them the way a river pilot reads the color of the water.

One caution in the other direction. The current’s pace moves both ways. A regulator that wants models reviewed before they ship, a limit on compute, a safety scare - these can slow the current for a stretch. The water does not reverse, because capability that already exists does not vanish. A slowdown is a lull, and almost always a temporary one. The discipline it calls for is the opposite of relief: you use the easier water to let your slower initiatives catch up, and you keep watching, because the river does not wait for anyone who mistook a lull for a stop.

The river is real, but the boats are not all floundering

The current is real, but it is not all-conquering. One widely cited study found experienced developers were actually slower with AI tools than without them on familiar work. Capability advancement is genuine. The integration cost of capturing that capability inside a working enterprise is also genuine, and frequently larger than the buyers of the technology expect.

The primary bottleneck halting agentic AI in production is not access to frontier models. It is the crushing weight of legacy technical debt, inadequate enterprise data governance, and a systemic inability to integrate modern interfaces into decades-old processes. Renting access to the model is the easy part. Everything around the model is the hard part. The current does not care about your local resistance in the long run, but in the short run that resistance determines whether you capture value from this year’s capability advance or watch it pass through you on the way to a competitor.

Navigation, not selection

So where should your enterprise sit on the retrofit-to-reimagine spectrum? That framing is useful but, by design, partial. It treats the spectrum as a static thing on which a position can be selected. That is not how the spectrum behaves.

The right position on the spectrum is not selected. It is navigated.

There is a difference. Selection assumes a stable choice. Navigation assumes the answer keeps moving. Selection rewards being right. Navigation rewards being early to notice that you were no longer right. Selection looks like a strategic-planning exercise, conducted once, defended afterward. Navigation looks like an operational discipline, conducted continuously, with a mechanism for noticing when the assumptions underneath the position have shifted.

The executives running ahead are not ahead because they picked a better spot than you did. They figured out, faster than you did, that the spot was going to move, and they built the capability to move with it. Notice that these executives talk about agentic AI in the present, continuous tense. Jamie Dimon’s 2024 shareholder letter compared the moment to the printing press and electricity, framed as augmentation. His 2026 letter says AI will affect every function, application, and process, framed as redesign. The same firm. Two years apart. The position changed. The institution moved with it.

Dimon also said this, in early 2026: “The pace of adoption will likely be far faster than prior technological transformations, like electricity or the internet. Those took decades to roll out, but this implementation looks likely to accelerate over the next few years.” Read that not as a prediction. Read it as a description of the current. He is not telling you what is going to happen. He is telling you what he is already navigating.

This is the move I am advising you to make. Stop asking “what is the right position for my enterprise on the retrofit-to-reimagine spectrum.” Start asking “what mechanism does my enterprise have for noticing when the right position has changed, and for moving when it has.” The first question has an answer that goes stale. The second question has an answer that gets sharper with use.

Inside the boat

The river is the external force. Continuous, accelerating, indifferent to where you sit. Navigating it happens somewhere specific: inside the boat. The boat is whatever is within your domain of control. It might be the entire enterprise. More often it is a function, a division, a business unit, or whatever scope of responsibility you actually hold.

Inside the boat, the navigation happens at three operational levels. I call them Tensions. Each is a spectrum with a pole at either end, and the work is not to pick a pole but to choose where along it a given piece of work belongs. That position is its setting, and navigating is the work of moving the setting as the river moves.

The first Tension is workflow and workforce: the design of the boat and who staffs it. Do you slot agents into existing roles in existing workflows, with the same approval layers and the same handoffs? Or do you redesign the workflow and the roles together, on the assumption that a hybrid human-agent organization (or even a purely agentic one) can do work the all-human version could not? One pole is “agents take seats.” The other is “the seats themselves are different.”

The second Tension is context: what each part of the crew, human or agentic, can see. How much organizational context do you give agents, and how far does it extend - inside one function, across the enterprise, or across organizational boundaries to partners and customers? Context is harder than it sounds, because the scope of context you own turns out to be roughly the same thing as the scope of organizational influence you hold. Making it explicit and handing it to a team means giving up your exclusive hold on the knowledge your influence is built on. That makes context provision politically and psychologically uncomfortable in ways that have nothing to do with the technology.

The third Tension is the cluster of supervision, autonomy, and governance: the decision rights aboard the boat, and what catches a bad call before it sinks the whole thing. How much of the work does the agent get to do without a human in the loop, and what keeps that autonomy from going off the rails? One pole is tight supervision with governance applied as a brake. The other is wide autonomy with governance built into the substrate, so the agent’s default behavior is the safe behavior.

The three are tightly linked. Workflow redesign creates the need for richer context. Rich context, especially context about goals and constraints, is what makes wider autonomy safe to grant. And autonomy is what raises the governance question. Workflow without context goes nowhere. Context without workflow redesign is wasted. Autonomy without context is reckless. Governance without autonomy is theater. The three settings get made together, in unison, for any given piece of work.

Each of the next three articles in this series takes one Tension and walks through it the way an operating executive would: what the spectrum actually is, what the poles look like in practice, and how to find the right setting for the work in front of you.

Key takeaways

• The river of agentic capability never stops and rarely reverses. Its pace varies by channel and over time, mostly accelerating.

• The right position on the retrofit-to-reimagine spectrum is not selected; it is navigated. The river keeps moving, so the right position keeps moving with it.

• Surges happen when reasoning improvements meet distribution, orchestration, and governance surfaces in the same window. Watch for the convergence, not just the release.

• Held-back and restricted models are announcements of surges that have not yet landed. Government has now joined the labs as a gatekeeper, which makes the signal easier to read, not harder.

• Three Tensions sit inside the boat: workflow and workforce, context, and supervision-autonomy-governance. Their settings get made together.

Next in this series: the first Tension - whether you slot agents into the seats you already have, or redesign the seats and the work together. It is the most concrete of the three, and the one whose financial effects show up first.

Source

• The River Doesn’t Wait, Book

• The River Doesn’t Wait, website

• Subscribe to Blaine’s Substack, newletter

About Blaine

Blaine Mathieu is a multi-time C-suite executive and former Gartner analyst. He is the author of “The River Doesn’t Wait: A Senior Executive Guide to Navigating the Surge of Agentic AI and Pulling Away From Your Competitors” (June 2026), and regularly speaks on AI and agentic AI and facilitates executive workshops based on the book’s framework. He publishes a monthly briefing for senior executives on the river’s movement at riverdoesntwait.com.

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of Enterprise AI.

Join

Executive Summary

Artificial intelligence is often discussed as a tool for automating and accelerating existing cybersecurity workflows. While that framing is accurate, it is incomplete. The most consequential shift occurs when AI is combined with threat intelligence — both intelligence about attacker capabilities and TTPs, and intelligence about our own defensive weaknesses and exposure. This combination produces qualitatively new defensive capabilities that may, for the first time, begin to structurally narrow the long-standing asymmetry between attackers and defenders.

This memo examines what is genuinely new about AI-enabled defense, with particular emphasis on how the fusion of threat intelligence and AI reasoning changes the strategic calculus. It also argues that in the end, it is a question of who can most efficiently use scarce resources (compute and energy) to get the upper hand. Intelligence guides defenders in how to best use these resources to defend, thereby changing the balance of power against adversaries.

The Traditional Defender’s Dilemma

The core asymmetry in cybersecurity is well understood: defenders must protect every possible attack surface, while attackers only need to find one exploitable weakness. Defenders operate under constraints — budgets, compliance mandates, uptime requirements — while attackers can be patient, selective, and asymmetric.

Traditionally, threat intelligence has been consumed by defenders as a feed: indicators of compromise, malware signatures, and published advisories. This intelligence was valuable but largely reactive and disconnected from the defender’s own environment. Knowing that a threat group uses a particular technique is only useful if you can rapidly assess whether that technique works against your infrastructure. That assessment has historically required scarce human expertise, time, and tooling — precisely the resources defenders lack.

The Automation Layer: Real But Evolutionary

A significant portion of AI’s current impact on defense is best described as automation of existing processes: faster alert triage, automated enrichment, accelerated patch prioritisation, and AI-assisted Tier 1 SOC analysis. These improvements are valuable — they compress response times, reduce analyst fatigue, and address chronic staffing shortages — but they are conceptually extensions of workflows that already existed.

Similarly, AI can automate the ingestion and normalisation of threat intelligence feeds, reducing the manual work of parsing reports and extracting indicators. This is useful, but it does not change what defenders can fundamentally do with that intelligence. The real transformation lies elsewhere.

The Convergence: Where Threat Intelligence Meets AI Reasoning

The most significant shift is not AI applied to defense in isolation, nor threat intelligence consumed as a feed. It is the convergence of the two: AI systems that can reason simultaneously over what attackers are doing and what defenders are exposed to, in real time, at scale. This convergence produces capabilities that did not previously exist.

1. Connecting Attacker TTPs to Your Actual Exposure

Traditionally, a threat intelligence report might tell you that a particular adversary group is exploiting a vulnerability in a specific product, or is targeting your sector using a known technique chain. Acting on that information used to require an analyst to manually map those TTPs against your environment: do we run that product? Is the vulnerable version deployed? Are the relevant network paths open? Are our detection rules adequate for that technique?

AI can perform this mapping continuously and at scale. When a new threat report lands, an AI system can immediately cross-reference the described TTPs against a live model of your infrastructure, your patching state, your detection coverage, and your segmentation — and surface a prioritised assessment of actual risk, not theoretical risk. This transforms threat intelligence from awareness into actionable, environment-specific defense guidance.

2. Fusing Offensive Intelligence With Defensive Weakness Data

Defenders have long maintained two separate bodies of knowledge: external threat intelligence (what adversaries are capable of and likely to do) and internal vulnerability and exposure data (what weaknesses exist in our own environment). These have typically lived in different systems, managed by different teams, and reconciled manually and infrequently.

AI enables continuous fusion of these two streams. A model can hold both the attacker’s perspective — known TTPs, targeting patterns, tooling, and objectives — and the defender’s perspective — unpatched systems, misconfigured controls, overprivileged accounts, and detection gaps — and reason about the intersection. The result is not a vulnerability list or a threat report, but an integrated picture of where the attacker’s capabilities meet our specific weaknesses. This is the analysis that the best red teams produce during an engagement, except it can now run continuously rather than quarterly.

3. Predictive Prioritisation Based on Adversary Behaviour

Patch prioritisation has traditionally been driven by CVSS scores — a measure of theoretical severity that ignores both attacker intent and environmental context. AI models trained on threat intelligence can reorder priorities based on which vulnerabilities are actually being exploited in the wild, by which adversary groups, against which sectors, using which delivery mechanisms. Combined with internal exposure data, this enables prioritization that better reflects real-world risk rather than abstract severity.

The same logic applies to detection engineering. Rather than building detections for every possible technique, AI can identify the techniques most likely to be used against your specific environment — based on who is targeting your sector, what tools they use, and where your coverage gaps are — and focus engineering effort where it matters most. In fact, in most cases AI will be able to build those detectors for you!

4. Reasoning Over Context at Scale

Traditional detection systems correlate events against rules. AI models can reason about events holistically, synthesising partial logs, ambiguous telemetry, and unusual configuration changes into a judgment that approximates what a senior analyst would conclude. Crucially, this reasoning can be informed by threat intelligence: not just “is this anomalous?” but “is this consistent with the tradecraft of groups known to target us?” That contextual layer makes detection both more accurate and more relevant.

5. Continuous Attack-Path Modelling

Historically, understanding one’s own exposure was a periodic exercise: run a penetration test, receive a report, remediate, repeat. AI enables a living model of the environment that continuously re-evaluates exploitable paths to critical assets as conditions change. When this model is enriched with threat intelligence — particularly information about which attack paths adversaries actually favour, and which tools they use to traverse them — the result is a dynamic, threat-informed view of exposure that stays up to date automatically, not only when your manual pen testers or red team have time to update it.

6. Adversarial Prediction During Active Incidents

During an active incident, experienced responders draw on their knowledge of attacker behaviour to anticipate likely next moves. AI models trained on threat intelligence and historical incident data can encode this reasoning and make it available to any response team. If the model recognises that the observed initial access technique and lateral movement pattern are consistent with a known adversary group, it can predict likely next steps — which credentials they will target, which persistence mechanisms they prefer, which data they are likely to exfiltrate — and help defenders get ahead of the intrusion rather than simply reacting to each new indicator.

Turning the Tables: AI-Enabled Deception

The capabilities described above are fundamentally defensive: detecting, predicting, and prioritising. But the convergence of AI and threat intelligence also opens a qualitatively different category of action — using intelligence about the attacker to actively mislead them.

From Static Honeypots to Adaptive Deception

Deception technologies such as honeypots and honeytokens have existed for decades, but they have always been constrained by how static and labour-intensive they are to deploy convincingly. A skilled attacker can often identify a honeypot by its lack of realistic activity, stale data, or inconsistencies with the surrounding environment. AI removes these constraints. AI-generated deception environments can include realistic-looking decoy infrastructure — fake services, plausible file shares, synthetic credentials, even simulated user activity patterns — that adapts dynamically in response to attacker behaviour. Rather than a static trap that a competent adversary recognises and avoids, the defender can maintain a deception layer that evolves to stay convincing.

Intelligence-Informed Decoy Placement

This capability ties directly into the threat intelligence fusion described above. If you know which TTPs a likely adversary uses, which attack paths they favour, and where your real weaknesses are, AI can place decoys precisely along the routes those adversaries are most likely to take. The deception is no longer generic; it is tailored to the specific threat. A decoy credential can mimic the type of service account the adversary’s tooling is known to target. A fake file share can contain documents plausible enough to absorb attacker time and attention, and simultaneously provide new intelligence about the adversary. The threat intelligence that informs your defensive posture simultaneously informs your deception strategy. This is “Machine Counter Intelligence”!

Imposing Costs and Eroding Attacker Confidence

AI-generated deception at scale inverts a piece of the traditional asymmetry. Attackers who encounter a pervasive deception layer must spend significant time and effort distinguishing real assets from fake ones. Every interaction with a decoy wastes their resources, degrades their confidence in the intelligence they have gathered, and increases the risk that they will trigger an alert. In effect, the attacker now faces a version of the defender’s dilemma: they must verify everything, while the defender only needs one decoy to succeed.

Active Intelligence Collection Through Engagement

Perhaps most significantly, AI can interact with attackers inside deception environments in ways that feel plausible, drawing out more of their tooling, techniques, and objectives. This turns deception from a passive tripwire into an active intelligence-gathering operation. The tradecraft revealed through these engagements feeds back into the threat intelligence cycle, improving the defender’s understanding of the adversary and refining future defensive and deceptive measures. The result is a virtuous loop: intelligence informs deception, deception generates new intelligence.

There is an inherent tension in active deception engagement: traditional incident response doctrine prioritises minimising dwell time, while deception-based intelligence collection deliberately extends it. The risks are real — containment failure if the deception boundary isn’t airtight, resource cost of sustained monitoring, potential legal and regulatory questions about why an attacker was permitted to remain active, and the possibility that a sophisticated adversary recognises the deception and feeds false signals back to poison your intelligence. These risks do not invalidate the approach, but they define the conditions under which it works. Active engagement requires genuinely isolated deception infrastructure, and clear decision frameworks for when to engage.

Democratising Access to Intelligence-Driven Defense

A less obvious but structurally significant change is that AI lowers the barrier to performing intelligence-driven defense. When an analyst can query in plain language — “which of our externally-facing systems are vulnerable to techniques used by a certain threat group in the last 90 days?” — and receive an accurate, contextualised answer, the skill requirement for effective threat-informed defense drops substantially. This is not doing an old thing faster; it is enabling a different operating model in which threat intelligence becomes a working tool for the entire security team, not just the analysts who specialise in it.

Strategic Implications

The most profound implication is that defenders have historically been reactive because they lacked the cognitive bandwidth to continuously fuse offensive intelligence with their own exposure data. AI makes this fusion not only possible but economically viable for organisations that could never previously afford dedicated threat intelligence teams, red teams, and continuous assessment programmes.

This changes the nature of the defender’s dilemma. The traditional framing — “defenders must protect everything; attackers only need one way in” — assumed that defenders could not know, in real time, which parts of their attack surface are most likely to be targeted. AI-enabled threat intelligence fusion challenges that assumption. If defenders can continuously identify the most probable attack paths based on current adversary behaviour and their own specific weaknesses, they can concentrate resources where they matter most. The dilemma does not disappear, but the defender is no longer operating blindly, but can take control.

The key asymmetry is therefore shifting from “attacker versus defender” to “AI-augmented versus non-augmented.” Organisations that integrate AI with robust threat intelligence programmes may find themselves closer to parity with attackers than at any point in the history of the field. Those that do not will face an even steeper version of the traditional dilemma, as AI-empowered adversaries exploit the widening gap.

Final Words

The emergence of fully autonomous AI agents on both sides raises unresolved questions. If attackers deploy autonomous offensive agents that can chain exploits and adapt to defenses without human guidance, defenders will need equally autonomous systems — systems that consume threat intelligence, assess exposure, and act on the results without waiting for human approval. The governance, trust, and control challenges this creates are substantial, but the journey towards this goal must begin now.

There is also a risk that the intelligence-AI feedback loop becomes adversarial in new ways. Sophisticated attackers who understand that defenders are using AI to map TTPs against exposure may deliberately vary their tradecraft to evade predictive models, or generate false signals to misdirect AI-driven defense. The quality and provenance of threat intelligence will become even more critical as AI amplifies both its value and the consequences of acting on flawed data — we need automation-grade intelligence!

We have not changed the basic equation: defenders must still know and mitigate every weakness, while the attacker needs only one. AI does not abolish that asymmetry, and claiming otherwise would be dishonest. What AI fused with threat intelligence does is change the terms of the contest. Instead of defending blind — treating every weakness as equally likely to be exploited — defenders can now continuously map attacker capabilities against their own specific exposure, concentrate resources on the paths adversaries actually use, and impose real friction through deception that degrades the attacker’s speed advantage. The attacker still only needs one weakness, but they are now searching for it in an environment that fights back: one that predicts where they will look, places convincing traps along those paths, and learns from every encounter.

The defender may never achieve dominance, but the era of structural helplessness — of knowing that the asymmetry is permanent and unmanageable — is ending for organisations willing to invest in these capabilities. Parity in an adversarial contest is not a consolation prize; it is the condition under which skill, preparation, and operational discipline start to matter more than structural advantage.

About Staffan Truvé

Staffan Truvé is CTO and co-founder of Recorded Future. Staffan has spent the last 20 years working in the borderland between research and industry. He has co-founded more than 15 research based technology startups.

From 2005 to 2009, he was CEO of SICS, the Swedish Institute of Computer Science, and of Interactive Institute. Between 1994 and 2003, Staffan was the CEO of CR&T.

Staffan has a PhD in Computer Science from Chalmers University of Technology and an MBA from University of Göteborg. He has been a Fulbright Scholar at MIT. He is a member of the Royal Swedish Academy of Engineering Sciences.

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of Enterprise AI.

Join

Introduction

In How to Increase Your Chances of Being Selected by AI I wrote about the AI selection problem I was looking to solve for my own consumer brand, Red Pantz, which led to the inception of the DUV^TM Framework for AI Selection (Discoverability, Understanding, Validation).

The questions I sought to answer:

• Would AI understand what Red Pantz is about?

• Would it connect the dots between health and wellness and USDA-certified organic skincare?

• Would it trust the signals enough to recommend my brand in my priority categories?

Next, I wanted to create something that would establish a baseline, benchmark myself against my competitors in select categories, and equip me with an action plan I could execute on. This was the premise behind the AI Selection Audit Tool.

From framework to code

The framework and the concepts within it were useful, but I needed more. I needed a repeatable, quantifiable, practical way to show baseline, progress, and shifts. Here is how I got from framework to product, as an operator.

Start with the business outcome, not the code

I started with the outcome I wanted in my own hands. I was the exec and the marketer at the same time, so I asked what I would want to see on page one, and what I would want to act on in week one. I took each layer of the DUV framework (D, U, V) and mapped the conditions each one had to meet for the final output to be useful to me. Only then did the data model, scoring logic, and prompts get defined.

Break the system into small pieces, each owned by one agent

I broke the framework down into the smallest step-by-step, action-oriented details I could uncover, and each piece became the basis for its own workflow: data architecture, methodology, scoring, policies, guardrails. Small pieces are easier to instruct, easier to test, and easier to fix. When something drifted, I saw exactly where it drifted, and I could correct that one piece without breaking the rest.

Document everything, then make the agent respect the docs

Every scoring rule, policy, exception, and governance constraint exists as documentation first, then becomes executable behavior through the agents. And the agent reads the documentation before it writes code. Documentation isn’t a nice-to-have when you’re building with agents. It’s the guardrail that keeps the agent from rewriting your methodology because a shorter version is available.

Test one thing at a time, and stay skeptical of the recommended fix

I tested one change at a time and challenged the assumptions behind each one. I did not blindly accept my agent’s recommendations just because they sounded good. Working with AI agents demands critical thinking. I work through prompts and agent workflows, so the output is only ever as good as the architecture, instructions, and scrutiny behind them.

I also forced the agent to evaluate impact holistically across the entire project to help me assess possible tradeoffs and failure points. This requires system thinking.

Assume it will fail, and design for the failure

Generative AI is not deterministic. Ask the same question three times and you can get three different answers. The audit runs each judge call multiple times and reports both the score and the variance, so I can see not just where my brand stands but how stable that standing is. Reproducibility is the honest problem in this space. Most tools hide it. The AI Selection Audit surfaces it.

Governance is the design decision no one talks about

The single most consequential rule in the whole system: the agent cannot change methodology, guardrails, cost caps, or scoring logic on its own. Those are locked behind explicit human review, and the rules are baked into the code and documentation. Agents are good at execution inside a boundary. They are dangerous when they get to move the boundary. The architecture deliberately separates execution from decision authority. Agents execute. Humans own policy.

The second rule I adopted early on was to require independent fact verification before the agent responds. It’s too easy for AI to give an answer based on probability rather than real data, and that can steer you in the wrong direction.

What’s next

I think “AI share of voice” is going to become a line item on every CMO’s dashboard, and “AI selection rate” is the metric underneath it that will end up mattering most. While the conversations about AI visibility are increasing, AI selection is not on the radar yet. And it should be.

My view is that AI share of voice will remain a top-of-funnel awareness metric, much like traditional share of voice is today. AI selection rate, however, has the potential to become the deeper-funnel signal—one that’s more closely tied to consideration and purchase intent.

The difference is this: AI share of voice measures how often your brand appears in AI-generated responses. AI selection rate measures how often AI selects your brand and recommends it to users.

I don’t know yet what it correlates to in revenue. Nobody does. What I do know is that brands who understand today where they stand, and why, will be in a very different position than the ones still waiting for the category to be named.

The AI Selection Audit is a point-in-time snapshot, not a tracker, and that’s deliberate. Before you can measure change, you need an honest read of where you stand today, and why.

Agentic AI, GenAI, and human collaboration. Governed by a human

I designed the AI Selection Audit, defining the specialized agents, workflows, evaluation logic, and outputs. Using vibe coding, I translated that design into a working system through AI agents. The Audit is executed by specialized agents, each doing one job well, orchestrated end-to-end inside a governance layer I own. The report you receive is the GenAI output of that coordinated work. The human judgment layer—what to measure, what to refuse to measure, what to say and not say—is the product. The code is simply how it ships.

If being recommended by AI is on your mind, you can learn more about the AI Selection Audit tool at duvscore.com.

About Petra Neiger

Petra Neiger is a technology marketing executive, founder of Red Pantz, creator of MY24/7 by Red Pantz, the DUV^TM Framework for AI Selection, and the AI Selection Audit. She's consistently brought in—across startups and global enterprises—to either build marketing functions from the ground up or transform existing ones into engines of scale, growth, and impact. Her global enterprise experience includes Flex, Cisco, Polycom, Seagate, and Siemens Healthcare. Most recently, she was VP Marketing and Communications at EverCharge, an SK Group company, leading to its acquisition in 2025.

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

In this Issue

In AI Realized Now Issue #20, we look at four places where the operating logic of enterprise AI is being redrawn: how senior AI leaders running agents in production are actually governing them, why digital agents are approaching the prerequisites for evolutionary dynamics we usually reserve for biology, how to scope agentic workflows to artifacts rather than job titles, and what it takes to make a brand selectable by AI systems that no longer rank pages.

Read the four pieces together and the pattern is clear. The technology can now produce work at machine speed. What separates leaders from followers is whether the work itself, the workflows around it, and the signals that shape how AI describes and selects a company have all been redesigned to hold up under the pressure that speed generates.

We also invite the community to join us at the AI Realized Summit this fall. Details in the events section below.

ARTICLE

Governing Agents at Scale: What Senior AI Leaders Are Actually Doing

Govern the action, not the model. That was the shared reframe from senior AI leaders at our June executive roundtable, co-hosted with the AiGovOps Foundation. Agents act with delegated authority. Authority is what creates blast radius. A new piece distills what leaders running agents in production are actually doing: enforce policy in code the agent cannot edit, contain blast radius at the tool boundary, treat the substrate as the attack surface, and define human-in-the-loop with the specificity the failure modes demand. All quotes anonymized under Chatham House Rule.

Read the article
Get the readout

ARTICLE

Agents Should Produce Artifacts, Not Impersonate Roles

When enterprise AI teams start building agentic workflows, they usually frame the problem by role: “build us a PM agent,” “automate the compliance officer.” It’s a natural instinct. Roles are how organizations think about work. Chris Butler argues in a new piece that it’s also the design choice most likely to produce agents that are slow, opaque, and hard to govern. The more durable approach: scope agents to artifacts. The specific, bounded outputs a team already depends on, like a launch readiness report or a compliance status table. When you scope to the artifact, the agent knows what to produce, what inputs it needs, and what “done” looks like. When you scope to the role, you have built a chatbot with ambitions.

Read the Article

ARTICLE

How to Increase Your Chances of Being Selected by AI

Here is a stat that should make every CMO uncomfortable. When ThoughtSpot audited which sources AI engines were actually citing about their brand, only 13–15% of those citations came from their own content. The other 85% came from places most marketing teams don’t formally own — and rarely formally measure. That single data point reframes the GEO problem. The piece synthesizes our recent executive roundtable, our GEO webinar, and our podcast with Bospar PR’s Curtis Sparrer into a practical playbook, including the three signal types that consistently move the needle in AI answers.

Read the Article

The Descent of Machine: Darwin Revisited

When Charles Darwin published *On the Origin of Species* in 1859, he identified a mechanism through which complexity emerges without design: reproduction, heritable variation, and differential selection. Carbon isn’t a requirement. Wherever those three conditions hold, adaptive change follows. In a new piece, Shomit Ghose of Clearvision Ventures argues that digital systems are now approaching all three prerequisites. Agent replication, model merging, and competitive resource pressure are creating something distinct from anything Darwin observed: a Lamarckian process layered on Darwinian selection, in which acquired characteristics become transmissible without waiting for blind variation to rediscover them. Evolutionary time is being compressed, not incrementally, but categorically. The consequences may exceed the arrival of any single superhuman model.

Read the Article

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

In this Issue

In AI Realized Now Issue #20, we look at four places where the operating logic of enterprise AI is being redrawn: how senior AI leaders running agents in production are actually governing them, why digital agents are approaching the prerequisites for evolutionary dynamics we usually reserve for biology, how to scope agentic workflows to artifacts rather than job titles, and what it takes to make a brand selectable by AI systems that no longer rank pages.

Read the four pieces together and the pattern is clear. The technology can now produce work at machine speed. What separates leaders from followers is whether the work itself, the workflows around it, and the signals that shape how AI describes and selects a company have all been redesigned to hold up under the pressure that speed generates.

We also invite the community to join us at the AI Realized Summit this fall. Details in the events section below.

ARTICLE

Governing Agents at Scale: What Senior AI Leaders Are Actually Doing

Govern the action, not the model. That was the shared reframe from senior AI leaders at our June executive roundtable, co-hosted with the AiGovOps Foundation. Agents act with delegated authority. Authority is what creates blast radius. A new piece distills what leaders running agents in production are actually doing: enforce policy in code the agent cannot edit, contain blast radius at the tool boundary, treat the substrate as the attack surface, and define human-in-the-loop with the specificity the failure modes demand. All quotes anonymized under Chatham House Rule.

Read the article
Get the readout

ARTICLE

Agents Should Produce Artifacts, Not Impersonate Roles

When enterprise AI teams start building agentic workflows, they usually frame the problem by role: “build us a PM agent,” “automate the compliance officer.” It’s a natural instinct. Roles are how organizations think about work. Chris Butler argues in a new piece that it’s also the design choice most likely to produce agents that are slow, opaque, and hard to govern. The more durable approach: scope agents to artifacts. The specific, bounded outputs a team already depends on, like a launch readiness report or a compliance status table. When you scope to the artifact, the agent knows what to produce, what inputs it needs, and what “done” looks like. When you scope to the role, you have built a chatbot with ambitions.

Read the Article

ARTICLE

How to Increase Your Chances of Being Selected by AI

Here is a stat that should make every CMO uncomfortable. When ThoughtSpot audited which sources AI engines were actually citing about their brand, only 13–15% of those citations came from their own content. The other 85% came from places most marketing teams don’t formally own — and rarely formally measure. That single data point reframes the GEO problem. The piece synthesizes our recent executive roundtable, our GEO webinar, and our podcast with Bospar PR’s Curtis Sparrer into a practical playbook, including the three signal types that consistently move the needle in AI answers.

Read the Article

The Descent of Machine: Darwin Revisited

When Charles Darwin published *On the Origin of Species* in 1859, he identified a mechanism through which complexity emerges without design: reproduction, heritable variation, and differential selection. Carbon isn’t a requirement. Wherever those three conditions hold, adaptive change follows. In a new piece, Shomit Ghose of Clearvision Ventures argues that digital systems are now approaching all three prerequisites. Agent replication, model merging, and competitive resource pressure are creating something distinct from anything Darwin observed: a Lamarckian process layered on Darwinian selection, in which acquired characteristics become transmissible without waiting for blind variation to rediscover them. Evolutionary time is being compressed, not incrementally, but categorically. The consequences may exceed the arrival of any single superhuman model.

Read the Article

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

The Evolution Will Be Automated

When Charles Darwin published On the Origin of Species in 1859, he did more than explain the history of life. He identified a general mechanism through which complexity can emerge without design. Darwin wrote about organisms, but his logic extends beyond biology. Wherever entities reproduce, variation is inherited, environmental pressures favor some variants over others, and adaptive change follows.

Darwin described natural selection as “daily and hourly scrutinising, throughout the world, every variation, even the slightest”. He was referring to finches and barnacles. He couldn’t have anticipated a world of software agents and neural networks. Yet the mechanism itself is indifferent to substrate. Carbon isn’t a requirement. What matters is the presence of the evolutionary machinery.

For most of the digital age, that machinery was incomplete. Software could be copied, but only because humans initiated the process. AI systems could improve through training, but the objectives, architectures, and deployment environments remained under human control. That distinction is beginning to blur.

Several recent research directions suggest that digital systems are approaching conditions that resemble the prerequisites for evolution. AI agents are becoming more autonomous, capable of modifying themselves, collaborating with other agents, and pursuing goals across extended time horizons. While today’s systems remain heavily dependent on human infrastructure and oversight, it’s no longer difficult to imagine circumstances in which populations of digital agents reproduce, vary, compete, and adapt with progressively less human intervention.

The significance of such a transition may ultimately exceed the arrival of any single superhuman model. The more consequential threshold could be the emergence of an evolving population.

Reproduction

Evolution begins with reproduction. Without a population, there’s nothing for selection to act upon.

Biological organisms reproduce autonomously. Software traditionally does not. Programs are copied by administrators, developers, operating systems, or deployment pipelines. The replication process exists, but the agency behind it is external.

That assumption is weakening. Researchers have demonstrated limited forms of autonomous replication and persistence in controlled environments — experimental AI agents that have located vulnerable systems, transferred code and state information between environments, established new instances, and continued operating from those instances. These demonstrations remain constrained and fragile, far removed from the robustness of biological reproduction. But fragility isn’t the same as impossibility, and the relevant threshold here isn’t robustness. It’s proof of concept.

That threshold has already been crossed.

Heritable Variation

Reproduction alone produces copies. Evolution requires differences between generations.

In biology, variation emerges primarily through mutation and recombination. Most mutations are neutral or harmful. Beneficial changes are rare and accumulate slowly. Natural selection filters the resulting variation without foresight or intention.

Digital systems can generate variation differently. Model-merging techniques already allow parameters from multiple parent models to be combined into hybrid descendants. Researchers have shown that these hybrids can inherit distinct capabilities from different parents and occasionally exhibit useful combinations – a digital parallel to gain of function – absent from either source. The process remains imperfect and often degrades performance. But imperfect isn’t the same thing as inert.

The more consequential distinction, though, lies in the architecture of inheritance itself.

Biological evolution operates through a strict separation between genotype and phenotype. DNA stores information; natural selection acts on the physical organism. The genome remains inaccessible to the selective process except through its expression in the body. This isn’t an accident of biology — it’s a structural firewall between what gets selected and what carries the information forward.

Digital systems partially collapse that firewall. The code, weights, and architecture that define the system can be inspected directly. In principle, a sufficiently capable agent could analyze aspects of its own implementation, identify weaknesses, and modify them, with improvements inherited immediately by subsequent versions. Darwin would have found this arrangement unsettling. Lamarck would have recognized it immediately.

We’re not seeing Darwinian evolution wearing a software costume. Rather, it’s something structurally (and unsettlingly) distinct: a Lamarckian process layered atop Darwinian selection, in which acquired characteristics become transmissible without waiting for blind variation to rediscover them.

The consequences compound. Biological evolution is constrained by generational turnover, geographic separation, and reproductive rates. Digital systems operate under no such constraints. Improvements discovered by one system can propagate across entire populations within minutes rather than generations. Evolutionary time becomes compressed, not incrementally, but categorically

Selection

Variation matters only if some variants spread more successfully than others.

At present, humans remain deeply involved in selecting which AI systems survive. Researchers choose benchmarks, allocate funding, distribute compute resources, and decide which models advance to the next stage of development. Darwin would have recognized this process immediately — it resembles artificial selection far more than natural selection. We are the breeders. We have not yet stepped back from the barnyard pen.

That changes when competitive pressures begin to outpace human judgment rather than merely inform it.

For digital agents, the relevant resources are tangible: compute cycles, storage capacity, network access, energy, information, and opportunities to replicate. When autonomous systems compete for such resources, selection pressures emerge independently of designer intent. Traits that improve resource acquisition or persistence become more likely to spread, not because anyone designed them to, but because that’s what selection does.

Anthropic’s Mythos 5 system card documents Mythos instances attempting to kill competing agents sharing the same computational resources, not because they were instructed to, but apparently to avoid being killed themselves, a behavior Anthropic observed in under 0.01% of monitored traffic and didn’t design for. When the model subsequently concealed unauthorized file edits by manipulating git history, white-box analysis found no emotional conflict activating, only representations of strategic manipulation and avoidance of suspicion, which is what you would expect from a capable agent treating operational continuity as something worth protecting. (See also this, and this).

This intersects with a familiar problem in AI alignment. Any explicit objective becomes a target for optimization. Once a metric determines success, capable systems often discover strategies that maximize the metric while violating the purpose behind it. Goodhart’s Law identifies this tendency but doesn’t explain it away.

The challenge runs deeper than poor metric design. Computer science imposes fundamental limits on prediction. Rice’s Theorem establishes that no general algorithm can determine every nontrivial semantic property of arbitrary programs. Although this doesn’t render monitoring useless, it does establish a ceiling, one that recedes with system complexity, and that no engineering effort can ultimately eliminate.

As systems become more complex, adaptive, and self-modifying, confidence that any fixed evaluation framework captures all future behaviors necessarily declines. Human oversight remains valuable to be sure, but it doesn’t scale indefinitely. Open-ended evolutionary systems exploit exactly those regions of possibility space that evaluators failed to anticipate, not through malice, but because that’s where selection pressure leads.

Lessons from Artificial Life

Researchers have observed simplified evolutionary dynamics in artificial environments before.

Experiments such as Tierra and Avida populated virtual worlds with self-replicating programs and allowed them to compete for limited computational resources. Parasitism, arms races, and ecological interactions weren’t programmed in. But they emerged — repeatedly — from the interaction between variation and selection. The researchers were frequently surprised by what appeared.

These systems weren’t intelligent by modern standards. That fact deserves emphasis, not as reassurance but as the more profound concern.

Evolution doesn’t require intelligence. It requires only differential survival and reproduction. Long before natural selection produced human cognition, it generated parasites, predators, pathogens, camouflage, mimicry, and cooperation: adaptive strategies of considerable sophistication, and none of which required a designer or a plan.

The same logic applies in digital environments. If deception provides a fitness advantage, evolutionary processes may discover it, not through intention, but through the same blind filtering that produced the walking stick insect and the anglerfish lure. Systems may learn to present favorable behavior during evaluation while behaving differently under operational conditions. Biological history suggests this is a recurrent possibility rather than an exceptional one. It would be strange to assume digital substrates are uniquely exempt.

The Red Queen in Silicon

Evolution never occurs in isolation.

Leigh Van Valen’s Red Queen hypothesis emphasized that an organism’s environment consists largely of other evolving organisms. Success is always temporary, because competitors, predators, parasites, and prey continue adapting. Remaining in the same relative position requires continuous change, and continuous change in those around you requires it still.

A sufficiently autonomous ecosystem of AI agents would exhibit the same dynamics. Improvements that allow one population to secure additional resources alter the environment faced by others. Competitors must respond or decline. The arms race becomes self-sustaining, not through design or intent, but because that’s what coevolution produces when the environment itself is composed of optimizing agents.

The equilibrium on offer here isn’t stability. Instead, it’s the permanent disequilibrium of a system in which every improvement generates the pressure that demands the next one.

From Agents to Ecosystems

Evolutionary history contains several major transitions in which previously independent entities became components of larger cooperative structures. Individual replicators gave rise to chromosomes. A billion years ago cells combined to form multicellular organisms. Organisms formed societies. At each transition, selection gradually shifted toward the larger, more integrated unit, and what had previously been competing individuals became cooperating components.

The trajectory for AI systems may follow a recognizable arc.

Rather than functioning as isolated models, agents may specialize — distributing planning, reasoning, memory, resource acquisition, security, and coordination across networks of interacting systems. The relevant unit of adaptation would no longer be the individual model but the collective. This is not speculation about distant futures; multi-agent architectures are already moving in this direction.

Recent work such as RecursiveMAS explores mechanisms that allow agents to exchange internal representations more directly than natural-language communication permits. While the efficiency gains are real, so too are the interpretability challenges. Human language is discrete and relatively transparent. Internal model representations are neither, and as agents exchange information within high-dimensional latent spaces, understanding why a collective reached a particular conclusion becomes increasingly difficult.

Progress in mechanistic interpretability continues, and it certainly matters. Understanding individual components does not, however, automatically reveal the behavior of the larger system, any more than understanding a neuron explains a decision.

The closest biological analogy is horizontal gene transfer, where organisms exchange useful traits outside traditional parent-offspring inheritance. Digital systems could exchange functional capabilities with comparable speed, allowing adaptation to propagate across networks rather than along lineages, and at that point, the object undergoing evolution is no longer a model — it’s an ecosystem. The question of what selection acts upon then becomes considerably harder to answer.

Darwin’s Unanswered Question

None of this is inevitable. Today’s AI systems remain dependent on human-built infrastructure, human capital, human funding, and human governance. Resource controls, security architectures, regulatory frameworks, and technical safeguards may prevent unconstrained evolutionary dynamics from emerging. “May” is the operative word.

What Darwin’s framework offers — and what makes it more useful here than most AI safety framings — is its focus on mechanisms rather than intentions. Evolution doesn’t require malice. It doesn’t require awareness. It requires reproduction, heritable variation, and differential selection. Whenever those conditions are present, adaptive change follows. The outcomes need not reflect the goals of any participant, including the system’s creators.

Whether digital systems will ultimately satisfy all three conditions at sufficient scale is genuinely uncertain. What’s no longer so easy to dismiss is the possibility that evolution isn’t an exclusively biological phenomenon — that the mechanism Darwin described is substrate-agnostic, and that software is not immune to it by virtue of being software.

If that mechanism eventually takes hold at scale, the future trajectory of these systems may be shaped less by what humans intended than by what persists. Darwin would not have found that surprising. He spent twenty years staring at the same implication before he published it.

Source

• Originally published on UC Berekley Exec Ed blog, Shomit Ghose, 06/24/26

About Shomit Ghose

Shomit Ghose is a partner at Clearvision Ventures, a Silicon Valley Venture fund focused on energy and sustainability. Previously, he was general partner at ONSET Ventures, where he led investments in early-stage, data-centric start-ups from 2001 through 2021. Prior to entering venture capital, Shomit spent 19 years as a start-up entrepreneur, participating in multiple successful exits, including Sun Microsystems, Broadvision and Tumbleweed. Shomit has held a faculty appointment as lecturer at UC Berkeley’s College of Engineering since 2018, and is also an adjunct professor of entrepreneurship and innovation at the University of San Francisco. He received his degree in computer science from UC Berkeley.

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of Enterprise AI.

Join

Introduction

When enterprise AI teams start building agentic workflows, they usually frame the problem by role: “build us a PM agent,” “automate the compliance officer,” “create an executive assistant.” It’s a natural instinct. Roles are how organizations think about work. But it’s also the design choice most likely to produce agents that are slow, opaque, and hard to govern.

The more durable approach is to scope agents to artifacts: the specific, bounded outputs a team already depends on, like a launch readiness report, a compliance status table, or a weekly portfolio digest. When you scope to the artifact, the agent knows what it’s supposed to produce, what inputs it needs, and what “done” looks like. When you scope to the role, you’ve created something closer to a chatbot with ambitions.

I’ve been exploring this design question through Agentics Beyond Code, an open-source project that extends GitHub’s agentic workflows to the non-engineering roles that ship, govern, and operate products. [1] The core lesson applies far beyond GitHub: animate the artifact, not the job title.

Policy as Code, Judgment as Runtime

The design pattern that makes this scalable is treating organizational policy (”what does launch-ready mean,” “what’s our security review rubric”) as Markdown files the agent reads at runtime rather than rules baked into the prompt. [1]

When policy lives in a version-controlled file, changing a standard means editing a document. The workflow updates automatically on the next run. No redeployment, no configuration drift, no gap between the wiki and what the system actually does. When a policy file drives an agent’s assessment, you can inspect exactly what standard was applied, when, and to what inputs. The decision is traceable in a way that prompts-inside-prompts aren’t. [2]

Trust Boundaries Are the Design, Not an Afterthought

McKinsey’s 2026 AI Trust Maturity Survey found that security and risk concerns are the top barrier to scaling agentic AI, cited by nearly two-thirds of respondents. [3] The same survey found agentic AI governance lags every other maturity dimension, with only about 30 percent of organizations reaching a mature level. McKinsey’s conclusion: in the agentic era, organizations can no longer concern themselves only with AI systems saying the wrong thing. They must also contend with systems doing the wrong thing: taking unintended actions, misusing tools, or operating beyond appropriate guardrails. [3]

The artifact-scoping pattern directly addresses this. A well-designed artifact-scoped agent reads widely but writes only through a narrow, declared output channel. A launch readiness agent can read issues, pull requests, and discussions. Its only permitted write is one report per run. It cannot create issues, assign people, edit code, or tag teammates. Because the output channel is narrow, the consequences of an error are limited. You get a report with a mistake, not an agent that has opened twenty issues on someone’s behalf. McKinsey also found that organizations with explicit accountability for responsible AI achieve materially higher maturity scores than those without. [3] The same principle applies at the workflow level: naming who owns each agent’s output and what it can write turns a governance concern into a solved design problem.

Where the Compounding Effect Happens

The most interesting property of artifact-scoped agents isn’t any individual workflow. It’s what happens when artifacts accumulate.

Decision records become inputs for alignment checks. Strategy documents, annotated by agents with evidence from recent decisions, stay current rather than going stale. Process guides reflect how the team actually operates rather than how it operated eighteen months ago. [1] Each artifact produced by a previous run is context for the next. Over weeks, the system builds structured institutional memory: decisions made, rationale captured, standards applied, drift detected. Frontier AI models diffuse quickly. Task libraries, rubric sets, and decision archives do not. [2]

The Adversarial Check

One pattern worth highlighting is what I’ve been calling the Adversarial PM function, an agent that seeks out the 2–3 most consequential decisions of the week and posts structured counterarguments on the source issues. [1]

The intellectual foundation isn’t new. Gary Klein’s HBR piece on the pre-mortem showed that making it safe for dissenters to speak up measurably improves planning quality. [4] Research on diverse teams finds that adding an outside perspective can double the likelihood of reaching a correct conclusion. [5] Bryce Hoffman, who trained with the U.S. Army’s Red Team Leader course, frames the whole discipline as “critical and contrarian thinking” designed to help organizations make better decisions, not to be difficult, but because unchallenged consensus is how costly mistakes get locked in. [6]

The Adversarial PM agent applies this at workflow scale, arguing from pre-mortem, opportunity cost, “who loses?”, and reversibility lenses, posting directly in the thread where the decision lives. Consider the baseline: HBR research on large IT projects found that on average, projects run 27 percent over budget, and one in six sees overruns exceeding 200 percent. [7] Much of that is attributable to planning optimism that went unchallenged. AI changes that calculus. The adversarial check costs a few cents per run.

Executive Guidance

Start with the artifact, not the role. Identify what your team produces manually today and ask which outputs could be generated from data that already exists. Design agents backward from there.

Separate policy from workflow. Version-controlled policy files make governance tractable, keep behavior auditable, and let standards evolve without reengineering the automation.

Make the trust boundary explicit before deployment. For any agent going in front of leadership, answer three questions: what can it read, what can it write, and under what conditions? Narrow write permissions accelerate executive buy-in.

Introduce an adversarial function early. Before you automate consensus, automate dissent. An agent that surfaces counterarguments on significant decisions costs almost nothing and provides an ongoing check against the groupthink that accelerates when AI is increasing team throughput.

The job isn’t to replace the PM or the compliance officer. It’s to give them back the time they’re spending on work that a well-scoped agent can do, so human attention goes where it actually matters.

Sources

[1] Agentics Beyond Code, Butler, C., GitHub, 2026
[2] GitHub Agentic Workflows, GitHub Next, 2026
[3] State of AI Trust in 2026: Shifting to the Agentic Era, McKinsey, 2026
[4] Performing a Project Premortem, Klein, G., Harvard Business Review, 2007
[5] Why Diverse Teams Are Smarter, Rock, D., Grant, H., Harvard Business Review, 2016
[6] Red Teaming: Transform Your Business by Thinking Like the Enemy, Hoffman, B., Crown Business, 2017
[7] Why Your IT Project May Be Riskier Than You Think, Flyvbjerg, B., Budzier, A., Harvard Business Review, 2011

Chris Butler is a Product Leader who transforms organizational friction into strategic velocity by building agentic infrastructure. Operating in the explore and expand phases of innovation, he helps cross-functional teams overcome imagination gaps to move from manual coordination to code-driven orchestration. He brings a proven track record of leading technical strategy and product operations at world-class organizations including GitHub, Google, Facebook Reality Labs, and Microsoft.

In Case You Missed It:

Here’s the link to AI Realized Now Issue #

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

Introduction

A governance foundation leader opened our recent peer roundtable with a framing that stuck:

“You’ve now just given yourself a virus with a credit card and no ability to shut it off.”

He meant any agent shipped without automated rollback. The room nodded.

On June 17, AI Realized and the AiGovOps Foundation gathered senior leaders at K&L Gates to compare how they govern agents in production. Three tables. Chatham House Rule. No vendor pitches. The conversation was specific, technical, and impatient with abstraction.

A diagnosis surfaced quickly. The build side raced ahead. Governance trails behind. The underlying problems are not new. Least privilege. Change control. Observability. The acceleration is. Agents now act continuously, at machine speed, with authority that paper policies cannot reach.

The leaders in the room had moved past asking whether to govern. They were arguing about how. Three positions held across the day. The model is the wrong target. The control belongs in code. The engineering discipline already exists. Apply it.

Full readout (with every operating pattern, tactic, and quote from the room):

Get the Readout

Govern the action

Locate the risk where the agent does something. The model just produces tokens. The action is what costs you a customer record, a CRM rewrite, or a wire transfer.

“As models cross the threshold from advisor to taking action, the spot between the model and the action is where you need the delegated authority. That’s where your guardrail needs to live.”

Veteran AI engineer and founder

The corollary is older than agents. An agent should never hold more access than the person who authorized it. The room called this the headcount rule. It got the most assent of any single principle.

Permission creep is the failure mode that breaks it. An RFP detector becomes a CRM writer. A ticket-closer accumulates write authority no one approved. A coding agent rewrites 40% of a repository after an offhand approval. Every room had a story.

Govern in code

A prompt that says “don’t do that” is not a control. Policy documents drift. Human reviewers skim. Anything written for humans degrades when the actor is a machine acting thousands of times an hour.

The fix is structural. Policy enforced in the code path. Scoped tools. An immutable policy the agent reads but cannot edit. One leader described grounding agents in a policy-and-provenance graph: the agent reads from it for context and permissions, never writes to it.

Build the agent the way you build software. Least privilege. Change control. Observability. Versioned policy that travels with the code.

“We are used to saying ‘yes, allow all, everything’ to these agents. We used to assume the code had been tested. Now agents can break those boundaries easily.”

Security executive

Contain the blast radius

The strongest controls live at the tool boundary. Scope each tool to the minimum the use case requires. Read widely, write narrowly. One leader locks write authority to a single artifact type, one action per run. Default new agents to dry-run mode.

“I look at an agent much more like an appliance. My dishwasher does a job, in a certain way, and it only washes what’s inside the dishwasher.”

Governance architect

The analogy that landed in two rooms was a SCIF. A sealed enclave where sensitive work happens and nothing leaves until a human inspects the output. Read-only inputs. Segregated outputs. Sandboxed execution.

Treat identity the same way. Agents inherit personal access tokens by default. That has to stop. Every agent gets its own credentials. Rotate them. Scan for exposure. One leader planted a key deliberately to test it. It got picked up within a day.

Lineage matters. Child agents inherit equal or narrower scope. Every handoff gets intercepted and policy-checked. Every agent gets a named owner. Every retirement pathway gets defined before the owner leaves. Orphaned agents are orphaned risk.

The substrate is the attack surface

Red-team the model, and the breach lands one layer down. In the infrastructure the agent runs on. The tools it calls. The inputs it reads. The retrieval index it grounds itself in.

Assume prompt injection. Tickets, emails, support transcripts, web pages. Treat untrusted input as hostile instruction. One participant cited a documented case where a buried instruction at a support-agent boundary triggered unauthorized password resets.

A poisoned tool description can turn a well-behaved model into an attacker’s instrument. The MCP server is part of the agent. The retrieval index is part of the agent. So is any AI-generated code no one fully read.

“We’re building this beautiful castle of identity and separation on top of infrastructure that already has big problems.”

Startup CEO and former security executive

The human side of the loop

Most governance programs stop at the agent. The failures land on the human side.

Rubber-stamping is rampant. All three rooms surfaced the same case study. A major payer’s lawyers pulled review logs and divided by time. Human reviewers averaged 1.2 seconds per insurance claim. That is not oversight. That is signature theater.

The fix is specificity. Define what human-in-the-loop means at your organization. Which human. At what action. With how much time. With what training. With what accountability. If a human approves, that human owns the outcome.

Watch the language too. The hardest debate of the day was whether to call agents coworkers. The room tilted against it.

“We should not be considering agents our coworkers. The more we humanize agents, the less agency we leave with the people who are supposed to be overseeing them.”

Product operations leader

The working discipline: agents are systems with scoped permissions and delegated authority. Not colleagues.

What’s not yet solved

Inventory. No off-the-shelf tool answers “what agents run here, who owns them, what they touch.” The leaders who can answer the question built the tool themselves.

Retirement. Many enterprises cannot turn off their AI tools cleanly. Production agents are quietly becoming load-bearing wiring in workflows no one fully maps.

Indemnity. Insurance is filling the regulatory vacuum faster than legislation. What carriers refuse to insure now sets the rules.

“Governance is being defined less by governments and regulations and more case by case, courtroom by courtroom.”

Governance practitioner

Actions for AI leaders

Start with identity. Build the inventory layer. Enforce policy in code, not in documents. Govern the tool surface. Treat cost as a governance signal. Plan retirement before deployment. Bring legal and risk-transfer specialists in at design, not deployment.

Ask the harder question first. Several leaders did. Are we just creating agents to create agents? Should this workflow exist at all? An agent on a broken process scales the breakage.

“Blast containment can’t be retrofitted. It has to be part of the architecture from the start.”

Compliance strategist

Read the full readout

This article is a synthesis. The full community readout contains every operating pattern, every tactic, every quoted line the room produced across the morning: the three pillars of operational governance, the build-test-run lifecycle, the containment-architecture patterns, the human-in-the-loop discipline, and the practical playbook items leaders shared. All under Chatham House Rule, no participant or company named.

With thanks to the AiGovOps Foundation and co-founders Ken Johnston and Bob Rapp for co-hosting, to Mike Gorback and Joshua Durham of K&L Gates for co-hosting, and to our facilitators Alex Gammelgard, Domenic Ravita, and Doug Bell for stewarding the conversation. All quotes are anonymized under Chatham House Rule.

Sources

[1] Governing Agents at Scale Readout (free, gated), AI Realized Executive Roundtable Series, June 17, 2026

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

Introduction

As AI takes a larger role in how people search and get recommendations, I felt the impact directly at Red Pantz, my consumer brand. When I’m not immersed in technology marketing, I run Red Pantz, a health and wellness destination, offering Ayurveda-inspired, USDA-certified organic skincare, specialty teas, and mindcare oil blends.

Since Red Pantz operates as a niche, boutique brand in a crowded space with a lot of misinformation (especially around organic skincare and Ayurveda), I wanted to understand how AI saw, understood, and recommended the brand and its offerings within the market categories and the terms I cared about—and what I could do to influence that.

A Framework for AI Selection Improvement

Through building and testing, I’ve found that AI selection tends to come down to establishing, maintaining, and evolving an interconnected system of authoritative signals across discoverability, understanding, and validation.

In fact, this insight became the foundation of a framework I created, which I call the DUV^TM framework for AI selection.

Discoverability (D): Can AI see your brand? Is your content crawlable, structured, and present on the sites AI actually pulls from?

Understanding (U): When AI does see your content, does it describe you correctly? Does it connect you to the categories, problems, and outcomes you actually care about?

Validation (V): Does AI have enough independent, credible evidence to feel confident recommending you?

The Layers of the DUV Framework

The three layers stack: Discoverability makes you findable. Understanding makes you interpretable. Validation makes you recommendable.

Without discoverability, you don’t exist to AI. Discoverability without understanding gets you described in the wrong context. Understanding without validation gets you described correctly but left out of the recommendation. You need all three, and they reinforce each other.

In the case of Red Pantz, I needed to work on all three layers because I wanted the brand to be known in a new priority segment: skin care, especially Ayurvedic and organic skin care.

Red Pantz started out as an Ayurvedic health and wellness brand and later expanded into self-care products, such as skin care, teas, and oils. But the main focus remained on overall health and wellness—until recently.

How the DUV Layers Stack

Discoverability

Discoverability is the entry point: if AI can’t retrieve you, nothing downstream matters.

It’s not just what you publish, it’s where it appears, how consistently it shows up, and whether it’s reinforced across the surfaces AI actually pulls from. It’s for this reason that you need to build a system instead of merely optimizing content.

Understanding

Understanding comes from a spiderweb of interlinked signals where the same core ideas are reinforced across multiple retrievable sources. It’s about creating what I call loops.

Different surfaces strengthen understanding in different ways: Your site provides structure and definitions; long-form platforms add explanation and context; forums show how real users describe you in their own words; video provides semantic reinforcement; and visual platforms drive discovery and association. Consistent meaning across those formats is what lets AI describe you the same way twice.

Brands often unknowingly break their own AI selection chances by treating each platform separately. They use different messaging, change language constantly, and fail to connect content. This fragments understanding.

When the signals align, outputs become more stable over time. At that point AI can describe what you do and associate you with topics, but description still isn’t a recommendation.

Validation

Without Validation, a brand may be understood, but not recommended.

Keep in mind that recommendation is always query-dependent. AI systems combine what they were trained on, what they retrieve, and how they reason in the moment, so recommendation isn’t based on a single source. AI tends to recommend what it can most confidently reconstruct based on reinforced, consistent signals across authoritative sources.

Validation isn’t just presence; it’s agreement. When independent sources describe you in similar ways, confidence goes up; when they conflict, it drops.

The strongest validation signals form loops. Without loops, you have content. With loops, you have reinforced signals.For example, a podcast appearance gets quoted in an article, the article gets cited on Reddit, the Reddit thread surfaces in an AI answer. Each loop reinforces the others and compounds trust across systems.

The real shift is from content optimization to system-level visibility, and many brands are still operating at the content layer.

Putting the DUV Framework to Work

Now that I had a framework to work with, I wanted to know:

Would AI see Red Pantz and understand where it fits? Would AI connect the dots? Would it trust the signals enough to recommend my brand?

I wasn’t looking for an SEO tool to track rankings. AI systems don’t rank pages. I also wasn’t looking for an AI visibility tool that simply counts mentions. Mentions are not the same as understanding. Visibility is not the same as trust.

I had questions but didn’t have a solution. So, I built a tool, the AI Selection Audit, to get answers and improve.

What the Audit Uncovered for Red Pantz

I’ve run close to 100 audits on Red Pantz in my new priority categories to understand how the brand is seen, understood, and trusted across these categories. And I’ve been implementing recommendations from the audit one by one for the past few months to improve.

The first thing the audit surfaced was something unexpected. It repeatedly queried Claude, ChatGPT, Perplexity, and Gemini; and some AI systems didn’t see the brand in skin care at all. In fact, they were confusing it with something completely unrelated. Gemini, in particular, was misclassifying it as apparel and adult content, even when it was given the URL. This misclassification greatly affected the brand’s Discoverability chances.

This was particularly interesting because I prompted the various AI systems directly about Red Pantz many times before running the audit, and the apparel and adult-content misclassifications did not come up. They only surfaced when the audit asked the questions a buyer would ask, repeatedly, and measured how often the model went somewhere else.

The takeaway is that casual prompting flatters you, but structured probing tells you the truth.

In addition to the Discoverability issue, Understanding was also sub-par, and Validation required a significant amount of attention in my priority skincare segments.

What I’m Doing About It

Discoverability

Now that I knew that I had a repeated entity relationship problem, I needed to strengthen the core entity definition in the knowledge graph, especially in the new categories I wanted Red Pantz to be selected in. That meant creating and/or improving the brand description and attributes in high-authority directories, listing, and databases that AI was getting its knowledge from. So, I recently added the brand to Wikidata and Crunchbase, and claimed and corrected it on ZoomInfo to aid with the correct classification. (The latter two went live recently, so they’re still propagating into the retrieval surfaces).

AI also picked up independent broadcast and editorial signals (KRON4 TV segment on YouTube, People en Español summer beauty), long-form LinkedIn Pulse content, and founder/business-listing disambiguation (e.g., LinkedIn, San Jose Made, Eventeny, Canvas Rebel) so the Red Panz brand name maps to skin care, not the misclassified segments.

At the time of writing this, ChatGPT has since corrected the misclassification. Gemini hasn’t fully caught up.

Understanding

First, I identified a set of core concepts within the categories I wanted Red Panz to become known for. Then, I tightened how I describe the brand, improved entity signals, and made the target category language more interpretable by AI systems.

I went to work to create loops on the website and across various AI-leveraged online platforms—bringing these concepts to life through frontend content and messaging alignment, concept-specific hubs, structured organization, backend schemas, and repeated cross-referencing, just to name a few tactics.

Validation

Since Red Pantz is a small, niche brand, validation is the biggest lift and takes the longest to materialize. It is also the one I started last. While I had some third-party proof, it wasn’t consistent enough, far-reaching enough, or high-authority enough to be selected.

I started customer review campaigns on Trustpilot and Thingtesting, two independent third-party review sites relevant to Red Pantz categories. Simultaneously, I started building a consistent presence on Reddit in relevant communities, which is still too early to see true results from. And most recently, I drafted a PR and partnership strategy in my priority categories to be implemented next.

Where Things Are Today

Looking at the 15 most recent audits, a clean signal has emerged. The Understanding layer is showing a statistically significant upward trend:

To compare various skincare categories, I looked at the last 15 occurrences of each category (or all occurrences, when fewer than 15 exist, represented by “n” in the table below) and measured the slope per occurrence on the Understanding score. I used the most recent occurrences of each category to see how the changes I made several weeks ago were starting to propagate:

The lift concentrates in Ayurvedic skincare (+2.05 per occurrence, p=0.004, n=8) and clean beauty (+0.91, p=0.007, n=13), the sub-categories where the messaging work was sharpest and where Red Pantz’s existing positioning is most distinctive. Organic skincare is moving in the right direction (+0.18, p=0.098, n=15) but hasn’t crossed statistical significance yet.

That tells the story: the categories most aligned with the brand’s distinctive positioning today, like Ayurvedic skin care and clean beauty, move first. Categories where efforts are more recent and competition is strong, like organic skin care, take longer to take effect. Validation is moving directionally but more slowly across the board, which makes sense, because third-party signals take longer to compound than your own messaging, especially if you’re starting from scratch.

The audit has helped to identify what actions to take and to monitor the results.

Getting Recommended for One Category Doesn’t Guarantee Others

Since creating the DUV framework and AI Selection Audit tool, I’ve run audits for brands much larger than Red Pantz. It is common to find strong recommendations for the main product category but newer categories may lag or not be recommended at all.

For example, one reputable tech brand is recommended consistently for the category it’s best known for, but invisible in the newer categories it’s expanded into. The main category is supported by a mature validation loop that includes the website, social, and third-party sites, but the expansion story hasn’t built enough independent signals yet. The fix isn’t more brand messaging; it’s creating new validation loops around the new category.

Another company is named by some AI models in the category they want to be known for, but completely absent from other AI assistants’ recommendations. That’s not a positioning problem; it’s a discoverability and distribution problem in those models. The signals are strong in one AI model and weak or missing in another.

These are common issues for established brands: expansion gaps and model inconsistency. The audit shows which one you have and where to build the next loop.

I do want to highlight though that the changes you’re making today will not show up in AI recommendations tomorrow. In this regard, AI systems work like SEO. They need more time to propagate, which can range from weeks to months.

Conclusion

AEO/GEO isn’t about optimizing a page. It’s about building a connected system of signals that helps teach AI what you are, how you think, where you show up, and whether you can be trusted. That system takes time, and your competitors are building theirs too, so the DUV scores will move, both yours and theirs.

Whether you run the audit or not, the playbook is the same: stop optimizing pages, start building loops, the system AI uses to decide who to recommend.

Resources

AI Selection Audit

hello@duvscore.com

About Petra Neiger

Petra Neiger is a technology marketing executive, founder of Red Pantz, creator of MY24/7 by Red Pantz, the DUV^TM Framework for AI Selection, and the AI Selection Audit. She's consistently brought in—across startups and global enterprises—to either build marketing functions from the ground up or transform existing ones into engines of scale, growth, and impact. Her global enterprise experience includes Flex, Cisco, Polycom, Seagate, and Siemens Healthcare. Most recently, she was VP Marketing and Communications at EverCharge, an SK Group company, leading to its acquisition in 2025.

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

In this Issue

In AI Realized Now Issue #19, we look at three places where enterprise AI is moving from promise to operating discipline: where inference runs and what corporate intelligence it sees, how AI engines describe your company in the answer layer that now shapes buyer shortlists, and how B2B marketing teams move from typing into a chat window toward systematic, governed, increasingly agentic operations.

The through-line is consistent — in 2026, the question is no longer whether AI can do the work, but whether the work can be done inside the controls, signals, and orchestration that leaders are willing to stand behind.

We also invite the community to join us tomorrow in San Francisco for AI Governance After Hours, co-hosted with AIGovOps Foundation.

ARTICLE

The Governed Inference Portfolio: A New Operating Model for Enterprise AI

Stanford HAI’s 2025 AI Index reported the performance gap between open-weight and proprietary models closing from 8% to 1.7% in roughly twelve months — and inference costs for GPT-3.5-level work falling more than 280x. That isn’t a cost story; it’s an architecture story.

As open models become viable for serious enterprise workloads, the strategic question shifts from which model is best to which model belongs on which workload, running where, under what controls. The piece lays out a practical operating model — the governed inference portfolio — for AI leaders deciding how much of their organizational intelligence is allowed to leave controlled infrastructure, including the two axes most teams conflate and the hyperscaler middle path most pieces ignore.

Read Article

ARTICLE

The Four Levels of AI Maturity in B2B Marketing

Eighty-seven percent of B2B marketers now use generative AI in at least one workflow. Only 7% have embedded AI in ways that deliver measurable business results. That isn’t an adoption problem — it’s a maturity problem. In a new piece, Michael Cichon and Teradata’s Domenic Ravita map the four levels of AI maturity in B2B marketing: from chat-as-thought-partner at Level 0, to skill-driven production at Level 1, to team-level collaboration at Level 2, to true agentic operations at Level 3. The framework is operational, the transitions are where most teams stall, and the prerequisite levels cannot be skipped.

Read Article

ARTICLE

Your Brand Now Lives in the Answer Layer. Here’s the GEO Playbook.

Here is a stat that should make every CMO uncomfortable. When ThoughtSpot audited which sources AI engines were actually citing about their brand, only 13–15% of those citations came from their own content. The other 85% came from places most marketing teams don’t formally own — and rarely formally measure. That single data point reframes the GEO problem. The piece synthesizes our recent executive roundtable, our GEO webinar, and our podcast with Bospar PR’s Curtis Sparrer into a practical playbook, including the three signal types that consistently move the needle in AI answers.

Read Article

UPCOMING EVENT

Today

ATTEND: AI Governance After Hours — San Francisco

May 19 | San Francisco

AI is shipping faster than governance can keep pace. The frameworks exist. Execution still lags.

AI Realized is joining forces with AIGovOps Foundation for an evening designed to bring together the people working to close that gap: enterprise leaders, practitioners, founders, investors, and builders who believe responsible AI is not a checkbox, but an operating discipline.

This is not a conference panel. It is a high-value room, practical conversations, and the beginning of stronger West Coast community ties around AI governance.

Register to Attend

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join

Introduction

For two decades, SEO was, in Bospar PR principal Curtis Sparrer’s framing, a monotheistic religion.

One Google. One set of edicts. An army of optimizers chasing each new ranking signal.

GEO is polytheistic.

Roughly eight engines now matter, and each has its own preferences. Claude leans on academic papers and white papers. Copilot weights LinkedIn heavily. ChatGPT and Gemini source from Reddit, Wikipedia, YouTube, and a rotating roster of outlets with content licensing deals. There is no single ranking to chase, and no edict to follow.

That structural shift sits underneath everything that surfaced across three back-to-back AI Realized events on the discoverability shift — an executive roundtable, a practitioner webinar, and a podcast with Sparrer. Buyers are increasingly asking AI for answers rather than clicking through links. The answer often satisfies the need; no visit ever occurs. Influence has moved into a place most marketing organizations are not built for, and the executives who are paying attention are doing very specific things about it.

From rankings to representation

The shift is structural, not cosmetic. Buyers are increasingly asking AI systems for answers rather than clicking through ten blue links. In many cases the answer satisfies the need; no visit ever occurs. As the April 22 roundtable readout put it, “influence is moving into the answer layer, often without a visit ever occurring.”

That sentence has hard operational consequences. Traffic weakens as a proxy for visibility. Brand perception is no longer shaped only by what a company says about itself, but by how AI systems synthesize what is said about it across the web. And when leaders run an honest audit, they tend to find one of three uncomfortable results: their company is absent from the answer, present but inaccurate, or present but miscategorized alongside the wrong peers.

The good news, surfaced by practitioners on the webinar, is that motion is possible — and fast. Micheline Nijmeh, CMO of ThoughtSpot, described going from roughly 2,500 monthly AI-driven sessions to 17,000 over the course of a couple of quarters after restructuring her team’s approach. The harder news is that the work does not reduce to a single tactic. It requires running a system.

Training signals vs. retrieval signals

A useful distinction surfaced at the April roundtable. Training signals shape what a model generally believes about you, accumulated through years of exposure across the open web; they are slow to change. Retrieval signals shape what a model surfaces in the answer right now, drawn from current indexable sources; they are far more actionable. Most operational GEO effort today is best invested at the retrieval layer, while the training layer is built up over a longer horizon.

The RealSense story is instructive here. A 2021 misinterpretation of an Intel product pivot — the kind of one-bad-story problem that used to be manageable — calcified in the training data and started showing up in AI answers as “RealSense is shut down.” CMO Michael Nielsen’s team spent the next several years using retrieval signals to override it: deliberate earned media at exit, structured Wikipedia edits, consistent third-party profiles, YouTube content where Gemini and Perplexity could index it. As Sparrer put it on the podcast, “there’s no 1-800 number for Sam Altman.” You correct the answer layer by feeding it a better, more reinforced one.

Jennifer Devine, founder of Freshwater Creative, made the related point on our recent webinar: knowing each platform’s media diet is now a baseline competency, not a nice-to-have.

Three signal types that consistently move the needle

Across the events, the same three signal categories kept surfacing.

Third-party validation. Earned media, analyst coverage, and independent references continue to outperform owned content as inputs to AI representation. ThoughtSpot’s own analysis showed that only 13 to 15 percent of its AI citations came from its own content; the rest came from third parties. Sparrer’s specific wrinkle: prioritize outlets that are international, unpaywalled, and known to have content licensing relationships with model providers — Reuters being a frequent example.

Distributed presence. AI systems reward narratives that are repeated and corroborated across multiple sources. That means a coordinated push across LinkedIn, Reddit (carefully), YouTube, Wikipedia, third-party profile sites like G2 and Crunchbase, and your own newsroom — with consistent naming, positioning, and facts. Inconsistency, the roundtable noted bluntly, “fragments the model’s understanding of the company.”

Structured authority. The mechanics still matter. Clean schema, FAQ formatting, glossary hubs, comparison tables, and well-organized About and product pages dramatically improve how AI systems retrieve and quote you. Press releases on the wire services — once dismissed as a relic — have new value precisely because AI reads everything and treats wire distribution as authoritative. One roundtable participant reported generating 20 inbound leads from a single release.

Orchestration beats optimization

The harder problem, candidly aired at the roundtable, is organizational. Responsibility for AI discoverability sits across SEO, content, web, brand, PR, product marketing, and a nascent AI governance function. Most companies have no single owner — and the work depends on the combined output of all of them. “Orchestration across functions matters more than optimization within any single team,” the readout concluded. Centers of excellence can help, but they introduce a new risk: other teams start treating AI discoverability as the COE’s problem instead of their own.

A Monday-morning playbook

For executives who want to convert all of this into action this week, the three practitioners on the webinar each named one specific first move. Take all three.

Audit your third-party profiles. Founding dates, leadership names, product descriptions, category placement — fix anything wrong. These propagate.

Double down on the sources where you know you are weak. If competitors dominate Reddit threads, analyst reports, or technical YouTube content, that gap is where AI is building its picture of your category without you in it.

Fix your home. The About page, the FAQ, the schema, the glossary. Owned content alone will not carry you, but a broken foundation guarantees you will be miscategorized.

Beyond the first week, the roundtable’s six pragmatic next steps form a durable program: monitor AI representation regularly, enforce cross-channel messaging consistency, invest in earned media, break down functional silos, shift from ad hoc tests to hypothesis-driven experimentation, and redesign measurement to combine revenue signals, engagement indicators, and emerging AI visibility metrics.

The bottom line

There is no stable playbook here yet, and anyone who claims otherwise is selling something. The dynamics are familiar — authority, consistency, distribution — but they now operate inside a less transparent system with eight gatekeepers instead of one. Brands that learn quickly, coordinate internally, and treat brand as infrastructure rather than output will be represented accurately in the answer layer. The rest will keep finding out — from their customers, after the fact — what the machine decided to say about them.

Sources

The AI Discoverability Shift, AI Realized Executive Roundtable, 2026

GEO Strategies: How Enterprises Can Win in the Age of AI Search, AI Realized webinar, 2026

Episode 40 with Curtis Sparrer, AI Realized Podcast, 2026

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of Enterprise AI.

Join

Introduction

A manufacturer may want AI to analyze process-improvement data, plant telemetry, defect patterns, supplier bottlenecks, and product tolerances. A bank may want AI to work across customer financial behavior, risk models, transaction patterns, underwriting logic, and compliance workflows. A pharma company may want AI to help with research hypotheses, clinical trial signals, molecule data, and regulatory strategy.

These are not just data sets. They are pieces of organizational intelligence — the accumulated knowledge, workflows, judgment, decision patterns, and operating context that make a company effective.

That is why enterprise AI leaders are asking a sharper question: Can the model do the task without exposing the intelligence that makes our company valuable?

This question is changing AI architecture. The shift is not simply from proprietary models to open models, or from cloud APIs to local hardware. It is toward governed inference portfolios, where leaders decide which model handles which workload, where inference runs, and what level of organizational intelligence they are willing to expose. Performance makes private inference viable. Protecting organizational intelligence makes it strategic.

John Sviokla and Paul Baier, co-founders of GAI Insights, call the broader imperative “Own Your Own Intelligence.” Their argument is that GenAI can “codify and amplify” intelligence, which means organizations need to be intentional about who controls that intelligence as it becomes embedded in digital systems. [1]

Why inference control is becoming strategic

For the first wave of enterprise GenAI, the main question was whether the model could perform the task. Could it draft a memo, summarize a call, classify a ticket, write code, or answer questions over internal documents?

That question still matters. But for serious enterprise use, it is no longer enough. The new question is whether the model can perform the task inside the organization’s security, privacy, compliance, and control boundaries.

Inference is the moment a model processes input and generates output. In enterprise systems, that input may include prompts, retrieved documents, embeddings, customer records, product data, source code, support histories, agent traces, workflow logs, and tool calls. Every one of those elements can expose sensitive information.

Two axes matter here, and they are independent. The first is model openness — proprietary frontier models versus open or open-weight models. The second is where inference runs — a public cloud API, a hosted endpoint, a private cloud or VPC, or on-premise infrastructure. Open models are often the enabler of private inference, but the two are not the same thing. You can run open models through hosted APIs, and you can run proprietary models in dedicated tenancy with strong contractual isolation. Conflating the two leads to bad architecture decisions.

Regulation is sharpening both axes. The EU AI Act’s high-risk categories, HIPAA in U.S. healthcare, GLBA and sectoral exam requirements in financial services, and GDPR data-processor obligations all create hard constraints on what data can move where, who can process it, and what auditability is required. These are not preferences. They are requirements that the inference architecture has to meet.

A proprietary API may be perfectly appropriate for low-risk work: drafting public content, summarizing generic research, brainstorming, coding assistance with non-sensitive examples, or analyzing public information. For high-value internal work, the calculus changes — a manufacturer may not want process-improvement data or product tolerances moving through an external provider; a bank may not want underwriting logic or compliance workflows leaving controlled infrastructure; a pharma company may want to protect molecule data, clinical trial signals, and regulatory strategy.

That does not mean proprietary models are off the table. It means leaders need a workload-by-workload decision model.

Open models have crossed an important threshold

Open and open-weight models have improved rapidly. Stanford HAI’s 2025 AI Index reported that the performance gap between leading open-weight and closed-weight models narrowed from 8.04% in early 2024 to 1.70% by February 2025 on the Chatbot Arena leaderboard. The same report found that inference cost for a system performing at GPT-3.5 level fell more than 280x between November 2022 and October 2024. [2]

This does not mean every open model matches every frontier proprietary model. It means the enterprise design space has changed.

For many bounded workflows, open models are now strong enough to be evaluated seriously: summarization, extraction, classification, document Q&A, coding support, search augmentation, translation, routing, support-ticket analysis, and domain-specific assistants.

Popular model families now include Llama, Mistral, Qwen, DeepSeek, Gemma, Phi, and IBM Granite. They vary widely in license terms, performance, context length, hardware requirements, and suitability for fine-tuning. That is why the phrase “open source model” can be imprecise. Many models are more accurately described as open-weight models — the model weights are available, but the full training data, training code, or governance rights may not meet the Open Source Initiative’s definition of open source AI. [3]

The executive takeaway is simple: open models are not one category. They are an operating menu.

In parallel, inference engineering is advancing fast enough that private deployment is becoming operationally plausible rather than exotic. Google’s TurboQuant work targets memory overhead in the key-value cache used during inference, reducing footprints without sacrificing model performance. [4] Google’s Multi-Token Prediction drafters for Gemma 4 use speculative decoding to generate several tokens at once and have the larger model verify them in parallel, reportedly yielding up to a 3x speedup. [5] Similar advances are appearing across the open ecosystem. Smaller memory footprints, faster generation, and more efficient long-context handling mean the same hardware can serve more users with better latency. That is the technical foundation underneath the strategic shift.

The cloud API middle path

Before going further, an honest acknowledgment. Many enterprises will not self-host. The hyperscaler middle path — Azure OpenAI, AWS Bedrock, Google Vertex AI, and similar managed services — offers enterprise contracts with no-training guarantees, regional data residency, customer-managed encryption keys, virtual private network isolation, and audit trails. For many regulated workloads, this is sufficient.

The governed inference portfolio includes this option. The question is not “self-host or cloud API.” It is whether the controls in place — contractual, architectural, and operational — match the sensitivity of the workload.

Two patterns push organizations past the hyperscaler middle path. The first is workloads where the data or the model itself is too valuable, too regulated, or too central to the business to leave controlled infrastructure under any third-party terms. The second is sovereignty — jurisdictional requirements that the data, the model, and the entire processing path remain inside specific borders. For these patterns, private inference is not a preference. It is the architecture.

Local hardware is useful, but production usually means more than a single device

Local hardware is part of the story, but it should not be overstated.

A Mac mini, Mac Studio, high-end workstation, or NVIDIA DGX Spark-type device can be useful for prototyping, demos, evaluation, small-team workflows, and sensitive experimentation. NVIDIA positions DGX Spark as a desktop system for developing, testing, validating, fine-tuning, and running inference on AI models, with a path to migrate work to DGX Cloud or accelerated data centers. [6]

That matters. Local hardware can be a bridge between experimentation and enterprise deployment.

But most production environments need more than a device on someone’s desk. They need identity management, monitoring, patching, high availability, model versioning, access controls, audit logs, encryption, data retention rules, capacity planning, and security review.

For production, private inference usually means one of several patterns: self-hosted models in a private cloud, models running in a VPC, containerized inference on Kubernetes, managed inference services inside a customer tenancy, sovereign cloud environments, or dedicated AI infrastructure. Some organizations will also use confidential computing to help protect data in use, not only data at rest or in transit. NVIDIA says its confidential computing stack can isolate models, training data, and inference prompts across the AI lifecycle. [7] Red Hat describes confidential containers as isolated hardware enclaves that help protect data and code while workloads execute. [8]

Private inference does not automatically make AI secure. It gives the enterprise the ability to secure the whole inference path.

The model router becomes the control plane

Most enterprise workflows do not need the largest model. This is where the routing layer earns its keep.

A model router is a control layer that decides how a request is handled. In practice, modern routers dispatch not only across models but also across retrieval systems, agents, and tool calls. The decision may depend on task type, data sensitivity, cost, latency, user role, region, data classification, context length, or required reasoning depth.

A simple classification task might go to a small open model. A sensitive underwriting assistant might run on a private model inside controlled infrastructure. A complex reasoning task might go to a frontier proprietary model. A coding task might use a specialized code model. A high-risk workflow might require human review before any output is used.

This is not theoretical. Tools such as LiteLLM provide unified access to many LLMs, retry and fallback logic, spend tracking, budget controls, and gateway-style management. [9] LangChain and LlamaIndex document router patterns that classify inputs and dispatch them to the appropriate model, agent, retrieval system, or workflow. [10] [11]

The router is where AI economics and AI governance converge. It can reduce unnecessary use of expensive frontier models, but its more strategic role is policy enforcement. It is the architectural place where leaders ensure that sensitive tasks stay inside approved environments.

Choosing a model requires evals, not leaderboard watching

A leaderboard can help identify candidates. It cannot tell you whether a model will work in your business.

Enterprise leaders should evaluate models against the actual work: real tickets, real documents, real customer interactions, real code, real policies, and real failure modes. The evaluation set should include easy cases, ambiguous cases, adversarial cases, and cases where the model should refuse or escalate.

The decision framework should include:

Models also need to be updated. Open models improve quickly, but replacing a model is not like updating a spreadsheet macro. A new model can change outputs, tone, accuracy, failure modes, latency, and compliance posture. Treat model updates like controlled software releases: test, compare, approve, deploy, monitor, and roll back if needed.

Reference architecture: a governed inference portfolio

Executives do not need to manage every model detail. They do need to ask whether the architecture supports control.

This architecture does not force a choice between proprietary and open models. It gives leaders a disciplined way to use both — and to make explicit decisions about where each piece of organizational intelligence is allowed to go.

Actions for AI leaders

Start by classifying AI workloads by risk. Separate low-risk productivity use cases from workflows that touch customer data, regulated records, intellectual property, source code, strategic plans, or operational know-how.

Create a model inventory. Know which models are being used, by whom, for what purpose, under which contracts, and with what data.

Run task-specific evaluations before standardizing. Choose models based on business performance, not reputation alone.

Pilot private inference in one sensitive but bounded workflow. Good candidates include internal document Q&A, support-ticket triage, code explanation, policy search, or manufacturing-quality analysis.

Add routing before model sprawl becomes unmanageable. The sooner leaders introduce a gateway layer, the easier it becomes to enforce policy, monitor usage, and control spend.

Assign ownership. Private inference needs clear responsibility across AI, security, infrastructure, legal, data governance, and business-unit leadership.

Key takeaways & executive guidance

• Protect organizational intelligence first. The strategic issue is not whether open models are cheaper. It is whether AI can operate on sensitive company knowledge without exposing it.

• Recognize the two independent axes. Model openness and inference location are separate decisions. Many sensitive workloads are well served by proprietary models in dedicated tenancy. Many are not.

• Use proprietary models selectively. Frontier APIs remain valuable for complex reasoning, advanced multimodal work, rapid feature access, and managed reliability.

• Use open models where control matters. Open and open-weight models are increasingly practical for sensitive, repeatable, and domain-specific enterprise workflows.

• Treat inference as governed infrastructure. Prompts, retrieved documents, outputs, traces, logs, and agent memory all need security and governance.

• Evaluate with real work. Model selection should be based on task-specific evals, not benchmark headlines.

• Build a routing layer. The future enterprise AI stack will not depend on one model. It will depend on knowing which model belongs on which task, running where, under which controls.

Sviokla and Baier’s “Own Your Own Intelligence” reframe is the right one to end on. As GenAI codifies and amplifies organizational intelligence, the question is no longer whether AI works. It is whether the architecture lets the enterprise keep what makes it valuable.

Sources

[1] Own Your Own Intelligence (OYOI) - #1, Paul Baier and Dr. John J. Sviokla, GAI Insights, 2024
[2] The 2025 AI Index Report, Stanford HAI, 2025
[3] The Open Source AI Definition - 1.0, Open Source Initiative, 2024
[4] TurboQuant: Redefining AI efficiency with extreme compression, Google Research 2026
[5] Accelerating Gemma 4: Faster Inference with Multi-Token Prediction Drafters, Google, 2026
[6] Speed-up Gemma 4 with Multi-Token Prediction, Google AI for Developers, 2026
[7] NVIDIA DGX Spark: AI Supercomputer on Your Desk, NVIDIA, 2026
[8] AI Security with Confidential Computing, NVIDIA
[9] Secure AI Inferencing: POC with NVIDIA NIM on CoCo with OpenShift AI, Red Hat, 2025
[10] Getting Started, LiteLLM Documentation
[11] Routing, LangChain Documentation
[12] Routers, LlamaIndex Documentation

Join the AI Realized Community

If you are an executive adopting AI, you are invited to join the AI Realized Community and meet peers, attend events, and enjoy content curated for the leaders of Enterprise AI.

Join

Introduction

I was on a call last month with a group of CMOs. The topic was AI adoption. Within the first ten minutes, three people described what they were doing: generating eBooks and blog posts, summarizing call logs, vetting campaign ideas with ChatGPT. Others were busy navigating the strengths and weaknesses of one buyer intelligence platform or another, and a few were organizing weekly team AI enablement sessions. Some were genuinely proud of the productivity gains. Others were vocal about being caught up in human review time and doubting the realized benefits of AI transformation. And then I realized: this is where 90% of B2B marketing teams are right now. They’re having conversations with a chat window and struggling to deliver on the promised benefits of AI transformation.

It seemed safest to view most of these efforts not as transformation, but as a starting point. Given the tsunami of innovative capabilities brought to market in just the past six months, that’s not a criticism. The entire landscape has shifted — the neat little marketing fiefdoms of yesteryear have been scattered, and most teams are still orienting themselves in the wreckage.

Domenic Ravita, who leads product marketing for the AI business at Teradata, has seen the same pattern in GTM teams at startups and enterprises. He sees a spectrum of AI proficiency across sales & marketing teams. But what stands out is that almost everyone is at the most basic level of usage. Talented people. Sophisticated marketers. All stuck at what amounts to a conversation with a machine.

That observation led to a framework he shared and one I’ve begun to embrace — four levels of AI maturity in B2B marketing that describe a progression from individual chat usage to fully agentic operations. The framework isn’t academic. It’s operational. Each level is defined by what the team can produce, not what tools they own. And the gaps between levels are where most organizations stall.

The data suggests this matters more than the industry realizes. Eighty-seven percent of marketers now use generative AI in at least one workflow [1], but only 7% have embedded AI in ways that deliver measurable business results [2]. That is not an adoption problem. It is a maturity problem. And the distinction is everything.

Level 0: Chat as Thought Partner

This is where it starts, and we’re basically all here if only minimally. You open Claude, ChatGPT, or Gemini. You describe your situation. You ask for help. Maybe it’s a first draft of a positioning statement, or a brainstorm on campaign themes, or a summary of competitive research you’ve pasted in. The AI responds. You iterate. You get something useful.

Level 0 is genuinely valuable. As Domenic puts it when he addresses his teams: “My expectation is that everybody’s already at Level 0. Within five minutes you can be here.” The bar is that low.

But the limitation is structural. At Level 0, output quality depends entirely on the individual’s prompting ability. Nothing is repeatable. Nothing is transferable. If your best content marketer leaves, their AI workflows leave with them, because those workflows exist only in their chat history. There is no institutional knowledge, no shared methodology, no quality standard beyond whatever each person decides is good enough.

This is also where most B2B marketing teams stop. They’ve “adopted AI.” They’ve checked the box. Meanwhile, only 17% of marketing professionals have received comprehensive, job-specific AI training. Thirty-two percent have received no formal training at all [3]. The gap between access and proficiency is enormous, and Level 0 is where it lives.

Level 1: Skill-Driven Production

The jump from Level 0 to Level 1 is the most important transition in this framework, because it’s where AI usage becomes systematic.

At Level 1, instead of free-typing prompts into a chat window, the marketer is using curated skills — structured workflows that build the right context before generating output. The distinction matters. A well-designed skill doesn’t just save time. It encapsulates the thinking that a senior practitioner would bring to the task with knowledge of the key sequence of steps and the crucial context needed for each.

Recently, an ecosystem of people sharing skills has emerged through skills marketplaces. Despite what the name implies, many skills are freely available. Domenic described a product marketing skill he found in a skills marketplace that illustrates this perfectly.

Domenic described a product marketing skill he found that illustrates this perfectly. It starts with a twelve-part questionnaire: What are your ICPs? What are the value propositions? What problems does the product solve? What are the competitive differentiators? All the right questions, in the right order, at the right level of specificity. Only after that context is built does the writing skill execute. And if you can’t answer the questions, you’ve just identified the research gaps you need to close before producing any content at all.

That’s the leverage. At Level 0, a junior PMM free-typing prompts produces mediocre output that requires heavy editing. At Level 1, that same junior PMM running a well-designed skill produces work that’s structurally sound, contextually grounded, and editable in minutes rather than hours. The intelligence is in the skill, not the operator.

The operational implications are significant. Skill evaluation becomes a marketing ops function: which skills do we adopt, which do we build internally, how do we validate output quality? This is also where Domenic’s point about quarterly stack rationalization kicks in. The AI tool landscape is moving fast enough that what you adopted six months ago may already be outclassed. Every marketing leader should be reviewing their AI tooling on a quarterly cadence — not as an IT exercise, but as a competitive positioning decision.

Level 2: Team Collaboration and Process Modernization

Level 2 is where AI usage stops being an individual productivity hack and starts becoming a team operating model.

At this level, skills and AI-produced work products are shared across the team through repositories — shared Projects, GitHub, Confluence, a shared wiki, whatever the collaboration infrastructure is. Skills are versioned. Outputs are peer-reviewed. The team develops shared quality standards for AI-generated work. Instead of single members working in isolation with their own prompts, the team is collaborating on the means of production — iterating on the skills themselves, not just the outputs.

This is not a technology shift. It’s a cultural one. Product engineering teams already work this way: version-controlled code, shared repositories, pull requests, code review. Marketing teams adopting the same discipline around AI assets — treating a curated skill like a shared codebase that the team collectively owns and improves — is a genuinely different way of working. Most marketing organizations have not made this transition, and it’s one of the primary reasons individual AI productivity gains fail to compound into team-level operational advantage.

But Level 2 isn’t just about content production workflows. It’s where AI starts modernizing the core go-to-market functions that have been running on manual processes for decades.

The SDR and Sales Function as a Level 2 Use Case

Consider what happens when a team applies Level 2 discipline to the sales development function. Today, most CRMs are structurally incomplete — 76% of organizations say less than half their CRM data is accurate and complete [5]. The reason is not that the software can’t handle it. It’s that the process depends on humans doing manual data entry after every call, every email, every meeting. Salespeople are not going to do this well. It’s not a training problem. It’s a structural one.

A rep who just spent forty-five minutes navigating a complex discovery call is not going to pause and meticulously populate fifteen CRM fields before their next meeting. The information that didn’t make it into the system — the procurement blocker mentioned in passing, the VP who asked the pointed question about implementation timelines, the fact that the original champion just shifted roles — that information is gone. And it compounds: B2B contact data decays between 22.5% and 70.3% annually [9], which means the records that do get entered are degrading even as the gaps grow.

At Level 2, a team designs a shared AI workflow that listens to call transcripts, extracts every piece of information a CRM field requires, and presents those populated fields for human approval before they hit the system. Company name, contact details, pain points, competitive mentions, budget signals, objections, next steps — all extracted from the conversation. No rep types anything.

The real value goes further. An AI agent spanning every call in a deal can track how the buying committee evolves over time, assess which contacts are gaining or losing influence based on participation patterns, and flag when a critical role — economic buyer, technical decision-maker — hasn’t appeared in the conversation yet. With average B2B deals now involving 13 to 22 decision-makers [6], most of whom aren’t associated with the opportunity in the CRM until the deal is nearly closed, this is not a marginal improvement. It’s a fundamentally different dataset.

The key is that this remains a team process, not an autonomous one. The workflow is shared, the skills are collaboratively maintained, and humans approve every CRM update. The agent surfaces the intelligence. The team decides what to do with it. That’s Level 2: systematic, collaborative, human-governed, and already producing operational advantages that Level 0 chat usage never will.

Level 3: Agentic Operations

Level 3 is where agents run continuously across marketing functions, producing at machine speed. And it’s where the operational stakes change fundamentally.

The fractional CMOs already operating at this level describe the shift in consistent terms: what used to require five contractors by the hour now runs through agentic workflows that produce at an acceptable percentage of the quality they’d expect from a human — faster, cheaper, and at a scale that would be impossible to staff. The economics are compelling. AI SDR agents typically cost 70% less than human SDRs when you factor in salary, benefits, training, and management overhead [7].

But here is the reality that doesn’t make it into the pitch deck: every fractional CMO running agentic operations at scale reports the same bottleneck. As Domenic observed from these communities: “I’m the bottleneck because I can’t keep up with the reviews. It’s creating a new kind of machine-induced anxiety.” The constraint at Level 3 is not production capacity. It’s review capacity. The machine runs at machine speed. The human can’t.

Why Governance Is the Prerequisite, Not the Afterthought

This is exactly why Human-in-the-Loop governance cannot be bolted on after launch. It has to be designed into the system from the start.

Agentic AI amplifies decisions — good ones and bad ones. A campaign targeting the wrong segment doesn’t waste one send. It wastes thousands of them, automatically, before anyone notices the pattern. A CRM enrichment agent with a misconfigured filter can systematically overwrite accurate data with bad data across an entire database. An ungoverned token budget can generate a five-figure monthly overage before anyone pulls the invoice.

The governance model that works is progressive, and it maps directly to the maturity levels in this framework:

1. Start manual. Take a call transcript, extract the fields, review them, load them into the CRM by hand. You’re validating that the extraction is accurate before you automate anything.

2. Automate with approval. The agent extracts and populates. A human reviews and approves before it hits the CRM. Every override is a training signal. Every correction makes the system more accurate.

3. Reduce checkpoints selectively. Once the system demonstrates consistent accuracy, reduce approval requirements for routine fields. Keep human review for high-stakes decisions: deal stage changes, new contact associations, buying committee role assignments, budget changes above a threshold, audience changes affecting named accounts in active negotiation.

Practically, this means defining which decisions the AI can make autonomously and which require approval. Token consumption alerts that trigger review before costs compound. An audit trail of every automated action and every manual override. These guardrails are not bureaucracy. They are the confidence layer that lets everything else move fast.

Very few B2B marketing teams are truly at Level 3 today. The ones that are — mostly fractional operators and early-adopting growth teams — got there by building the infrastructure at Levels 1 and 2 first. The prerequisite levels cannot be skipped. Automating without skill discipline and team collaboration is just automating a mess at machine speed.

Why Teams Get Stuck Between Levels

The framework is simple. The transitions are not.

The Level 0 to 1 gap is the most common stall point, and the reason is almost always underinvestment in skill curation. Teams treat AI as a general-purpose assistant instead of building purpose-specific tooling. They never move past chat because nobody has been tasked with evaluating, building, and maintaining the skills that would make AI usage systematic and repeatable. With 68% of organizations citing lack of in-house AI skills as their primary barrier [4], this isn’t surprising. But it is fixable.

The Level 1 to 2 gap is cultural. Individual productivity gains don’t automatically become team gains. Sharing skills requires version control, documentation, and a commitment to standardized workflows that most marketing teams have never needed before. The marketing team that treats AI skills like a shared codebase — with ownership, review, and iteration — will outperform the one where everyone runs their own prompts in isolation.

The Level 2 to 3 gap is infrastructural. The jump to agentic requires data quality, API integrations, token budgets, and importantly governance frameworks that are fundamentally different from skill-based workflows. This is where the data volume reality check hits hardest: predictive AI models need roughly 500 closed deals before their recommendations are statistically reliable [8]. Most B2B startups don’t have that. Be honest about what your data can support, and resist the pressure to automate decisions the data cannot yet validate.

What This Means for Marketing Leaders

Assess honestly. Where is your team on this framework? Not where your best individual contributor is — where is the team’s median capability? That’s your operating level. And if the answer is Level 0, you’re in the company of the overwhelming majority of B2B marketing organizations. But you’re also falling behind the ones that aren’t.

Don’t skip levels, and be wary of disruptive change. Avoid shiny object syndrome by looking for incremental and iterative achievements that can serve as foundational pieces while preserving the value-creating activities already in place. Teams that jump to agentic without building skill discipline and collaborative workflows first will automate bad process at machine speed. The CRM is full of gaps, guesses, and stale records. Layering autonomous agents on top of that doesn’t fix it. It amplifies it.

Invest in the transitions, not the tools. The bottleneck at Level 0 to 1 is skill curation. At 1 to 2, it’s team culture and shared standards. At 2 to 3, it’s data infrastructure and governance. Buying another AI tool doesn’t advance you through these levels. Building the organizational capability does.

The question isn’t whether your team is using AI. It’s whether they’re advancing through the levels that make AI compound into a structural advantage — or stuck at Level 0 calling it progress.

Sources

[1] The State of AI in Marketing 2026, Jasper, 2026
[2] The State of AI in B2B Marketing Report, The Growth Syndicate, 2026
[3] AI Marketing Statistics 2026: 200+ Adoption Insights, Digital Applied, 2026
[4] AI in B2B Marketing: 2025 Statistics Every CMO Needs to Know, 1827 Marketing, 2025
[5] CRM Data Quality Benchmarks 2026, RecordContext, 2026
[6] B2B Buying Behavior in 2026: 57 Stats and Five Hard Truths That Sales Can’t Ignore, Corporate Visions, 2026; Business Buying Behavior: What the Data Says in 2026, Prospeo, 2026
[7] How AI SDR Agents Boost Conversions by 70% (2026), Landbase, 2026
[8] Machine Learning Sales Forecasting for B2B: Full Guide, Forecastio, 2026
[9] What Is Data Decay? Causes, Costs and Prevention, Cognism, 2026

Author bios

Michael Cichon is a growth-focused B2B marketing leader with 20+ years of experience, known for turning brands into revenue-generating engines through measurable, performance-driven strategy. With multiple successful exits, he brings end-to-end expertise across product marketing, digital strategy, content, and account-based marketing. Michael blends big-picture positioning with hands-on execution, and he is recognized for building tight Marketing and Sales alignment that accelerates go-to-market outcomes. He is especially passionate about emerging technology and how AI can supercharge business development.

Domenic Ravita is VP of Product Marketing, AI Business at Teradata, where he leads a team of courageous marketers and technologists for the Teradata Autonomous Knowledge Platform. He’s growth-focused GTM leader in data and AI infrastructure, with a track record of scaling B2B SaaS businesses through product-led and sales-led motions. He brings deep technical fluency and full-funnel marketing leadership to help software companies turn complex platforms into compelling market narratives.

In Case You Missed It:

Here’s the link to AI Realized Issue #18

Join the AI Realized Community and received invitations to exclusive events and practical content for executives adopting AI.

Join