The organizations winning with AI are rebuilding around it. Governance must be rebuilt too.
A new report from World Economic Forum in collaboration with Kearney argues that the organizations pulling ahead didn't add AI to existing workflows. They rebuilt their operating model around it.
What it says
When AI is bolted onto existing processes, governance can stay where it always was: a policy, a review step, a human checking outputs at the end.
Rebuilding around AI breaks that. The report's own example notes a live agent making roughly 1,000 times more decisions than in its test phase, so exhaustive human review is impossible. Workflows adapt in real time rather than following fixed sequences.
So the frontier organizations move control into the architecture. They own the control layers around the model: orchestration, context, and APIs over proprietary data. This governs who reaches which models and data, and keeps audit logs even when vendors change.
This is also where security lives. Agents now act with credentials and reach into CRM, finance, and HR through that same orchestration layer. Identity, credential scope, and data exposure become a security boundary, not just a governance one. Evaluation becomes a gate agents must clear before going live.
Why it matters
Governance you apply after the fact does not survive contact with a system that runs the business.
Once AI is embedded in execution, oversight and access control have to be designed into orchestration, evaluation, and identity controls, or they do not exist at scale. This is the difference between a policy that exists and a control that can be enforced.
For regulated firms, that difference is what customer security reviews and supervisors are starting to test.
Key takeaways
- Governance designed in survives; governance applied on top does not.
- Every agent is an access path into your data. Identity and credential scope are now a security perimeter, not an afterthought.
- "Who controls the model and the data" is now an architecture decision, and a diligence question.
Source:
· World Economic Forum & Kearney — The AI-First Operating System: A Blueprint for Operating and Business Model Innovation — weforum.org, June 2026
As you rebuild workflows around AI, are your controls being rebuilt with them? Or just carried over?