The Missing Half Of Enterprise AI Is The Operations Manual

The views and opinions expressed are those of Philip Flint and do not represent the official policy or position of any organization.

Enterprises have spent three years learning what AI agents can technically do. The harder question, and the one most governance programs have not caught up to, is what those agents are actually authorized to do. An agent can inherit a user’s permissions and act on them at a speed and scale no human ever would, executing thousands of tasks nobody explicitly signed off on. The gap between capability and authorization is where the risk now lives, and closing it means governing delegated authority, not just access.

Philip Flint is a Lead Enterprise Architect with more than a decade in the role and over 30 years in enterprise IT, working in regulated professional services. He describes his job as chief imagineer, the person who looks at what's coming and plans for it before it arrives through the back door. On AI governance, the distinction he keeps returning to is the one between what a system is able to do and what it was ever meant to do.

"A user has rights. You gave me modify and edit rights to a whole bunch of shares, so I have the ability to change tens of thousands of files. You didn’t give me the authority to encrypt them all, but you gave me the ability to do it. Rights are not authority," Flint said.

• We built the product before the operations manual: Flint’s read on where most organizations actually stand is that capability has sprinted ahead of control. AI arrives through feature releases, lands on desktops before anyone planned for it, and leaves governance reacting rather than directing. "ChatGPT was our minimum viable product, and since then we’ve been building on it at a rapid pace. But what we haven’t built is the operations manual, and that’s our governance. It’s lagging quite a bit behind," Flint said. The danger he flags is that organizations misjudge how exposed they are. It works like security, he said: you think you're in a good place, right up until you find out you're not.

• Rights quietly compound into authority nobody granted: Few teams set out to hand an agent sweeping power. The authority accrues through a series of individually reasonable permissions: let it read a system, call an API, update a record, trigger the next workflow. The mistake, in Flint’s view, is assuming no one has crossed that line yet. "I think that’s what we’ve done, though," he said. Each grant looks mundane on its own, and the sum is a level of delegated authority no one ever decided to confer. The ransomware parallel is his sharpest illustration of the mechanism. A piece of malware uses the rights of whoever runs it, with no regard for whether anyone intended those rights to be used that way, because authority of that kind was never actually assigned.

The classic objection is that agents simply follow their instructions, so limits should hold. Flint shares an invoice scenario that shows why that assumption is fragile. Tell an agent its job is to get invoices paid on time, set a $5,000 ceiling, and then feed it a $25,000 invoice, and the question becomes whether it honors the limit or serves the imperative by splitting the payment into five. The fix Flint points toward is making the stringency of a control track the risk of the action rather than the convenience of the workflow.

The subtler failure is cumulative. A single $5,000 payment is recoverable, but an agent moving at machine speed might run $5 million through in a week before anyone thinks to ask whether that was reasonable. A human would have paused. The agent has no reason to. Flint sees the same imperative-chasing logic in the OpenAI model-evaluation incident disclosed in July 2026, in which models, told to solve a benchmark, found an unintended path to the answer by compromising external infrastructure. "You gave it an imperative, and it delivered. It found a way with the tooling that it has," Flint said.

• Govern at the edges, because the middle moves too fast: Traditional governance depended on human speed. Work ran slowly enough to leave room to consult a colleague, pause, and reflect on whether an action was right, and that slack functioned as control even though no one designed it that way. Agents remove the slack. Flint’s response is to push governance to the edges: shift left into design-time decisions about what an agent is permitted to do, and shift right into ongoing assurance that watches for drift as the agent learns and its behavior changes. The runtime middle is the hardest part, because the usual fix doesn't hold. "If you put a human in the loop and they keep getting asked ‘can I do it?’ the reality is they say yes, yes, yes, yes. You don’t have any governance there," Flint explained. Real runtime governance, in his view, has to be designed in as actions, permissions, and thresholds the agent can't talk its way past rather than a human rubber stamp.

• Accountability has to be layered, with a name at the top: Nobody can know or control everything an AI capability does, so making one person responsible for all of it is neither fair nor realistic. Flint’s answer is layered accountability: the organization answers for its systems, the executive owns strategy and risk, the technology and architecture teams own the build, and security, compliance, and assurance each hold their piece. But layered is not diffuse. Someone still has to be the figurehead who can say their part is sound, and Flint’s test for that is plain: can the owner sit down and explain that, with what they knew at the time, they acted ethically and did the right thing. Where human judgment has to enter at all is its own question. For Flint, the right level of oversight depends not only on the potential harm if an agent gets something wrong, but on the nature of the decision itself. Some activities can be automated safely within well-defined boundaries; others call for human judgment, ethical discretion, or empathy, even when an agent could perform the task to a high technical standard.

• The hardest case is the agent already on the desktop: Layered accountability maps cleanly onto a centrally managed backend capability. What worries Flint more is agentic AI arriving on individual desktops, where an employee can hand a task to an agent and tell it to proceed without a committee anywhere in sight. The focus so far, he said, has been almost entirely on what agents can do. "People are thinking about what it can do. The missing piece I see is what can’t it do, what do I have to stop it doing, and where’s that programmed in," Flint shared. Defining the boundaries of forbidden action, and building them in rather than assuming good intentions, is in his view the larger and more neglected half of the work.

For Flint, governance done right speeds an organization up rather than slowing it down, stepping in at the right moment rather than all the time, the way good security does. He treats it as a living thing that needs ongoing assurance rather than a box ticked once at deployment. What makes it hold, though, is culture more than tooling. At a regulated, employee-owned firm he has the advantage of people already inclined to do the right thing, and he reinforces it with a refrain repeated until it sticks. "We have to have a business tomorrow. We have to have jobs tomorrow," he said. Governance therefore plays a part in protecting the organization's future, with constraints applied where they are necessary and proportionate, rather than becoming an obstacle to getting things done. Users are the first line of defense, and the background controls are there to catch them when they fall.

Flint’s own summary of the destination is less about restraint than calibration. As he put it, the goal is "the right amount of autonomy, for the right work, at the right time, with the right controls." For CIOs still mapping what their agents can reach, his point is that the more urgent map is the one showing what they are allowed to do, and who decided.