Vision
Vision
The Architecture of Foregone Conclusions
In 1994, a Netscape engineer wrote a four-page proposal for a small piece of browser data. Cookies shipped in the next release. Google spent six years trying to replace them and failed. The quick fix outlasted the replacement project because by the time anyone questioned it, everything else depended on it. That same mechanism is now operating in agent infrastructure and identity, except the dependency graph that took cookies three years to form is building in months. Most governance conversations assume there's time to get the architecture right. The defaults accumulating in your stack this quarter suggest otherwise.
The Architecture of Foregone Conclusions
In 1994, a Netscape engineer wrote a four-page proposal for a small piece of browser data. Cookies shipped in the next release. Google spent six years trying to replace them and failed. The quick fix outlasted the replacement project because by the time anyone questioned it, everything else depended on it. That same mechanism is now operating in agent infrastructure and identity, except the dependency graph that took cookies three years to form is building in months. Most governance conversations assume there's time to get the architecture right. The defaults accumulating in your stack this quarter suggest otherwise.
Two Defaults Hiding in Plain Sight
The Pilot That Worked
Failed AI pilots generate postmortems. Successful ones generate something quieter: permanent architecture. When a pilot encodes the current workflow and hits its targets, the reporting lines it assumed become the reporting lines. The decision rights it left untouched stay untouched. The window for redesign closes before anyone notices it was open.
What the Junior Analyst Knew
When organizations automate entry-level work, the efficiency gains are visible. What's been removed takes longer to miss. Junior analysts processing exceptions and escalating edge cases did measurable, standardized work. They also served as the mechanism through which institutions discovered what their formal processes missed. Nobody is building a replacement for that function, because most organizations didn't realize it existed.
The Regulatory Lag
On May 7, the EU agreed to push the AI Act's high-risk obligations from August 2026 to December 2027. Honest reasoning: harmonized standards weren't ready, conformity bodies weren't appointed. Companies were being asked to comply against benchmarks that didn't exist yet.
Agent infrastructure, of course, kept moving. Over 10,000 MCP servers indexed. Shadow AI spreading through enterprises faster than procurement can track. Eighteen extra months sounds generous until you notice what's being poured into production right now, without logging baked into core design, without governance architecture anyone would choose if they were starting clean.
GDPR gave us the preview. Most organizations bolted consent banners onto unchanged data infrastructure and called it compliance. The AI Act risks repeating that pattern at a deeper layer, where retrofitting is harder and the stakes compound. Article 12 requires integrated logging as an architectural property. That's not a banner you can bolt on later.
Worth Reading
