As AI Fragments The Enterprise, CIOs Orchestrate The Workflows And Hand Agents To The Business

The views and opinions expressed are those of Rizwan Jan and do not represent the official policy or position of any organization.

Enterprise AI promises to connect the business, but aimed at a landscape of disconnected systems and messy data, it tends to spread the mess faster than it clears it. What changes the outcome is sequencing. An orchestration layer automates the handoffs between systems, a centralized set of governance policies keeps identity and data classification in one place, and the agents sit with the business units that own the work. Put those pieces in that order and AI starts closing the gaps between systems rather than widening them.

Rizwan Jan is Vice President and Chief Information Officer at CNA Corporation, the nonprofit research organization that runs national-security and public-sector analysis, with roughly two-thirds of its work tied to the Navy. Before CNA, he was Chief Information Officer and, earlier, Chief Information Security Officer at The Henry M. Jackson Foundation for the Advancement of Military Medicine, and he held cybersecurity and incident-response roles at Booz Allen Hamilton and Aetna. That mix of security leadership and federal operating constraints shapes how he reads the current rush to deploy AI.

"The orchestration layer, that's the part that needs to be really automated, to get the humans out of the loop and build a good agent-human relationship, where the human sits on the loop versus in the loop," Jan said. That on-the-loop model only works once the data and ownership underneath it are solid, and getting that foundation right is where Jan says most AI programs stumble.

• Prep before paint: Most of the work sits in documenting how people actually operate and cleaning up the data they generate, long before a model enters the picture. "Think about it as you're painting a room. Putting the drop cloth down, taping the room, that's always the hard stuff," Jan said, equating the prep to an organization's business requirements. "But once the prep work is done, painting goes up pretty quickly." Skip it, and you inherit the old problem in a new tool: unstructured, low-quality data feeding decisions nobody can trust.

• Humans as the seams: Data lives wherever enterprise systems put it, across platforms like ServiceNow, ERP systems, and CRM tools, and the people in between end up as the integration layer. "The friction is in between those systems, and it's the humans who live there, extracting that data, cleaning it up, and cutting and pasting it to another system," Jan said. Automating those seams is the real job of orchestration, and it's what lets an agent carry a process from one system to the next without a person shuttling records by hand.

• Governance before scale: Orchestration only stays contained when it sits on centralized governance, identity management, and a data-classification scheme that sorts what's sensitive, proprietary, or public. Those controls are what stop a hundred new agents from becoming a hundred new silos. "If you continue to go down this road and spin up AI in an already fragmented environment, you're just driving additional fragmentation, because there's no business value in that."

Those pillars are simple to list and difficult to place. Governance policy, identity, and classification only mean something once someone is accountable for each slice of data and each agent that touches it, and that's where Jan says most programs stall. His framing moves the question off the technology and onto the org chart: less about what an agent can do, more about who answers for what it does. That same shift is what makes monitoring tractable, since it defines what's worth watching in the first place.

• Business owns the agents: "Who knows the data better? It's not IT, it's the business." In Jan's model the agents belong to the CFO, COO, or Chief HR Officer, whoever owns the underlying process, while the data classification that ranks an agent's criticality follows the sensitivity of the data it handles, so an agent near PHI is treated very differently from one near marketing copy. "The governance model, from a technology perspective, should be managed by your IT folks. So that's where that relationship should be. It's not just one singular owner," Jan said. Monitoring follows the same split: the signal that matters is data moving where it shouldn't, so he treats agents like service accounts, scoped to a task and tracked through the data they touch.

• Human on the loop, by design: Automation runs the routine path, and people step in only at defined thresholds. The invoice is his standard example. "Your invoices may be automatically approved at a threshold, but if it's $100,000, you may need that human to actually look at that invoice and click that approve button, or deny." The harder question is whether that escalation is a line in a policy document or something enforced in the architecture at runtime, and the answer ties back to ownership: the person in the loop has to be the one whose job it already is to make that call.

None of this arrives as a platform purchase. Jan's advice to other CIOs is to resist automating everything at once and instead pick a single high-friction workflow that already crosses departments, with onboarding a new hire as his favorite, since it runs through HR, IT, finance, and benefits in one chain. Reducing the manual handoffs in that one process builds the trust, and the track record, to take on the next.

What makes or breaks all of it is less technical than it sounds. Treating an agent as part of the workforce means someone has to answer for it. "It always comes down to ownership, and most people run away from that," Jan said. "That's a cultural shift that needs to change."