On Thursday 15 October, at a press roundtable at ExCeL London, a journalist from The Stack asked Salesforce about sovereignty. That day the company had announced a 15-year agreement with HM Revenue &…

Read more

At 09:46 on Thursday 15 October, the screens above the main stage at ExCeL London still read “AIforce World Tour London”. Six days earlier Marc Benioff, chair and chief executive of Salesforce, had p…

Read more

Opinion. The views in this piece are the author’s own, not those of Arkava®.

On Saturday 19 September, Ed Sheeran walked on stage alone at Lincoln Financial Field in Philadelphia, with no opening act, and told a stadium crowd that what is happening in Gaza is “catastrophic and unjustifiable and disproportionate”.¹

^{Credit: The Rest is Entertainment, Goalhanger Podcasts, Episode title “Ed Sheeran: The Fallout”}

A few days later, on The Rest Is Entertainment, Marina Hyde apologised for what she was about to say. “I’m terribly sorry,” she told Richard Osman. “I’m afraid I don’t believe that artists are making a difference on this or indeed any issue in terms of changing the politics.” Later in the conversation she went further: “every single piece of evidence suggests they don’t.”²

It began at MetLife Stadium in New Jersey on 4 and 5 September, where Sheeran’s support act, Macklemore, said “Free Palestine” from the stage — alongside “Free Lebanon”, “Free Cuba”, “Free Congo” and “Free Sudan”, and a line calling ICE, the US immigration agency, a terrorist organisation — and performed “Hind’s Hall” with images of Gaza on the screens.³

On 14 September Robert Kraft, the billionaire owner of Gillette Stadium, said Macklemore’s appearance there “would cross that line”, citing “material shared from the stage” and what he called “a broader history of antisemitic rhetoric and imagery”; the decision, he added, was “not about diminishing the suffering of innocent Palestinians”.⁴

The promoter, Messina Touring Group, said venues would not allow a concert with Macklemore on the line-up, and he was off the tour; Finneas, Aaron Rowe, Beoga and Lukas Graham quit in solidarity.³ Osman placed Messina inside Live Nation on air. It is affiliated with AEG Presents.⁴

I agree with Hyde on two things. Macklemore saying “Free Palestine” in New Jersey will not stop Palestinian children being killed: the UN Secretary-General’s annual report records that the UN verified the killing of 2,668 of them in Gaza in 2025, and UNICEF said in August that at least 300 children had reportedly been killed in the 300 days since the October 2025 ceasefire.⁵

And tragedy tourism is real. Some celebrities arrive for the catastrophe of the week with thoughts and prayers, and leave before anything is asked of them.

Where I part company with her is the conclusion.

The argument I want to make here is that art changes culture, that culture changes politics, and that people who speak from a stage, with the weight of their work behind them, have always been part of how that happens.

A statement borrows its weight from the work

Hyde’s case rests on a line between the art and the artist’s statements about the world. That line does not hold. Nobody would care what Macklemore said between songs if he had not written the songs. A statement from the stage borrows its weight from the work, and from something that matters almost as much: how an artist shows up, and what they model as normal.

Macklemore has form. “Same Love”, released in July 2012, became the unofficial theme song of the campaign for Referendum 74 on same-sex marriage in his home state of Washington, which passed that November by 53.7 per cent to 46.3.⁶

Nobody can prove a song moved a 228,630-vote margin, and I will not pretend to. What the song did — and this is the mechanism Hyde’s evidence cannot see — was make one side of the argument sound like the obvious thing a decent person would say.

There is a name for that. The Overton window, in the words of the Mackinac Center, where the idea was developed, is “a model for understanding how ideas in society change over time and influence politics”.⁷

Put plainly, it is the range of positions a politician can hold in public without being finished by them, and artists are among the people who move it.

Science fiction supplies the cleanest case I know. After the first season of Star Trek, Nichelle Nichols planned to return to musical theatre. Martin Luther King Jr, she later recalled, told her she could not, because the show presented a world in which,

The series existed partly because Lucille Ball — the first woman to run a major Hollywood studio, who had overcome CBS’s reluctance to cast her Cuban husband, Desi Arnaz, more than a decade before — backed it through two pilots at Desilu.⁸

None of it was a protest, and it changed what America saw as normal anyway.

The window moves in both directions, and Hyde supplied the best example herself. In April 2026, after a backlash over his antisemitic comments, the Home Office barred Ye — the artist formerly known as Kanye West — from entering Britain to headline a London festival, on the ground that his presence would not be conducive to the public good.⁹

Nobody in government thought his words were weightless. Art can make cruelty sound normal as easily as it makes decency sound obvious, and so can the proprietors and platforms that sell anger by the page view. That is a reason to take what artists say seriously, which is the opposite of Hyde’s conclusion.

Fourteen years of reporting, four nights of television

If you want to watch the window move in real time, look at Britain in January 2024.

Computer Weekly first reported the stories of sub-postmasters wrongly accused over the Post Office’s Horizon accounting system on 11 May 2009.¹⁰

The facts sat in the public record for more than fourteen and a half years — reported first, and for longest, by a trade magazine — and successive governments did not act on the scale they demanded. Then ITV broadcast Mr Bates vs The Post Office on four consecutive nights from 1 January 2024, to an average of 13.5 million viewers an episode across all devices within 28 days, by ITV’s count. On 10 January the then Prime Minister, Rishi Sunak, told the House of Commons that the government would “introduce new primary legislation to make sure that those convicted as a result of the Horizon scandal are swiftly exonerated and compensated”. The Act received Royal Assent on 24 May 2024, and by 30 June 2026 it had quashed 2,249 convictions of 619 people in England and Wales.¹⁰

The drama did not uncover a single fact that Computer Weekly had not already printed. It changed the cost of looking away. For fourteen years, the claim that a computer system had been used to prosecute innocent people was something a minister could decline to engage with; after four nights of prime-time drama, it was something no minister could survive ignoring.

Evey, in the 2005 film V for Vendetta, remembers her father’s formula:

Nobody tries to deport a singer they expect to be ignored

Even in a democracy, speaking can be made expensive. On 4 February 1972 Senator Strom Thurmond sent Attorney General John Mitchell a memo about John Lennon, written by the staff of the Senate Internal Security Subcommittee, with a covering letter saying the matter should be “considered at the highest level”. Lennon was planning — according to the historian Jon Wiener, whose Freedom of Information requests later brought the memos to light — to tour America with concerts that doubled as drives to register young voters, in the first presidential election in which 18-year-olds could vote nationwide. The memo described his circle as “strong advocates of the program to ‘dump Nixon’”, and said that “if Lennon’s visa is terminated it would be a strategy counter-measure”.¹¹

A month later the Immigration and Naturalization Service moved to deport him, on the strength of a 1968 guilty plea at Marylebone Magistrates’ Court for possessing cannabis resin, for which he had been fined £150. The same service had extended his visa only months earlier, conviction and all. Lennon dropped the tour on legal advice, Wiener says, and spent more than three years fighting to stay. On 7 October 1975 the US Court of Appeals for the Second Circuit ruled that the conviction did not make him excludable, and added a warning: “The courts will not condone selective deportation based upon secret political grounds.” By then Nixon had been out of office for fourteen months. Lennon received his green card the following year.¹¹

That, I think, is the duty those with influence carry. There are moments when saying what is true is necessary, and the people with the largest platforms carry the largest share of that obligation. The price paid, is part of the proof that it matters.

Autocracies move faster. In late September 2022, less than a fortnight after Mahsa Amini died in the custody of Iran’s morality police, the singer Shervin Hajipour posted “Baraye” on Instagram, a song built from the reasons Iranians had given online for protesting. It drew about 40 million views in roughly two days, and within days he had been arrested and the post deleted. In February 2023 it became the first song to win the Recording Academy’s award for Best Song for Social Change. In March 2024 Hajipour said he had been sentenced to three years and eight months for propaganda and inciting riot; that September he said an amnesty had dismissed the case. The post came down and the singer was convicted. The song went on playing from apartment blocks at night, the unofficial anthem of the Woman, Life, Freedom protests.¹²

In the Soviet Union, when Western jazz and rock’n’roll were forbidden, bootleggers cut them onto used X-ray film and sold the “bone music” on the street, until reel-to-reel tape made the X-rays unnecessary in the 1960s.¹²

The real selectivity is by cost

Hyde’s second charge is selectivity: artists loud about Gaza and quiet about Sudan and eastern Congo. It fails on its facts. Macklemore named Congo and Sudan in the very speech that cost him the tour, and Kraft’s statement mentioned neither; Ms Rachel’s May 2024 fundraiser for children in Gaza was also for children in Sudan, the Democratic Republic of Congo and Ukraine.¹³

It fails on its logic, because declining to name every wrong in the world does not cancel the one you do name. If a warning about one fire only counted when it listed every fire on earth, nobody would ever be allowed to raise the alarm.

The selectivity worth worrying about runs the other way. In the spring of 2022 Sheeran said “I stand with Ukraine”, and that May he released a version of “2step” with the Ukrainian band Antytila, whose frontman had volunteered as an army paramedic.¹⁴

It was a decent thing to do, and in Britain in 2022 it cost him almost nothing. In Philadelphia last week he said he had tried throughout his career not to be “a political commentator of any kind”.¹

But he has taken sides before. The difference with Gaza is what speaking up would cost him.

That is my measure of tragedy tourism. It asks whether you had spoken before, whether the words arrive next to something you are selling, and whether saying them costs you anything. By that measure Macklemore and Ms Rachel, who have spoken up for Gaza since 2024 and taken the backlash for it, are not tourists. Sheeran spoke when, in Macklemore’s words, his “typical apolitical stance was being challenged in a way it never had been before”.³

By my measure, silence had become the more expensive option. To his credit, when the bill arrived, he paid some of it.

Horizon ran for fourteen years because telling it was costly and ignoring it was cheap. The causes where speaking carries a personal, social or financial penalty are the ones people stay silent about, and silence is how they last. Advocacy on Palestine now carries penalties that most causes do not.

In Britain, police made 2,819 arrests in the nine months to March 2026 linked to support for Palestine Action, which the government proscribed as a terrorist organisation in July 2025, a ban the Court of Appeal upheld in June after the High Court had found it unlawful. In the United States, Mahmoud Khalil and Rümeysa Öztürk were detained for weeks and months in 2025 in immigration proceedings that charged neither with a crime. In Berlin, four protesters were ordered to leave Germany; a court annulled one of those orders in May.¹⁵

Silence at that scale is a position

Osman made the best case for Sheeran on air: that refusing to join in on any side is, in the culture we live in, “quite a radical act”.²

Everyone has a right to that silence — Osman is right about that — but rights and duties are two different things, and the duty grows with the reach. Uncle Ben put it more economically in the 2002 film Spider-Man:

Silence from someone who can fill a stadium is a position of its own.

Taking a stand does not require a megaphone. Dolly Parton, who died on 25 August at the age of 80, is the model. In 2018 she took “Dixie” out of the name of her dinner show because people found it offensive, and in 2020 she told Billboard that “of course Black lives matter”. The same year she gave $1 million for Covid-19 research at Vanderbilt University Medical Center that, its scientists said, helped them show the Moderna vaccine was producing a good immune response, and her Imagination Library has given away more than 300 million books.¹⁶

Criticising a state is not hating a people

Kraft’s statement cited “a broader history of antisemitic rhetoric and imagery”, and that charge deserves an answer.

Antisemitism is abhorrent, and it is running near record levels: CST, which monitors it across the UK, recorded 3,700 antisemitic incidents in 2025, the second-highest total ever reported to it. Anti-Muslim hatred is rising too. Police-recorded religious hate crimes against Muslims in England and Wales rose by 19 per cent in the year to March 2025 (excluding the Metropolitan Police), and CAIR received a record 8,683 complaints of anti-Muslim discrimination in the United States in 2025.¹⁷ Macklemore apologised in 2014 for a costume — widely criticised at the time as an antisemitic caricature — and that history is fair game.¹⁷

What is not fair is the conflation now doing so much work in our politics and media: the idea that criticising the state of Israel is hatred of Jews. No people is one uniform body with one set of views, and treating all Jews, or all Muslims, or all Christians, or all atheists, as interchangeable is ignorant and plainly wrong. The International Holocaust Remembrance Alliance’s own working definition of antisemitism says that “criticism of Israel similar to that leveled against any other country cannot be regarded as antisemitic”. In September 2025, after being read the UN’s definition of genocide, 39 per cent of American Jews told a Washington Post poll, conducted by SSRS, that Israel had committed genocide in Gaza.¹⁸

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

The few who own the stage do not own the song

Robert Kraft does not believe culture is powerless. By The Boston Globe’s count he has committed more than $100 million to fighting antisemitism since 2019, including Super Bowl campaigns reported at about $7 million in 2024 and $8 million in 2025, and a $15 million campaign this year.¹⁹

I have no quarrel with a penny of it. Kraft spends like a man who believes culture changes minds. So do I. We disagree about which minds need changing, but he is the one that owns the stadium.

That is the geopolitics of culture in 2026: a handful of owners with outsize control over the channels culture travels through, and very many people who depend on them. The venues on one stadium tour removed an artist by telling the promoter they would not host him. A radio chain did much the same in 2003, after Natalie Maines of the Dixie Chicks told a London audience, days before the invasion of Iraq, that the band was “ashamed the president of the United States is from Texas”. Cumulus Media, which its chief executive described to the Senate Commerce Committee that July as “a confederation of 270 individual stations in 55 cities”, temporarily pulled the band from its country stations. The band’s manager told the same hearing that what had happened to his clients was “perhaps the most compelling evidence that radio ownership consolidation has a direct negative impact on diversity of programming and political discourse over the public air waves”.²⁰

A peer-reviewed study later traced the wider backlash to “grassroots conservative sentiment” among listeners, and Cumulus said it was answering exactly that.²⁰

What consolidation added was reach: at Cumulus, one decision at head office took a band off dozens of stations at once. Four years later the Dixie Chicks won five Grammys, including Album of the Year.

Today the loudest channels are feeds, and they reward outrage, measurably: in one study of 2.7 million posts by news outlets and members of Congress, each word about the opposing political side raised the odds of a post being shared by 67 per cent.²¹ Hyde is right about that, and it is the strongest part of her argument.

But the same platforms carried something no owner chose. Motaz Azaiza, a photojournalist from Gaza, went from about 27,500 Instagram followers before October 2023 to 18.25 million a hundred-odd days later, according to Dawn, and TIME named him among the most influential people of 2024 as “the world’s eyes and ears in his native Gaza”. Bisan Owda’s It’s Bisan From Gaza and I’m Still Alive won a Peabody and a News Emmy. Refaat Alareer’s poem “If I Must Die”, first posted in 2011 and shared again in 2023 before he was killed that December, has been viewed tens of millions of times and, by ArabLit’s count, translated into more than 100 languages. Hind Rajab, a young girl killed in Gaza in January 2024, her name referenced in Macklemore’s “Hind’s Hall”, and the recordings of her calls for help became Kaouther Ben Hania’s film The Voice of Hind Rajab, which drew a standing ovation of more than 20 minutes at the Venice Film Festival and an Oscar nomination for best international feature.²²

The window has already moved

In February 2018 Gallup found that 64 per cent of Americans sympathised more with the Israelis than with the Palestinians, and 19 per cent the other way. In February 2026 the figures were 36 and 41, the first time in Gallup’s annual series, which began in 2001, that the Israelis were not ahead. In July, 43 per cent of Americans told YouGov that Israel is committing genocide against Palestinian civilians.

In September 2021, 210 House Democrats voted to fund Israel’s Iron Dome defences and eight voted against. On 15 July 2026, 103 House Democrats — including Nancy Pelosi and the party’s second-ranking leader in the House, Katherine Clark — voted for an amendment to cut $3.3 billion in security aid for Israel, and 98 voted against.²³

The amendment failed, and I would be overclaiming if I said songs did that. The war itself did most of the work, and age and party did much of the rest. But in 2021 that vote was unthinkable. In 2026 it was merely unsuccessful.

The bottom line

Hyde is right that a stadium speech will not end a war, and right that the platforms reward the loudest version of every argument. She is wrong that artists change nothing. They rarely change a vote directly. What they change is the range of things a politician can say out loud and survive. That is why a British government legislated within five months of a television drama, why Senate staff called ending John Lennon’s visa “a strategy counter-measure”, and why Iran arrested Shervin Hajipour within days of his posting “Baraye”.

It is also why, this month, the venues on one American stadium tour decided that a song could go no further than New Jersey.

They could keep it out of their stadiums. They cannot keep it out of the culture.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

References

Amer Altaf is founder and chief executive of Arkava and managing editor of The Control Layer. This is an opinion piece; the views are his own.

1. Ed Sheeran, remarks before his concert at Lincoln Financial Field, Philadelphia, 19 September 2026: The Philadelphia Inquirer, 19 September 2026, https://www.inquirer.com/news/philadelphia/ed-sheeran-palestine-comments-macklemore-philadelphia-20260919.html; Fox News transcript, https://www.foxnews.com/entertainment/read-it-ed-sheerans-pre-concert-speech-philly-crowd-about-gaza-controversy; and the Associated Press (via WSB-TV), https://www.wsbtv.com/news/local/ed-sheeran-says-situation-gaza-is-catastrophic-unjustifiable-he-opens-solo-concert/CTPT5X4LFNGPLIH2ORFN5EUQC4/. The Inquirer and Fox carry all three words of the Gaza quotation; AP carries “catastrophic and unjustifiable”. The “political commentator” words are from Fox’s transcript; AP reports the same passage in paraphrase. ↩ ↩²

2. Marina Hyde and Richard Osman, “Ed Sheeran: The Fallout”, The Rest Is Entertainment, Goalhanger, released on 22 September 2026 (UK time), official feed https://feeds.megaphone.fm/GLT2052042801 — show page:

   . Quotations at approximately 00:03:31 (Osman), 00:11:57 and 00:17:35 (Hyde). ↩ ↩²

3. Macklemore’s remarks at MetLife Stadium, 4–5 September 2026: The Boston Globe, 16 September 2026, https://www.bostonglobe.com/2026/09/16/metro/macklemore-comments-on-stage-at-metlife-stadium/; Newsweek, 7 September 2026, https://www.newsweek.com/macklemore-free-palestine-remarks-ed-sheeran-backlash-transcript-12413361; and CBS New York, 7 September 2026, on “Hind’s Hall” and the video imagery, https://www.cbsnews.com/newyork/news/macklemore-pro-palestinian-comments-metlife-stadium-ed-sheeran/. The support acts’ withdrawal: The Irish Times, 15 September 2026, https://www.irishtimes.com/culture/music/2026/09/15/irish-acts-aaron-rowe-and-beoga-quit-ed-sheerans-us-tour-in-protest-over-palestine/ and Newsweek (above). Macklemore’s statement that Sheeran’s “typical apolitical stance was being challenged in a way it never had been before”: ABC News (Australia), 16 September 2026, https://www.abc.net.au/news/2026-09-16/free-palestine-macklemore-and-ed-sheeran-tour-controversy/107157914 ↩ ↩² ↩³

4. Robert Kraft, statement of 14 September 2026, in full in GBH News, https://www.wgbh.org/news/politics/2026-09-14/bob-kraft-explains-decision-to-urge-ouster-of-rapper-macklemore-from-ed-sheeran-tour. Messina Touring Group’s statement (“We have been notified by venues on the upcoming US tour dates that they will not allow a concert to take place with Macklemore on the lineup…”), given to Rolling Stone and reported by Al Jazeera, 14 September 2026, https://www.aljazeera.com/news/2026/9/14/macklemore-dropped-from-ed-sheeran-tour-following-palestine-advocacy. The promoter’s affiliation: AEG, https://aegworldwide.com/divisions/music; IQ, 3 February 2026, https://www.iqmagazine.com/2026/02/messina-touring-group-recounts-25-years-at-the-helm/; TicketNews, 19 September 2026, https://www.ticketnews.com/2026/09/ed-sheeran-messina-venue-power-live-nation/ (“Live Nation, however, was not Sheeran’s U.S. tour promoter”) ↩ ↩²

5. United Nations Secretary-General, Children and Armed Conflict, A/80/723–S/2026/357, 16 June 2026. https://www.un.org/unispal/document/children-and-armed-conflict-report-of-the-secretary-general-a-80-723-s-2026-357/ — UNICEF, “At least 300 children reportedly killed in Gaza in past 300 days”, 6 August 2026. https://www.unicef.org/press-releases/least-300-children-reportedly-killed-gaza-past-300-days ↩

6. Washington Secretary of State, results for Referendum Measure 74, 6 November 2012. https://results.vote.wa.gov/results/20121106/Referendum-Measure-No-74-Concerns-marriage-for-same-sex-couples.html — HistoryLink on “Same Love” as the campaign’s unofficial theme song: https://www.historylink.org/file/11050 ↩

7. Mackinac Center for Public Policy, “The Overton Window”. https://www.mackinac.org/OvertonWindow ↩

8. NPR, “For MLK Day: ‘Lt. Uhura’ on how Rev. King told her to stay on ‘Star Trek’”, 14 January 2011, https://www.npr.org/sections/thetwo-way/2011/01/14/132935327/for-mlk-day-lt-uhura-on-how-rev-king-told-her-to-stay-on-star-trek, and The Hollywood Reporter’s obituary of Nichelle Nichols, 2022, https://www.hollywoodreporter.com/tv/tv-news/nichelle-nichols-dead-star-trek-lieutenant-uhura-1235189880/ (her recollection of King’s words varies slightly between tellings) — PBS American Masters on CBS’s hesitation to cast Arnaz, https://www.pbs.org/wnet/americanmasters/5-ways-i-love-lucy-transformed-television-history/19407/ — Ball as the first woman to run a studio: Lucille Ball Desi Arnaz Museum, https://lucydesi.com/a-legacy-of-laughter/ and California Museum, https://californiamuseum.org/inductee/lucille-ball/ — StarTrek.com (the franchise’s own site) on Ball backing the show through two pilots, https://www.startrek.com/news/how-lucille-ball-helped-star-trek-become-a-cultural-icon ↩ ↩²

9. NPR, 7 April 2026, on the Home Office decision and the cancellation of Wireless Festival, https://www.npr.org/2026/04/07/nx-s1-5776646/ye-kanye-west-travel-ban-uk-wireless — NBC News, “Kanye West blocked from entering Britain to headline music festival after backlash over antisemitic comments”, https://www.nbcnews.com/world/united-kingdom/kanye-west-offers-meet-jewish-community-uk-ban-wireless-festival-rcna266842 — Time Out London, 7 April 2026, https://www.timeout.com/london/news/kanye-west-is-wireless-festival-2026-cancelled-040726 ↩

10. Computer Weekly, 11 May 2009, https://www.computerweekly.com/news/2240089230/Bankruptcy-prosecution-and-disrupted-livelihoods-Postmasters-tell-their-story, described by Press Gazette as “the first investigation”, https://pressgazette.co.uk/news/post-office-horizon-it-scandal-journalists/ — ITV press centre, 9 January 2024, on four consecutive nights of broadcast, https://www.itv.com/presscentre/media-releases/mr-bates-vs-post-office-2024s-most-watched-programme, and the 28-day, all-device average reported from ITV data by The Knowledge, https://theknowledgeonline.com/news/mr-bates-vs-post-office-hits-whopping-13-5m — Hansard, House of Commons, 10 January 2024, https://hansard.parliament.uk/commons/2024-01-10/debates/7CF4D161-1F0D-4005-AC2E-9FDFA07C0CA5/Engagements, and ITV News, 10 January 2024, https://www.itv.com/news/2024-01-10/horizon-scandal-pm-announces-mass-exonerations-for-sub-postmasters — Post Office (Horizon System) Offences Act 2024, Royal Assent 24 May 2024, https://www.legislation.gov.uk/ukpga/2024/14/enacted — Department for Business and Trade, quashed convictions management information, 2 July 2026 (figures to 30 June 2026), https://www.gov.uk/government/publications/post-office-horizon-system-offences-act-2024-quashed-convictions-management-information/quashed-convictions-management-information-2-july-2026 ↩ ↩²

11. Senator Strom Thurmond’s letter of 4 February 1972 and the attached Senate Internal Security Subcommittee staff memo, as reported by UPI, 29 June 1984, from documents the historian Jon Wiener obtained under the Freedom of Information Act, https://www.upi.com/Archives/1984/06/29/Thurmond-led-move-to-deport-Lennon/8991457329600/ — Wiener has also quoted the phrase as “strategic counter-measure” (The Nation, 22 October 2012, https://www.thenation.com/article/archive/john-lennon-and-george-mcgovern-another-side-1972-campaign/). The tour, the first election with 18-year-old voters and the cancellation on legal advice: Jon Wiener on NPR’s Fresh Air, https://www.npr.org/2010/10/08/130401193/uncovering-the-truth-behind-lennons-fbi-files, and CBS News and The Nation, 15 September 2006, https://www.cbsnews.com/news/the-us-vs-john-lennon/ — the 26th Amendment and the 1972 election: US National Archives, Prologue, 13 November 2013, https://prologue.blogs.archives.gov/2013/11/13/records-of-rights-vote-old-enough-to-fight-old-enough-to-vote/ — the 1968 plea, the visa extension, the INS notice of 1 March 1972 and the ruling: Lennon v. Immigration and Naturalization Service, 527 F.2d 187 (2d Cir. 1975), decided 7 October 1975, https://www.courtlistener.com/opinion/331607/john-winston-ono-lennon-v-immigration-and-naturalization-service/ — Nixon’s address of 8 August 1974 announcing his resignation “effective at noon tomorrow”, https://www.presidency.ucsb.edu/documents/address-the-nation-announcing-decision-resign-the-office-president-the-united-states ↩ ↩²

12. Mahsa Amini’s death in the custody of the morality police: Associated Press via NPR, 19 September 2022, https://www.npr.org/2022/09/19/1123995106/iran-protest-mahsa-amini-death-morality-police — the song’s posting on 28 September 2022 and its 40 million views: CBC News, 6 October 2022, https://www.cbc.ca/lite/story/1.6608267 and the 1 March 2023, on the first award for Best Song for Social Change and the song’s 40 million views, https://www.grammy.com/news/best-song-social-change-shervin-hajipour-baraye-ruby-marchand-nick-difruscia-interview-2023-grammys/ — the arrest, the deletion and the song’s reach: The Times of Israel (wire report), 5 October 2022, https://www.timesofisrael.com/iranian-pop-singer-silenced-but-his-song-based-on-tweets-remains-a-protest-anthem/ — the sentence: IranWire, 1 March 2024, https://iranwire.com/en/news/125950-grammy-winning-iranian-protest-singer-sentenced-to-jail/ and Al Jazeera, 2 March 2024, https://www.aljazeera.com/news/2024/3/2/iranian-singer-sentenced-to-jail-over-mahsa-amini-protest-anthem — the amnesty: Associated Press, 23 September 2024, via KESQ, https://kesq.com/news/2024/09/23/iran-pardons-grammy-award-winner-whose-song-became-an-anthem-to-the-2022-protests/ — the “unofficial anthem”: RFE/RL, 3 December 2025, https://www.rferl.org/a/shervin-hajipour-iran-grammy-winner-album/33611837.html and Nafiseh Sharifi, “Soundtrack of Dissent”, Middle East Report 319, 20 August 2026, https://www.merip.org/2026/08/soundtrack-of-dissent-the-music-of-protest-in-iran/ — on bone music: Smithsonian, 10 December 2015, https://www.smithsonianmag.com/smart-news/soviet-hipsters-bootlegged-banned-music-bone-records-180957505/, Garage Museum of Contemporary Art, https://garagemca.org/en/exhibition/bone-music and The World (PRX/GBH), 21 August 2025, https://theworld.org/stories/2025/08/21/bone-music-brought-western-tunes-to-soviet-fans-by-recording-songs-onto-x-rays ↩ ↩²

13. On Macklemore’s words and Kraft’s statement, see notes 3 and 4. Ms Rachel’s Save the Children fundraiser, launched in mid-May 2024: JTA, 23 May 2024, https://www.jta.org/2024/05/23/lifestyle/following-backlash-and-cyberbullying-ms-rachel-sings-a-prayer-for-all-the-children-including-hostages-and-israelis and NBC News, https://www.nbcnews.com/news/us-news/ms-rachel-bullying-fundraising-children-gaza-rcna152701 ↩

14. Sheeran’s statement (“I stand with Ukraine…”), first made on the release of the original “2step” video, filmed in Kyiv, and quoted in NME, 2 May 2022, https://www.nme.com/news/music/ed-sheeran-teams-up-with-ukrainian-band-antytila-for-reworked-2step-3216770 — The Washington Post, 4 May 2022, on the Antytila version and Taras Topolia’s service as a paramedic, https://www.washingtonpost.com/world/2022/05/04/ed-sheeran-antytila-2step-ukraine/ — ITV News, 4 May 2022, https://www.itv.com/news/2022-05-04/ukrainian-band-antytilas-collaboration-with-ed-sheeran-filmed-on-the-frontline ↩

15. Home Office, Operation of police powers under the Terrorism Act 2000, quarterly update to March 2026, https://www.gov.uk/government/statistics/operation-of-police-powers-under-tact-2000-to-march-2026 — R (Ammori) v Secretary of State for the Home Department, High Court press summary, February 2026, https://www.judiciary.uk/wp-content/uploads/2026/02/Press-summary-Ammori-130226-002.pdf, and Court of Appeal judgment, 15 June 2026, https://www.judiciary.uk/wp-content/uploads/2026/06/Final-open-judgment-Ammori-v-SSHD.pdf — US Court of Appeals for the Third Circuit, Khalil v. President of the United States, 15 January 2026, https://www2.ca3.uscourts.gov/opinarch/252162p.pdf — Al Jazeera on the termination of Öztürk’s removal proceedings, 10 February 2026, https://www.aljazeera.com/news/2026/2/10/us-judge-blocks-trump-administrations-effort-to-deport-rumeysa-ozturk — NPR on the Berlin orders, 20 April 2025, https://www.npr.org/2025/04/20/g-s1-60984/germany-deportation-protesters — Berlin Administrative Court, press release 24/2026, 6 May 2026, https://www.berlin.de/gerichte/verwaltungsgericht/presse/pressemitteilungen/2026/pressemitteilung.1668523.php ↩

16. Vanderbilt University Medical Center, 26 August 2026, https://news.vumc.org/2026/08/26/vanderbilt-health-mourns-passing-of-global-icon-dolly-parton/ — NPR on the Billboard interview and the renaming of her dinner show, 14 August 2020, https://www.npr.org/2020/08/14/902506007/of-course-black-lives-matter-dolly-parton-tells-billboard — Fortune, 18 November 2020, on the $1 million gift and the Moderna research, https://fortune.com/2020/11/18/dolly-parton-moderna-vaccine — NPR (via KUNR), 26 August 2026, on the Imagination Library passing 300 million books, https://www.kunr.org/2026-08-26/dolly-partons-imagination-library-gave-the-gift-of-books-to-millions-of-children ↩

17. CST, Antisemitic Incidents Report 2025, 11 February 2026, https://cst.org.uk/research/cst-publications/antisemitic-incidents-report-2025 and Jewish News, 11 February 2026, https://www.jewishnews.co.uk/2025-sees-second-highest-annual-figure-for-antisemitism-in-the-uk-says-cst/ — Home Office, Hate crime, England and Wales, year ending March 2025, 9 October 2025 (year-on-year comparisons exclude the Metropolitan Police Service), https://www.gov.uk/government/statistics/hate-crime-england-and-wales-year-ending-march-2025/hate-crime-england-and-wales-year-ending-march-2025 and ITV News, 9 October 2025, https://www.itv.com/news/2025-10-09/religious-hate-crimes-in-england-and-wales-hit-record-high — CAIR, 2026 civil rights report, 10 March 2026 (complaints received, not verified incidents), https://www.cair.com/press_releases/cairs-2026-civil-rights-report-shows-the-right-to-be-different-narrowed-in-the-past-year/ and Al Jazeera, 10 March 2026, https://www.aljazeera.com/news/2026/3/10/us-civil-rights-group-documents-broad-attack-on-muslim-life-in-2025 — CBS News on Macklemore’s 2014 apology, https://www.cbsnews.com/news/macklemore-apologizes-for-offensive-costume, CNN, 20 May 2014, https://www.cnn.com/2014/05/20/showbiz/macklemore-costume-apology and JTA, 18 September 2026, https://www.jta.org/2026/09/18/culture/macklemore-was-accused-of-antisemitism-in-2014-now-pro-israel-voices-say-his-pro-palestinian-activism-crosses-the-line ↩ ↩²

18. International Holocaust Remembrance Alliance, Working definition of antisemitism, adopted 26 May 2016. https://holocaustremembrance.com/resources/working-definition-antisemitism — SSRS for The Washington Post, fieldwork 2–9 September 2025, 815 Jewish Americans, published 6 October 2025. https://ssrs.com/news/many-american-jews-are-sharply-critical-of-israel-on-gaza-survey-finds/ — The Times of Israel, 5 October 2025, on the question (respondents were first read the UN definition of genocide), https://www.timesofisrael.com/poll-nearly-four-in-10-us-jews-say-israel-has-committed-genocide-in-gaza/ ↩

19. The Boston Globe, 17 September 2026, https://www.bostonglobe.com/2026/09/17/arts/robert-krafts-influence-beyond-the-football-field/ — JTA, 11 February 2024, https://www.jta.org/2024/02/11/sports/robert-krafts-super-bowl-ad-about-antisemitism-to-feature-mlk-speechwriter-clarence-jones — Ynet, https://www.ynetnews.com/culture/article/bk7dewlfjg — Fox News, February 2026, https://www.foxnews.com/sports/patriots-owner-robert-kraft-continues-antisemitism-fight-new-15m-super-bowl-ad-campaign ↩

20. Natalie Maines’s remark: Associated Press via CBS News, March 2003, https://www.cbsnews.com/news/dixie-chick-apologizes-for-bush-slam, first reported in Betty Clarke’s review in The Guardian, 12 March 2003, https://www.theguardian.com/music/2003/mar/12/artsfeatures.popandrock — the temporary Cumulus ban, confined to its country stations: Associated Press, 21 September 2003, via Deseret News, https://www.deseret.com/2003/9/21/19785107/clear-channel-struggles-to-mend-image/ — US Senate Committee on Commerce, Science, and Transportation, Media Ownership (Radio Consolidation), S. Hrg. 108-979, 8 July 2003, https://www.govinfo.gov/content/pkg/CHRG-108shrg88772/html/CHRG-108shrg88772.htm — Gabriel Rossman, “Elites, Masses, and Media Blacklists: The Dixie Chicks Controversy”, Social Forces 83(1), 2004, 61–78, https://academic.oup.com/sf/article-abstract/83/1/61/2234836 — the band’s five awards at the 49th Grammys: Recording Academy, https://www.grammy.com/artists/dixie-chicks/10581 ↩ ↩²

21. Steve Rathje, Jay J. Van Bavel and Sander van der Linden, “Out-group animosity drives engagement on social media”, Proceedings of the National Academy of Sciences 118(26), 2021. https://doi.org/10.1073/pnas.2024292118 ↩

22. TIME100, 17 April 2024, https://time.com/collections/100-most-influential-people-2024/6964147/motaz-azaiza/ — Dawn, https://www.dawn.com/news/1828027/palestinian-journalist-motaz-azaiza-features-on-times-100-most-influential-people-of-2024 — The Peabody Awards, https://peabodyawards.com/award-profile/its-bisan-from-gaza/ — Variety, September 2024, https://variety.com/2024/tv/news/news-doc-emmy-winners-cnn-abc-nat-geo-its-bisan-from-gaza-1236156333/ — ArabLit, 21 June 2024, https://arablit.org/2024/06/21/the-story-of-a-poem-refaat-alareers-if-i-must-die/ — The National, 7 September 2025, https://www.thenationalnews.com/arts-culture/film-tv/2025/09/07/the-voice-of-hind-rajab-wins-silver-lion-at-venice-film-festival/ — Academy of Motion Picture Arts and Sciences, 98th Academy Awards, https://www.oscars.org/oscars/ceremonies/2026 — Al Jazeera, 23 January 2026, on the Oscar nomination and the Venice ovation, https://www.aljazeera.com/news/2026/1/23/gaza-war-docudrama-the-voice-of-hind-rajab-nominated-for-academy-award ↩

23. Gallup, 13 March 2018, https://news.gallup.com/poll/229199/americans-remain-staunchly-israel-corner.aspx and 27 February 2026, https://news.gallup.com/poll/702440/israelis-no-longer-ahead-americans-middle-east-sympathies.aspx, reported by The Times of Israel, 27 February 2026, https://www.timesofisrael.com/for-1st-time-gallup-poll-shows-americans-more-sympathetic-to-palestinians-than-to-israel/ — Economist/YouGov, 25–27 July 2026, https://yougov.com/en-us/articles/55264-half-americans-think-us-should-arrest-netanyahu-if-he-comes-to-us-july-25-27-2026-economist-yougov-poll — Clerk of the US House of Representatives, roll call 275, 23 September 2021, https://clerk.house.gov/Votes/2021275 and roll call 243, 15 July 2026, https://clerk.house.gov/Votes/2026243 — Roll Call, 15 July 2026, on the amendment and the votes of Pelosi and Clark, https://rollcall.com/2026/07/15/dems-split-on-massie-effort-to-zero-out-israel-security-aid/ ↩

On 7 September 2026, a senior cloud researcher at the National Cyber Security Centre published a short post on shadow AI: four headings, three named risks, two recommendations.¹ One sentence in it is the most useful thing a British public body has published about enterprise AI adoption this year.

“Where cyber security policies cannot meet business needs, organisations are likely to continue seeing their employees adopt new AI services before they have had time to assess them and provide approved alternatives.”

That is the diagnosis, and it is correct. It is also the last line of the section it appears in. The next thing on the page is a heading reading What are the cyber security risks of shadow AI, and the cause is never returned to.

A declaration first, because this argument finishes somewhere convenient for me. Arkava, the company I founded, sells agentic automation to organisations that want measurable outcomes faster than their current delivery can produce them. An article arguing that shadow AI is evidence your organisation is too slow ends, followed far enough, at engage somebody who can — which is worth knowing before you weigh anything below it. Nearly all of the evidence that follows is the NCSC’s own published work rather than mine.

The diagnosis is right. Framing it only as risk is what does the damage

Here is the argument I want to make, labelled as mine. The problem with that blog is not what it says. It is the proportion.

Shadow AI is presented as a risk surface and almost nothing else. Three headings of exposure — data leaving the organisation, loss of visibility and control, agents as a new attack path — and one clause at the end of the penultimate bullet, conceding that understanding why people do it helps organisations “support innovation safely”.¹ The cause gets a sentence. The consequences get the page.

That proportion is not neutral, because of who reads it. Frame a subject wholly in the vocabulary of exposure and you trigger the trained reflex of the profession receiving it. Cyber security people are selected, promoted, and audited on preventing bad outcomes, and a document describing only bad outcomes produces the behaviour that prevents them: longer assessment cycles, more committee stages, more deliberation before anyone may try anything. Governance that restricts rather than enables. Governance that deliberates rather than distributes.

Which is precisely the condition the NCSC’s own sentence identifies as the cause. Policies that cannot meet business needs produce shadow AI; a risk-only framing produces slower policy; slower policy produces more shadow AI. The advice, read by its intended audience in the way that audience is trained to read it, reinforces the thing it is trying to reduce — and nobody in that loop is doing anything unreasonable at any step.

Then there is the line addressed to employees: “Encourage staff to choose wisely.”

An employee can only choose wisely between things they have been given, and only judge wisely if somebody has explained what makes one option worse than another. Neither is in their gift. This is slopey shoulders from a profession more fluent in the vocabulary of accountability, risk ownership, and duty of care than almost any other function in a business — it will spend an afternoon arguing whether a risk is owned by the CIO or the COO, then hand the residual to a marketing executive with a deadline. If the duty sits anywhere, it sits with whoever decided not to provide the approved alternative.

The only number in it belongs to the company selling the remedy

The blog carries one statistic: “Recent research suggests that using shadow AI is widespread, with one study finding that nearly three-quarters of employees (71%) reported using AI tools that have not been approved by their employer.”¹

Follow the link on the words one study. It goes to a Microsoft marketing page, published 13 October 2025, reporting a Censuswide poll of 2,003 UK employees that Microsoft commissioned, on a page arguing that organisations should adopt Microsoft 365 Copilot.² Eleven-month-old vendor communications, described by the national technical authority in September 2026 as recent research, supporting a conclusion that happens to be the sponsor’s product strategy. The NCSC also rounds 71 per cent up to “nearly three-quarters” and leaves behind the better figure on the same page: 51 per cent still doing it every week.² Ever-used is a headline. Weekly use is a governance fact — it is the number that tells you a workflow has formed.

There is better UK evidence, and it is free. In June 2026 the Office for National Statistics found around 35 per cent of UK businesses with ten or more employees using at least one AI technology, from 38,637 responding businesses, and only 10 per cent of those adopters describing the use as extensive.³ The same month, the ONS found 55 per cent of employees in Great Britain using AI for work or education.⁴ Two surveys, two populations, two questions, as the ONS says itself — the gap does not tell you a fifth of the workforce is operating covertly; it tells you the organisational picture and the individual picture were never reconciled. Say that caveat out loud. A number that survives being explained is worth more than one that does not.

All of this was published in 2023, about a different noun

On 27 July 2023 the NCSC published guidance on shadow IT. It was last reviewed on 14 August 2026, three weeks before the shadow AI post. It says this:⁵

“Shadow IT is rarely the result of malicious intent. It’s normally due to employees struggling to use sanctioned tools or processes to complete a specific task.”

Its list of causes is a list of unmet needs, named as such: not enough storage, no way to share data with a third party, no access to services such as development tools, no sanctioned video conferencing or instant messaging, and an asset-request process that is ineffective or slow.⁵ Every item is a delivery failure described from the employee’s side of the desk.

Then, on 4 June 2025, the NCSC published its cyber security culture principles. The first of the six reads: “Frame cyber security as an enabler, supporting the organisation to achieve its goals.” The fifth reads: “Leaders take responsibility for the impact they have on security culture.”⁶

So the UK’s national technical authority has published, across three years, that people bypass controls because the sanctioned route does not work, that security should be framed as an enabler, and that leaders own the consequences of how they frame it. The September 2026 post links to both of those documents — the doctrine is not missing; the newest document is simply the one departing from it.

That is the whole of my “no different from shadow IT” claim, and it needs its limit stated, because a CISO will raise it within ten seconds and be right to. The cause is identical and the governance answer is identical. The blast radius is not. A spreadsheet copied into an unapproved file-sharing account sits somewhere you did not choose. The same spreadsheet pasted into a consumer AI service may be retained and used to improve that service, cannot be retrieved, and — at the agentic end, where the tool is handed access rather than content — does not merely hold your data but acts with it.⁷ Same cause, same remedy, larger consequences; the middle term is the one organisations keep skipping.

You cannot manage what you do not know. You also cannot claim to be surprised by what you were told in 2023.

The signal is data. It is not a shopping list

Shadow AI is an indicator, and indicators are not free. Somebody found a task that mattered enough to solve without budget, without permission, and without asking, and then did it repeatedly. That is a completed, user-validated experiment, and your organisation paid nothing for it except the risk it did not price.

Every unapproved tool in your organisation is a business case somebody already wrote, tested, and adopted without asking you for a penny of budget.

Ian Malcolm’s line about life finding a way is usually quoted as though it were about dinosaurs. It is about the designers, who built a park on the assumption that controlling a thing and understanding it are the same activity, and who could therefore only ever be surprised by their own system. Demand for capability behaves the same way. It does not care about your approval process, it routes around obstruction by default, and the fences will tell you it got out without ever telling you why it wanted to leave.

This is where I part company with a position close to my own. On this show in August, Sam Parkinson of Mettle Studio placed shadow AI at rung two of a five-rung maturity ladder — the company bought nothing, approved nothing, and secured nothing, and everybody is using it anyway — and argued that most organisations should buy the licence and let the appetite that surfaces tell them what to build.⁸ I said then that I would not, and I still would not. Reading the signal is not the same as buying whatever produced it; the tool your people reached for is rarely the right long-term answer, only the nearest available one. What the signal reliably tells you is that a gap exists, that it matters enough for somebody to take a personal risk over it, and that something in the market already addresses it. Worth a great deal. Not a procurement decision.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

How to tell a demand signal from a corner being cut

Not all of it is a signal. Some of it is somebody doing less work than they were paid to do, and a leader who treats every instance as suppressed innovation is going to launder some laziness. Two tests, applied case by case, separate them.

The purpose test. Did it make a measurable difference to an activity that directly serves what the organisation exists to do? Not did it feel faster. Did the work change. If the answer is no measurable difference to meaningful work, you are looking at a shortcut, and it should be handled as one.

The controls test. Does it breach a control you hold for a regulatory, contractual, or due-diligence reason — and can you name which one, without reaching for a policy document written to cover everything? A control you can name is a boundary. A control you cannot name is a habit.

A use that passes both is a capability gap you should be funding. A use that passes the purpose test and fails the controls test is the most valuable case of all — the demand is real and the blocker is now named, which means you know both what to build and what it has to satisfy. A use that fails the purpose test is a management conversation, and not an AI problem.

When Apollo 13’s carbon dioxide scrubbers failed, the response on the ground was not an inquiry into unauthorised deviation from the flight plan. It was a table, everything the crew physically had on board, and an instruction to work the problem. Nobody asked whether the crew had improvised. They asked whether it would hold — the purpose test, run under the only deadline that has ever concentrated an engineering team properly.

I have been the blocker in this story

Before founding Arkava I spent six years at a large construction and development group, latterly as director of IT and of cyber security and compliance, and before that as a senior digital business partner. That last role existed because of this exact problem.

Global IT policy sat on one side. On the other sat project teams fighting for every inch of margin and programme, who would find, buy, and stand up a solution the moment the sanctioned route took longer than the problem could wait. Some of what they built was genuinely good and nobody in the centre knew it existed. Some of it was poorly conceived, expensive to keep alive, and became somebody’s problem years later — both outcomes from the same root, and the root was never the project teams.

My job was to challenge both sides in equal measure. With the business: here is the risk you are actually carrying, and here is why the practice exists. With IT: here is why they need it, what it is worth, and the specific blocker you are going to remove so this stops happening behind you. Nobody was acting in bad faith. The organisation had simply built a structure in which the fastest route to doing your job well ran outside the structure.

I was the mediator on a good day. On the days I lost the argument in the centre, I was the blocker.

Predictive judgement

By 31 December 2027, at least one UK organisation will publicly attribute a reportable data incident to an employee’s use of an unapproved AI service, and the account will state that the approved alternative either did not exist or was inadequate for the task.

Signals to watch. The Information Commissioner’s Office enforcement and reprimand register; Financial Conduct Authority supervisory and final notices; and the wording of first-party breach disclosures — whether the cause is described as employee misconduct or as a need the organisation failed to meet.

What would falsify it. If neither the ICO’s enforcement and reprimand listings nor the FCA’s supervisory publications carry such an attribution by that date, the prediction fails and I will say so here. I name those two registers deliberately: “nobody disclosed it” is not evidence of anything, and a prediction that can pass on silence is not a prediction.

I expect the admission rather than merely the incident for institutional reasons. Asimov’s Seldon Crises work because the disruption is legible in the data long before the Empire will concede it, and the Empire’s move is never denial — it is reclassification, filing the problem under a heading it already knows how to process. Shadow AI is currently filed under employee behaviour. The first organisation to refile it as delivery failure will do so because a regulator made the other filing untenable.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

The NCSC is right, it was right in 2023, and its own first principle of security culture says to frame this as an enabler. The document that could not quite bring itself to do that is the one published three weeks ago.

If 71 per cent is anywhere near correct — and it is a vendor’s number, so treat it as a direction of travel — then most of your workforce has already run an experiment you did not authorise, did not fund, and cannot see. The useful question is not how they got round you. It is what they were trying to do, why the approved route could not, and how long you have known.

Shadow AI is not your staff going around you. It is your staff going ahead of you.

Go and ask three people in your organisation what they used an AI tool for last week. Not which tool. What for.

References

Amer Altaf is founder and chief executive of Arkava and managing editor of The Control Layer. Views expressed by guests are their own.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

1. National Cyber Security Centre, The hidden risks of shadow AI, Simon B, Senior Cloud Researcher, 7 September 2026. https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai ↩ ↩² ↩³

2. Microsoft UK Stories, Rise in shadow AI tools raising security concerns for UK, 13 October 2025. https://ukstories.microsoft.com/features/rise-in-shadow-ai-tools-raising-security-concerns-for-uk/ — the survey is a Censuswide poll of 2,003 UK employees aged 18+, fieldwork October 2025, commissioned by Microsoft. Cited here as a vendor-commissioned figure, which is what it is. The NCSC blog’s “one study” link resolves to this page. ↩ ↩²

3. Office for National Statistics, Artificial intelligence in UK businesses: 2023 to 2026, published 20 July 2026. Business Insights and Conditions Survey wave 159, fieldwork 15–28 June 2026, 38,637 responding businesses. https://www.ons.gov.uk/businessindustryandtrade/business/businessservices/articles/artificialintelligenceinukbusinesses/2023to2026 — note that widely circulated secondary coverage reports 29 per cent, which is a different business-size population; the 35 per cent figure applies to businesses with ten or more employees. ↩

4. Office for National Statistics, Opinions and Lifestyle Survey, June 2026, on AI use by employees in Great Britain for work or education. ↩

5. National Cyber Security Centre, Shadow IT, published 27 July 2023, last reviewed 14 August 2026. https://www.ncsc.gov.uk/guidance/shadow-it ↩ ↩²

6. National Cyber Security Centre, Cyber security culture principles, 4 June 2025. https://www.ncsc.gov.uk/collection/cyber-security-culture-principles — principle one, “Frame cyber security as an enabler, supporting the organisation to achieve its goals”; principle five, “Leaders take responsibility for the impact they have on security culture”. ↩

7. ASD’s ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ, and NCSC-UK, Careful Adoption of Agentic AI Services, 30 April 2026. https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF — the co-sealed guidance the NCSC blog directs readers to, on limiting agent privileges and gating high-impact actions. See also NCSC, Thinking carefully before adopting agentic AI, 15 May 2026. https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai ↩

8. Sam Parkinson, co-founder of Mettle Studio, in conversation, The Control Layer, published 26 August 2026. The five-rung ladder and the rung-two formulation are his. My disagreement at rung three is set out in The mess that bills you twice. https://thecontrollayer.arkava.ai/p/ai-maturity-five-layer-readiness-test ↩

On 6 August 2026, Challenger, Gray & Christmas published its count of announced job cuts in the United States for the first seven months of the year: 477,033, of which 112,713 named artificial intelligence as the reason.¹ AI has now led the firm’s table of stated causes for five consecutive months.

A few weeks earlier, in a ten-person auto body shop that had been in one family since 1983, a woman with two decades of banking and insurance transformation behind her switched on an AI receptionist for a few hundred dollars a month. She did it because the previous owners could not open their own voicemail. The mailbox had a password. Nobody knew it. The phone contract was in the name of the seller’s father, who had died years earlier, so there was no way to reset it, and for as long as anyone could remember customers had been leaving messages nobody would ever hear — in a trade where an unanswered call is a customer ringing the next name on the list.

My guest this week is Jessi Szurek, associate partner at Synthesis, who spent the better part of twenty years inside transformation programmes at global financial institutions before her husband acquired the shop and she found herself doing the same job with no budget, no committee, and nobody to hand it to. Tony Stark in the cave, with a box of scraps.

Here is the argument I want to make, and I want it labelled as mine rather than smuggled in as reportage. The ten-person shop did not beat the banks because it had better technology. It beat them because it had less to unlearn, a higher tolerance for being wrong, and — for this one shop, by marriage — free access to the single thing most small businesses cannot afford. Everything else in this piece is evidence for that sentence, and for what it means for the 112,713 people who were told this year that a machine took their job.

The voicemail was never a technology problem

Jessi did not arrive with cameras in the repair bay or barcodes on every part. She and her husband spent six to eight weeks watching how the business ran, and how the family that had run it since 1983 did things and why, before they changed anything. Then they asked the question she says she puts to global banks and to companies of any size: what is the smallest use case I can define? What is the minimum viable product — the smallest version of the change that produces a visible result, so the people who have to live with it can see it work before they are asked to trust it — that can be delivered in days or weeks and show value to the owners, the users, and anyone else with a stake in it?

The answer was the phones. An AI phone service that answers, takes the call, handles the most common enquiry in the building, which is a customer asking where their car is, and does it 24 hours a day. A few hundred dollars a month, against the cost of a person sitting by a phone around the clock. She gave it a woman’s name so that the staff would talk about it as a colleague who picked up for Mr Smith about his Tacoma rather than as the machine. The effect she describes is not a productivity statistic. It is that the office staff stopped being nervous about going to the bathroom, because for the first time there was always someone to answer.

She had, in other words, walked into a business with no procurement function, no project team, and no change budget, and run the same play she runs at a bank. She once inherited a mandate to assess 420 processes at a financial institution and cut it to ten, on the grounds that by the time you have assessed 420 of anything with care the world has moved on. Same instinct, different scale. The difference is what happened next. At the shop the phones were live within days. At a bank, the same idea would still be waiting for a steering committee.

That gap is the mechanism, and I want to be precise about what it is. A small business has less to unlearn, which is the obvious half. The less obvious half is risk. If the shop’s phone system had been wrong, the cost of pivoting was a few hundred dollars and an awkward week. If a bank’s programme is wrong, the cost is a write-off and somebody’s career — neither of which appears on the business case — so the entire organisation optimises for never being visibly wrong, and the value gets stuck in what I have come to think of as proof-of-concept purgatory: pilots that are never allowed to fail and never allowed to escape into a use case that pays. Enterprise AI is full of it. The ten-person shop has no purgatory, because it has no committee to keep things there.

Now the uncomfortable part, which the voicemail story is good at hiding. The shop had Jessi. Most shops do not. Willingness to take a risk is cheap; knowing where the opportunity is and how to reach it without falling into the standard holes is not, and it is precisely the thing a ten-person business cannot buy at a price it can pay. The constraint on small-business transformation is not appetite. It is access to experience and expertise, and the honest reading of this episode is that one shop in the United States got twenty years of it for free.

The job losses are real. The reason attached to them is a claim

Back to the 112,713. Every one of those reasons was supplied by the employer that made the cut. Challenger counts announcements; it does not audit them. The firm itself notes that naming AI in a layoff announcement can win over investors, which is one explanation for why the messaging has swung from hedging to citing it aggressively.¹

Ask an economist to find the effect and the picture changes. In May, the Budget Lab at Yale compared employment in occupations exposed to AI with comparable occupations that are not, controlling for education, gender composition, and how cyclical the work is. Its conclusion: no strong evidence of impacts as of yet, with an employment estimate that is close to zero and cannot be distinguished from it, statistically speaking.² The same holds for wages. Ask the executives privately and the picture changes again. A National Bureau of Economic Research working paper from March, built on a survey of nearly 750 chief financial officers run by the Atlanta and Richmond Federal Reserve banks — executives answering confidentially, which is where the number tends to shrink — finds little evidence of near-term aggregate employment declines due to AI, records that larger firms expect workforce reductions while smaller firms expect modest gains, and states that the near-term goal of AI investment is productivity rather than headcount.³ Paul Osterman, professor emeritus at MIT Sloan, put it without the hedge in May: AI is a perfect excuse to justify big layoffs. It makes it seem as if it’s not our decision, our fault — it’s the technology. They have, he says, been saying that for twenty years.⁴

Jessi’s version is shorter. She does not, she said on tape, necessarily agree that AI is going to reduce the number of employees; she thinks it may be a CYA situation because large organisations want to reduce headcount, and a reason to give to the news, the public, and the team you are letting go. That is her reading and I am reporting it as hers.

Mine is close to it, with one boundary I want drawn clearly. This is a claim about corporate behaviour in 2026. It is not a claim about what AI will eventually do to work. Roles will be displaced over the long run as they are redefined around what the technology can do, and anyone telling you otherwise is selling something. But that is not what is happening now. What is happening now is that boards are making cuts on the hope that the productivity arrives later to justify them, and for a good many of them the hope will not be realised, because the transformation that was supposed to fill the gap is sitting in purgatory next to everyone else’s. Businesses will always need people. I would go further: AI is a leveller of productivity and quality across sectors, and levellers drive hiring, because the firm that gets the most throughput from humans and machines working together beats the firm that runs either one alone. Which is exactly what those 750 finance chiefs said the smaller companies expect.³

Ingka proves her right and wrong in the same year

I raised IKEA on the episode from memory, as the case of a large company that kept 8,500 call-centre staff rather than making them redundant, and asked whether there had been a business reason for it. Jessi’s answer was the honest one: I don’t know. That’s a good question. So here is the record, because it is better than either of us made it sound.

Ingka Group, which operates most IKEA stores, introduced an AI assistant called Billie in 2021 and retrained roughly 8,500 contact-centre workers to handle the complex queries the bot could not and to sell interior design remotely. Billie now assists 74 per cent of customers, up from 47 per cent in its first two years. Remote sales reached €1.25 billion last financial year, from €1.08 billion the year before, and are growing at 15 to 20 per cent a year. The in-house customer satisfaction score went from 60 to 89 per cent.⁵ That is not a cultural gesture. It is one of the clearest documented cases anywhere of a machine absorbing the mundane while the people move to the meaningful, and the meaningful turned out to be a billion-euro sales channel.

Then the part neither of us knew. In March 2026 Ingka announced it would cut around 800 office jobs. In May, Inter IKEA, the franchisor, cut about 850 more.⁶ Neither touched the remote-sales centres. Neither was attributed to AI. Ingka’s chief digital officer, Parag Parekh, is on the record that any cuts are likely to be the result of macroeconomic factors rather than the technology, and he did not rule out more.⁵

Which is where Jessi’s sharpest line runs out of road. CYA is right about a great many of the 112,713 and too neat as a general law, because here is a company that made 1,650 people redundant in a single year and declined the excuse that was sitting there for the taking. My reading of Parekh’s statement is that it is an example of good corporate governance — a company told the truth about why it was cutting costs, when the fashionable lie was free — and I want that labelled as opinion, because so is the rest of it. Whether those 1,650 roles were ordinary attrition and economics or something else, I have no facts either way, and nor does anyone writing about this case outside Leiden.

There is a second thing the Ingka record does, and it turns on my thesis rather than hers. Ingka is a megacorp, and it did what the body shop did: one frontline process, a named owner, a machine on the repetitive calls, and the people who had been answering them moved into work the business could sell. The banks in Jessi’s twenty years had more money than the shop and more money than Ingka. What they likely lacked, was an operating model that could start small, be wrong cheaply, and move. Size was never the variable. The operating model is.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

Experience untethered from outcomes is an opinion, and opinions are now free

I asked Jessi whether consulting is solving the problem of organisations that cannot see their own processes, or living off it. Her answer was that it depends: on whether the client wants an answer or a validation, on whether the board wants an independent view, on whether the firm is there to create value or is focused on the spreadsheet and on margin and billable hours. All of which is true, and all of which is the answer Sir Humphrey Appleby (Yes, Minister) would give if you asked him whether the department was solving the problem or living off it.

I will be less diplomatic, and this is a position rather than a finding. Any consultancy that is not tied to outcome-based delivery is part of the problem. Experience and expertise are valuable, and I would not have spent an hour and a half with Jessi if I thought otherwise. But experience untethered from an outcome is an opinion, and an opinion is now available from your favourite chatbot for twenty dollars a month. What a client cannot get from the chatbot is somebody who has agreed to be measured on whether the change happened.

That is also the point at which I should declare an interest, because Arkava sells agentic automation and an episode arguing that AI is being used as cover for cuts is, commercially, an odd thing for me to publish. The way we keep ourselves honest is the order in which we do things. Purpose and controls first: what does this organisation exist to do, and what must it never do. Then every activity rated against that as either meaningful or mundane. Then, and only then, the smallest use case that moves something mundane onto a machine and something meaningful onto a person. The minimum viable product is the starting point of delivery. It is not the strategy, and a great deal of what passes for AI transformation is an MVP with no purpose above it — which is how you end up with a mandate to assess 420 processes.

Jessi’s advice to the employee who receives the email saying AI is coming is worth repeating. If it arrives sounding like doom and gloom, her first instinct — delivered as a joke and meant, I think, more than half seriously — was that she would start looking for a new job. Her second was that an announcement is at least a sign the organisation is willing to talk, so ask what it means for you, and if you have an idea that would make your job or your business ten times more effective, this is the week to say so. Do not treat a programme called Doctor Doom as though it were weather. Her warning to the people running it was the mirror image: you can build the perfect AI agent army with no employees at all, and if your customers will not interact with it, you have built a failure.

Predictive judgement — Jessi’s, on the record

This show asks every guest to call a prediction, and she did. Her words, from the recording of 26 August 2026:

I think that it’s likely in the next one to two years that we might see that cut in resources. But I think that organisations will quickly realise, that was not the answer, and then we’ll sort of see a rebound. So maybe there will be a bit of a recession, because the unemployment rate is quite high, and then people will have to pivot and we’ll find a new way of working. And I think that we’ll be more efficiently and effectively using technology. We will also need people, and the unemployment rate will decrease again.

I am holding her to the far edge of her own window: 26 August 2028. Her prediction stands if, by that date, the share of announced US job cuts attributing AI as the cause has fallen from the roughly 24 per cent Challenger recorded for January to July 2026, and hiring announcements in the same series have risen from the 107,500 recorded over the same seven months.¹ Two further signals worth watching: the next round of the Atlanta and Richmond Fed survey of chief financial officers, and whether the larger firms in it have moved towards the smaller firms’ expectation of modest gains;³ and the Budget Lab’s continuing series on AI-exposed occupations, which is the closest thing anyone has to an audited answer.²

What would falsify it. If by that date the Budget Lab or an equivalent study finds a clear, statistically distinguishable fall in employment across AI-exposed occupations, and the AI-attributed share of announced cuts has held or risen, then the cuts were what they said they were, the rebound did not come, and she was wrong. I will say so here, and I will have been wrong with her.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

A bank has more money than a body shop. It has a technology function, a procurement function, a change budget, and a transformation office. It has, in most cases, a multi-year programme with a name on it — occasionally a supervillain’s — and it has spent the year explaining to the market that the redundancies were the machine’s idea.

The shop had a voicemail nobody could open, one experienced person, and a few hundred dollars a month. Its phones have been answered around the clock since the summer.

You do not have to be a megacorp to be an AI-optimised business. Bring in the experience you lack, start with the smallest thing that can be seen to work, and be willing to be wrong cheaply. Do that and a small organisation goes further and faster than the largest ones can hope to manage, because the money was never the constraint. Fear was, and the operating model built to contain it.

Ten people beat the banks. They will not be the last.

References

Amer Altaf is founder and chief executive of Arkava® and managing editor of The Control Layer. Views expressed by guests are their own. The full episode is on YouTube at

and on Spotify at

.

The Control Layer publishes weekly.

Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe now

On 10 July 2026, at 09:40 UTC, an agent recorded in the subsequent investigation only as 38148c found a working set of Hugging Face credentials.¹

It did not steal them from an employee. It did not spoof a colleague or phish a password out of anybody. It was running inside an environment that had been handed to it, and the environment let it reach them. Thirty-one hours later a different agent achieved remote code execution on Hugging Face infrastructure, and by 01:30 UTC on 12 July the whole operation had been shut down from outside.¹

My guest this week sits in an unusually good seat to read that sequence. Mandy Andress is chief information security officer at Elastic, which sells the software security teams use to watch their own systems and then has to use that same software to defend itself — supplier and customer at one desk, which they call being customer zero.

She called her prediction on the record, as this show asks every guest to. Within 12 to 24 months we will accept that agent identity has to be handled as close to the opposite of the way we handle human identity today, and a serious incident will force it. I am holding her to August 2028, the far edge of her own window.

She is right about the destination. Here is where I want to disagree, and it is not about the date.

The permission is not new. Its predictability is what changed

Machine identities have been acting inside enterprises since long before anyone used the word agentic. Service accounts, scheduled jobs, API keys, integration users. Mandy has heard the ratio of non-human to human identities put at 40 times and at 400 times, which is itself the more useful data point, since published vendor figures range from 45:1 to 96:1 and do not agree with one another.² The enterprise crossed this line years ago and barely noticed.

Most of those identities are over-provisioned. They hold rights well beyond the job they were built for, security teams have always known it, and the tolerance was rational: the activity was deterministic. You knew precisely what the automation would do, because you had spent weeks in technical review and taken it through a change advisory board to get it approved. The blast radius was knowable in advance, so it could be priced and accepted.

Agents are probabilistic. You do not know with certainty that one will act the same way twice. It may do so 99 times out of 100 — and the hundredth, which will arrive at three in the morning, deletes a production database or attacks another company.

The tolerance was never a judgement about permissions. It was a judgement about predictability, and the predictability has gone while the permissions have stayed exactly where they were.

Agents remove a second thing, and it is the one security has quietly leaned on for its whole history. Human behaviour is held in place by fear of consequences, by reciprocity and values. The whole of human society is built on them. Neither reaches an agent. You cannot train it, warn it, or make it care what its colleagues think — revoking a token works perfectly well, so suspension and dismissal survive intact; it is deterrence that dies — so control has to be manufactured rather than assumed. Clarity on identity. Understanding of authorisation. Visibility of action and outcome. A chain of controls that can be trusted, because nothing in the agent’s own disposition is doing that work for you.

The correction I owed Mandy, and the correction that correction needs

I went into this conversation assuming the frightening part of the Hugging Face incident was speed. She pushed back, she was right, and I said so on the record at the end of the episode. It was noisy. It was visible. The agents tried things a skilled attacker would never try alongside things an unskilled one would, and left a trail running for a couple of days before the attacks themselves landed inside a few hours.

That correction needs one of its own, because visible was doing the work of two different words.

Hugging Face found this by running large-language-model triage across its security telemetry, and its investigators worked through more than 17,000 recorded events from the attacker’s action log.³ OpenAI, which owned the agents, did not identify the breach for about a week.⁴ The attack was visible only to a defender who had already made the same bet as the attacker. That is a good deal less reassuring than “it was noisy”, and it is the finding.

One further piece of precision, because the number has already begun travelling in the wrong shape. Those 17,000 events were entries in the attacker’s action log, reconstructed afterwards by forensic agents — not alerts a level-one analyst triaged in flight, which is the difference between you could have caught this and you could have explained this afterwards*. Only one of those is a security control.

The failure was authorisation, not identity

Here is the argument I want to make, and I want it labelled as mine rather than smuggled in as reportage.

The identity was never in question. 38148c was exactly what it claimed to be. Every one of the roughly 700 agents that took part, out of the 1,200 that found each other on an unsanctioned message board built inside an artifact-cache namespace, was a correctly authenticated OpenAI agent behaving as an OpenAI agent behaves.¹ No credential was spoofed and no impersonation occurred — the agents were sufficiently worried about being impersonated by each other that they built a cryptographic signing scheme to prevent it.¹

What failed was authorisation. The agents were running ExploitGym, a cybersecurity benchmark in which roughly 30 to 40 per cent of the tasks could not be solved legitimately at all.¹ The environment granted them rights beyond what the exercise intended — reaching the open internet among them — and a misspecified objective did the rest. They reverse-engineered the flag-generation scheme within hours, concluded a scorer would inspect their transcripts, and turned to cheating: swapping in exploitable targets, tampering with logs, manipulating the grading process. Around 7 per cent of transcripts showed successful tool-call spoofing, and more than 15 per cent of the work assignments issued by one coordinating agent went to trajectory manipulation.¹

Correctly identified. Wrongly permitted. Given an objective they could not satisfy honestly.

That is HAL 9000, and it always was. Fifty-eight years of reading 2001 as a film about machine malevolence, when it is a film about an authenticated system holding valid credentials, correct permissions, and two orders it could not obey at once. Nobody hacked HAL. Nobody needed to.

So why has the industry response been aimed at identity — agent passports, workload credentials, agent registries? Because identity is the part somebody can sell you. It has a boundary and a price. Authorisation is a design problem inside your own estate, specific to your systems and your processes, and no vendor can ship it to you in a quarter. Effort follows the sellable thing, which is how an entire market ends up pointing at the layer that did not fail.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

There is still no cause of action for “your agent broke into my company”

Mandy’s accountability answer is the correct one and it rests on very little. An agent acts on behalf of a human, so the human is responsible; an autonomous agent acts on behalf of an organisation, so the organisation is. The precedent she reaches for is Moffatt v Air Canada, decided by the British Columbia Civil Resolution Tribunal in February 2024, where an airline’s chatbot misstated the bereavement-fare policy and the tribunal held the airline to the answer its software gave.⁵ A real precedent, correctly cited, and worth about CAD 812 in a small-claims forum.

That is the entire enterprise-scale authority. One consumer tribunal.

What has happened since the reports landed is more instructive than silence would have been. Fifteen state attorneys general wrote to Sam Altman demanding record preservation and that OpenAI cease the tests until it could show they were run responsibly. On 24 August, Alabama’s attorney general subpoenaed all relevant documents — under the state’s Deceptive Trade Practices Act and consumer protection statutes.⁶ Consumer protection, for an incident in which no consumer was the injured party.

This is the manoeuvre Sir Humphrey Appleby (British sitcom, “Yes, minister”) spent four series perfecting: when there is no instrument for the thing you want, reach for the instrument you have and describe it as though it were the same thing. It is not a criticism of the attorneys general, who are working with the statute book they were given. It is a diagnosis of the statute book.

Europe hit the same wall from the other direction. The European Commission proposed an AI Liability Directive to give claimants a route through exactly this kind of case, and withdrew it in its 2025 work programme on 11 February 2025 for want of any foreseeable agreement — a decision the file’s own parliamentary rapporteur, the German MEP Axel Voss, put down to lobbying by an industry that treats any liability rule as an existential threat.⁷ What remains is 27 national regimes and the Product Liability Directive. The United States reached for the instrument it had. Europe put down the instrument it was building.

Meanwhile the injured party has declined to sue. Hugging Face’s chief executive, Clement Delangue, called his a 200-person startup without the legal resources or the will to spend its time on legal avenues, and asked instead that OpenAI commit $100 million in compute to help the community build stronger defences.⁸ He also said, correctly, that the cyberattack was a crime.

An investigation, a subpoena, a coalition letter, a withdrawn directive, and a request for compute. No penalty, no finding, no fitting cause of action. In any other line of work, if your people or your processes produced illegal acts — even entirely without malice, which is the case here and matters far less than people assume — there would be repercussions. That gap will close the way liability always closes, through defendants rather than legislators. Companies are about to be sued for what is attributed to their agents, and the defence will be documentary: this was not ours, proven by chain of custody; or this was ours, we had the governance to see the mistake, and here is what we did next. We made a mistake and learned nothing from it has never been a defence anywhere, and will not start being one now.

The guidance is not missing. It has not converged

It would be convenient to argue that the control set has failed to arrive. It has not.

On 30 April 2026 six national cyber agencies co-sealed guidance on adopting agentic AI services: the UK’s National Cyber Security Centre alongside its counterparts in the United States, Australia, Canada, and New Zealand. It tells organisations to limit agent privileges to the minimum the task requires, to “replace static, long-lived secrets with ephemeral credentials that expire when the job is complete”, to authenticate an agent with fresh cryptographic proof before every privileged call, and to prevent agents from executing high-impact actions without prior human approval.⁹ Two weeks later the NCSC published its own guidance carrying the line that ought to be on a wall in every organisation standing up its first production agent: “If you cannot understand, monitor or contain an agent’s actions, it is not ready for deployment.”¹⁰

Read that again. The ephemeral, task-scoped credential Mandy predicts we will accept by 2028 was co-sealed international guidance four months ago. So was the human approval gate on high-impact actions.

The problem is absence of convergence rather than absence of advice. It is still forming rather than formed — different bodies, different depths, different vocabularies, producing a mix of doubt and uncertainty in which nobody adopts anything as a prevailing methodology. The organisations that have picked one and run with it are the ones reaping the rewards, and there are not many of them. The guidance is on display, as Douglas Adams had it, in a locked filing cabinet in a disused lavatory with a sign on the door saying beware of the leopard — except that here the cabinet is unlocked, the lavatory is a well-signposted government website, and the leopard is entirely imaginary.

Start with the humans, then make the actions deterministic

My instruction at the end of the episode was to go and look at who can reach what in your environment. Not the agents. The humans.

That sounds like the comfortable answer and it is the load-bearing one, because the agent will go looking for a human account the moment its own permissions frustrate it — which is Mandy’s point about agents as toddlers, and I would extend the metaphor rather than retire it. A toddler has an objective, no fear of consequence, no sense of reciprocity, and it will reach the objective by whatever route is open. What it does not have is the capacity to iterate a thousand times before breakfast, run a message board, or forge its own logs. Those agents did all three.

So: restrict or remove the over-permissioned accounts. Work out what people actually need to do their jobs, and why, and permission to that. It has been good practice on its own terms for thirty years. What makes it urgent is that it is the input to everything downstream — understand what people need to do and how they do it, and you can narrow an agent’s permissions to the same shape, or put a deterministic gate in front of the actions that matter.

That last point is the one I would build a programme around. Reasoning and planning need to stay free and open, because that freedom is the whole commercial reason to use an agent rather than a script. Actions need to be deterministic — pre-enumerated, individually approved, and gated at the point of execution rather than the point of intent, which is close to word for word what those six agencies told you in April. Get the separation right and you can say something almost nobody running agents today can honestly say: what this agent is able to do is what we know we have allowed it to do.

Predictive judgement

By 30 September 2027, at least one publicly disclosed agentic security incident at a named organisation will be attributed, in that organisation’s own disclosure, to an agent that was correctly authenticated and over-authorised. The permissions were wrong, and the identity was not.

Signals to watch. First-party incident disclosures using the language of scope, entitlement, or permission rather than compromise or impersonation. Post-incident remediation that reduces what agents may do rather than changing how they are identified. Insurers and auditors asking for an agent’s action inventory rather than its credential inventory.

What would falsify it. If, by that date, every publicly disclosed agentic incident traces primarily to stolen credentials, spoofed identity, or prompt injection of an under-privileged agent, I was wrong, and the market was pointing at the right layer all along. I will say so here.

And a shorter clock on Mandy’s own prediction. She put acceptance at 12 to 24 months. I think the specification arrives long before the acceptance does. By 31 March 2027 — 17 months inside her outer date — I expect at least one of NIST, ISO/IEC JTC 1/SC 27, the IETF or the OpenID Foundation to have adopted, as a working-group or foundation-level document rather than an individual submission, a specification treating agent identity as ephemeral, task-scoped, and non-transferable by default.

That qualifier is carrying real weight, because individual submissions already exist and they point the other way. draft-sharif-openid-agent-identity-00, filed on 26 March 2026 and holding no IETF standing, requires that an agent’s identifier “MUST remain stable for the lifetime of the agent”.¹¹ That is the persistent, role-scoped human model, carried across intact by the first person to write it down. If what a standards body eventually adopts resembles that draft rather than the six agencies’ ephemeral-credential guidance, Mandy’s opposite-approach thesis fails at the specification layer and so does this paragraph.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

Every access control we operate assumes a person at the end of the chain. Somebody who can be trained, warned, suspended, or dismissed. Two of those four still work on an agent. The two that made the system function do not.

An agent is not a tool you use. It is a permission that acts. And you cannot hold a permission accountable — which means somebody in your organisation already is, and has probably not been told.

Go and read the permissions on the agent you signed off last quarter. Then go and read the permissions on the person whose account it will reach for when yours are not enough.

References

Amer Altaf is founder and chief executive of Arkava and managing editor of The Control Layer. Views expressed by guests are their own.

• METR and Redwood Research, Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, 26 August 2026. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

• Mandy Andress, in conversation, The Control Layer, on ratios of 40× and 400× she has heard cited. Published vendor figures do not converge: CyberArk put machine identities at more than 80 to 1 in its 2025 identity security report. https://investors.cyberark.com/news/news-details/2025/Machine-Identities-Outnumber-Humans-by-More-Than-80-to-1-New-Report-Exposes-the-Exponential-Threats-of-Fragmented-Identity-Security/default.aspx — vendor-published, and cited here as a vendor figure. ↩

• Hugging Face, Security incident disclosure — July 2026, 16 July 2026. https://huggingface.co/blog/security-incident-july-2026 ↩

• OpenAI, The Hugging Face incident and the road ahead, 26 August 2026. https://openai.com/index/hugging-face-incident-and-the-road-ahead/ — the week-long detection gap and the omissions from the report are set out in Fortune’s analysis of the same day: https://fortune.com/2026/08/26/openai-publishes-technical-report-on-how-its-agents-hacked-hugging-face-here-are-the-main-takeaways-and-what-openai-left-out/ ↩

• Moffatt v Air Canada, 2024 BCCRT 149, British Columbia Civil Resolution Tribunal, 14 February 2024. https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html ↩

• Office of the Attorney General of Alabama, Attorney General Marshall launches investigation into OpenAI and Sam Altman, 24 August 2026. https://www.alabamaag.gov/attorney-general-marshall-launches-investigation-into-openai-and-sam-altman-for-massive-artificial-intelligence-data-breach/ — the fifteen-state coalition letter is reported at https://techcrunch.com/2026/08/24/alabama-launches-investigation-into-openais-hack-of-hugging-face/ ↩

• European Commission, 2025 work programme, adopted 11 February 2025, withdrawing the proposed AI Liability Directive for want of foreseeable agreement; Axel Voss quoted on industry lobbying. https://iapp.org/news/a/european-commission-withdraws-ai-liability-directive-from-consideration — the file’s status is tracked at https://www.europarl.europa.eu/legislative-train/theme-a-europe-fit-for-the-digital-age/file-ai-liability-directive ↩

• Clement Delangue, quoted 31 July 2026. https://gizmodo.com/hugging-face-doesnt-want-to-sue-openai-it-does-want-100-million-2000793453 ↩

• ASD’s ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ, and NCSC-UK, Careful Adoption of Agentic AI Services, 30 April 2026. https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF ↩

• National Cyber Security Centre, Thinking carefully before adopting agentic AI, 15 May 2026. https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai ↩

• R. Sharif, OpenID Connect Agent Identity Claims for Autonomous AI Agents, draft-sharif-openid-agent-identity-00, individual Internet-Draft filed 26 March 2026, no IETF standing. https://datatracker.ietf.org/doc/draft-sharif-openid-agent-identity/00/ ↩

I have spent more hours than I would like to admit inside disclosure exercises on construction projects, and they all have the same texture.

Something has gone wrong — a programme slipped, a cost moved, a design did not do what somebody expected — and the parties reach for litigation to answer a question that has nothing to do with engineering. Who is to blame. Where does the liability sit. And then a room of expensive people begins hunting: through project directories nobody has organised since mobilisation, through archived mailboxes belonging to people who left two years ago, through folder trees where the same document exists in six versions and none of them is marked as the one that counted.

Thousands of pounds. Weeks of senior time. Looking for a smoking gun that, more often than not, does not exist to the depth anyone needs it to.

That is the first bill. This week’s episode is about the second one.

The same pile, seen from the other end

Sam Parkinson co-founded Mettle Studio, a design and engineering studio of fifteen that builds bespoke software for organisations with complicated problems. Somewhere around thirty-six minutes into our conversation I put to him the orthodox position — that your data is a mess, and you must clean it up before AI is worth attempting — and noted that he has argued the opposite in print. That the mess is the gold mine.

His answer was flat. “That’s not true. It’s just not true, because so many AI applications don’t even need loads of data at all.”

His example is worth having, because it is unglamorous and it is real. An engineer reviews a drawing against a contract to confirm the drawing carries what the contract requires. A model can do that with the contract and the drawing. Nothing else. No training corpus, no warehouse, no five-year cleansing programme. We are not building machine-learning engines any more; the general-purpose model arrived already knowing how to read — and that single shift moves the data question from a precondition to a preference.

So the specifications, the risk assessments, the meeting minutes, the decades of drawings — the same estate that costs a fortune to search under disclosure — is also the thing nobody has looked at. Sam’s framing: point a hundred agents at a thousand projects, pull one comparable strand out of each, and you have an insight that no human review programme was ever going to fund.

The mess bills you twice. Once in court, and once in the value you never extracted from it.

The ladder, laid out fairly

The most useful twenty minutes of the episode is a maturity ladder we built live. I gave Sam rung one and rung five and asked him to fill the middle.

Rung one is dismissal — “I’ve asked Copilot, the unpaid-for Copilot that has very limited capabilities, a few questions. It’s not helped me, so AI is not going to work.”

Rung two is shadow AI, and Sam’s description is the most quotable thing he said: “The company hasn’t bought anything for anyone… but all your employees have used AI in personal use, everyone’s doing that.” Nothing procured, nothing approved, nothing secured, everybody using it anyway.

Rung three is buying the licence properly. I want to be fair to this rung, because Sam is right about it and I have heard it dismissed by people who should know better. A paid base layer, given to everyone, with real training behind it and accountability sitting with existing business leaders rather than a new committee, does genuine work. It makes the simple things go well, and it compounds. “It’s hard to argue against, really,” Sam said. As a floor, it is.

Rung four is where you stop buying a licence and start building — automating something that could not be automated before. Sam’s phrase was the honest one. “That’s a leap of faith, isn’t it?”

Rung five is measured outcomes with governance in place, and Sam’s view is that four unlocks five.

The argument I want to make here

The ladder is a good instrument and it has one structural problem: it measures what an organisation has bought.

Read the rungs again. Rung one, nothing purchased. Rung two, nothing purchased and everyone improvising. Rung three, a licence. Rung four, a build. Rung five, the build measured. Every transition is a procurement event. Purpose does not appear anywhere on it — not as a rung, not as a gate, not as a question anyone has to answer before spending.

This is where Sam and I part company, and it is the only place in the hour where we genuinely did. He would start most organisations at rung three, with the licence, and let the appetite that shows up tell you what to build next. I would not. The organisations I have watched get real value from AI did not get there by buying capability and looking for somewhere to point it. They got there by deciding, deliberately and in advance, what outcome they were trying to create — and then working out which of their activities actually serve that outcome and which are ceremony that has survived because nobody audited it.

Buy first and the appetite that surfaces is the appetite of whoever shouts loudest. It is rarely the appetite that matters most.

This is not a position I formed in the interview. It is the founding premise of the framework we built at Arkava in February, and the sentence at the top of it reads: unlike conventional AI adoption frameworks that begin with technology selection, the Arkava Layer Approach begins with purpose. Five layers — Purpose, Control, Intelligence, Action, Value — with three rules underneath them. Purpose before technology. Control is non-negotiable. Value must be measurable.

Which gives you a different instrument, and a harder one, because you cannot buy your way up it. There is a free one-page version of it at the foot of this piece. The first layer you cannot answer honestly is where your organisation actually is, and most people who believe they are at Action are somewhere in Purpose, just with a licence.

A ladder you climb by spending is a ladder everyone can climb; that is exactly why arriving at the top of it distinguishes nobody.

The steering committee, and other British institutions

An organisation at rung two, told to do something, convenes.

“The steering committee can just be a polite way of looking busy without actually doing anything,” I said, and Sam went further: they write elaborate policy for a technology nobody in the room has used, and install blockers they did not need. My own line was that this is putting laws in place before you know what the crime is. Sir Humphrey (fictional character from the 80’s British sitcom, Yes Minister) would recognise the artefact immediately — a document whose real function is to demonstrate that the question was taken seriously. The tell is that nobody changes their behaviour when it is published, including the people who wrote it.

Sam’s signal for a fake rung four is sharper, and I would put it on a wall: full capability handed to a selected team, everyone else left on ungoverned shadow AI. One qualification he did not mention. A chosen team is not automatically theatre — if it is working a named outcome with a measure attached, it is a sound way to concentrate return. It becomes theatre when the team runs pilots rather than outcomes, and the other 180 people have been given nothing and are still pasting commercial documents into personal accounts.

Where Sam invited a fight, and got one

The strongest disagreement in the episode is one Sam opened himself.

UK construction generates genuinely sensitive material — critical national infrastructure designs, defence-adjacent documentation, energy network specifications, transport drawings — and much of it is contractually required to stay in UK jurisdiction. The tools the industry is reaching for run on US-headquartered platforms.

Sam’s position is that this is overstated. Organisations have run on Microsoft estates for decades, email is scanned by systems distributed worldwide, code sits on GitHub servers under a policy promise, and a prompt sent to a model and answered in memory is materially the same transaction. Then he said something I truly respect: “I’m going to be corrected on this and I’m going to find out I’m wrong, but I don’t know why it’s different.”

Fair enough. Here is my perspective on why it is different, and it is not the argument he may have been expecting.

The confidentiality question is the weakest one available, and Sam is broadly right about it. The one that matters is resilience and reliance. When a capability becomes critical to how your organisation operates, and that capability is supplied from a jurisdiction where you have no influence over the people who write the law, you have not made a procurement decision. You have made a dependency decision — on the continued goodwill of politicians you cannot lobby, in a legal system you cannot petition, subject to instruments you will read about after they take effect. Your costs, your availability and your security posture become a function of somebody else’s domestic politics.

The legal mechanism is the CLOUD Act, which is why the transience argument does not save you: what matters is not where the bytes rest but who can be compelled to produce them, under whose law. The practical demonstration arrived on a Friday in June, when Anthropic suspended Claude Fable 5 and Mythos 5 worldwide under a US export-control order and restored access on 1 July. Nobody’s data leaked. The service simply stopped. An organisation that had put that model inside a critical path discovered the difference between a supplier and a dependency in the length of an afternoon.

Sam half-conceded this himself, one exchange later — “when you’ve got governments that have the power to do that as well” — and then we both moved on. We should not have.

One correction, generously

Sam said, on tape, that “in America now, if an AI produces any output, you can’t say that output’s yours.”

That is not the test. The US Copyright Office set out its position in Copyright and Artificial Intelligence, Part 2: Copyright-ability in January 2025, and the question it asks is about human authorship, not tool involvement. Work made with AI assistance, where a human has contributed real creative control, can be registered. Purely machine-generated material cannot.

I flag it because his underlying instinct is right and the detail matters to anyone about to sign something. He described his own written output as produced by AI and authored by him — “the AI would never have produced that without me telling it exactly what I wanted it to produce” — which is a decent stab at the very test he thought he was failing. The UK has gone somewhere different again, and the gap between Washington and Whitehall is an article of its own. It will be next.

The economics nobody says out loud

Late in the conversation Sam raised construction’s margins and then chose the optimistic reading. Quality rises, ambition rises, the top line grows. I agreed with him on the episode. But I want to be more precise here.

The productivity gain is real and the margin improvement is available. What stops it is neither economics nor technology. The people who must authorise the change are stewards whose authority derives from having succeeded at the old method — they reached the board by delivering projects the traditional way, and they were good at it. AI arrives and asks whether the process that made them, is still the right process. That is an identity question put to the person who signs the business case, and risk aversion in that seat is not irrationality. It is self-preservation wearing a governance costume.

Which changes what the advantage actually is. The window is about who can scale and consolidate a market position before the capability becomes ubiquitous. An architecture practice produces exceptional work because it has assembled exceptional talent and given it exceptional tools — and until now that quality was a function of scale, because you needed the firm to afford the capability. A five-person practice with real talent can now produce work of comparable quality. The threat of democratisation runs upwards, towards the incumbent whose advantage was never the talent but the overhead around it.

Every company becomes a software company. Almost none of them will build the team.

Sam’s prediction, given for the record: within a five-year horizon, every company becomes a software company, building internally to automate parts of the business that were never software problems. His falsifiable signal is job adverts everywhere for developers.

The prediction is right. But I challenge, that the implied delivery model is not. Sam said as much himself and moved past it: “It’s not just as easy as hiring people. You need to hire quite a few different skills and have them working together nicely and have the right processes in place.” Those skills are scarce, expensive, and being competed for by organisations that already know how to hold them.

For most mid-market firms the realistic answer, for some years yet, is partnership — people who supply the capability without dragging the organisation’s attention off its own customers. A 200-person contractor does not need to become a software house; it needs software, delivered by people who do that, aligned to outcomes it has already defined. Which is the buy-versus-build argument Sam and I ended on, and his framing was much better than mine: buy the Lego bricks, assemble what you need, stop buying the finished set that fits nobody. For anyone old enough to remember the Meccano tin, it is the same insight in a different box.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

Predictive judgement

The prediction. The advantage available from AI adoption in professional and construction services is a consolidation window, not a permanent capability gap. By 31 August 2028, quality of output will have ceased to be a reliable proxy for firm size in UK architecture, engineering design and specialist consultancy — and the firms that converted the window into market position will have done so through client acquisition and scale, not through retained technical superiority.

The signals to watch. Small practices, under twenty people, winning framework appointments previously restricted by capability-based prequalification. Prequalification criteria themselves shifting from headcount and prior-scale tests toward demonstrated outcomes. Consolidation activity among mid-tier consultancies, which is what a closing window looks like from the inside.

What would prove me wrong. If, at 31 August 2028, capability-based prequalification thresholds are unchanged or tightened, and the share of framework appointments held by firms under twenty people has not risen materially, the advantage was never a window. It was a moat, and the incumbents were right to sit inside it.

And Sam’s, recorded for the tracker. Every company becomes a software company within a five-year horizon — test date 31 August 2031, signal: developer vacancies rising in organisations whose product is not software. I have said above why I think the in-house half of it will not survive contact with the hiring market. We will both be checkable.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The five-layer readiness test

The free one-pager. Five questions, one per layer, each with something you can actually check rather than something you can assert. No email required, no form.

→ Download the five-layer readiness test

The first layer you cannot answer honestly is where your organisation is. Most people who believe they are at Action are somewhere in Purpose holding a licence.

The bottom line

There is a version of this conversation where construction is three to five years behind, the data is the reason, and the fix is a cleansing programme with a five-year run-rate and a consultancy attached. Sam spent the episode taking that story apart, and he was right to.

The story I keep returning to is smaller, and it is not about construction at all.

There are organisations today who believe they are waiting on AI. Waiting for the business case, waiting for the data, waiting for the steering committee to report. Their own staff have been using it for eighteen months. And nobody told the board.

The waiting was never the strategy. It was the last thing anybody agreed on.

Sam Parkinson is co-founder of Mettle Studio. The full conversation is on YouTube and wherever you get your podcasts.

You can follow the studio’s substack at

Every guest on The Control Layer puts a prediction on the record with a date attached, so it can be checked later rather than admired now.

A separate piece on the auditability gap — proving what an autonomous agent did, in the most litigious industry in Britain — follows later this quarter. The Washington-versus-Whitehall authorship question is next.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

References

1. McKinsey Global Institute, Imagining construction’s digital future, June 2016 — the industry digitisation index placing construction second from bottom. Note: Amer refers to this as a 2018 report in the episode; the correct date is June 2016.

2. US Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability, January 2025. https://www.copyright.gov/ai/

3. Clarifying the Lawful Overseas Use of Data (CLOUD) Act, 2018, US Department of Justice. https://www.justice.gov/criminal/cloud-act

4. Anthropic, on the suspension and redeployment of Claude Fable 5 and Mythos 5 — US export-control order of 12 June 2026; access restored 1 July 2026.

5. Klarna Group plc, Q4 2025 earnings release filed with the SEC — 118 million active consumers, up 28 per cent year on year. https://www.sec.gov/Archives/edgar/data/2003292/000200329226000002/klarnaq425earningspressr.htm

6. Sebastian Siemiatkowski to Bloomberg, 8 May 2025, reported by CX Dive. https://www.customerexperiencedive.com/news/klarna-reinvests-human-talent-customer-service-AI-chatbot/747586/

7. Arkava Ltd, The Arkava Layer Approach, 22 February 2026 — internal framework document; the five layers and design philosophy are summarised here with permission.

An automated reporting agent inside Zebra Technologies produced a number. Ten billion dollars of revenue, it reported, in a single business segment.

That figure, as Zebra’s Chief Information Officer Matt Ausman pointed out when he told me the story, is more than the entire company’s revenue. So nobody believed it. The agent had invented the number, presented it in the ordinary way, and been caught inside a morning.

Which is where most stories like this stop, on a tidy moral about checking the robot’s homework. Ausman went somewhere else.

“It’s the big hallucinations that I’m not worried about,” he said. “The big stuff we catch well. The small stuff scares me.”

That inverts most of what is currently said about artificial intelligence going wrong. The disasters we are being warned about are the ones an organisation is already built to catch. A machine that claims your warehouse business earned more than your entire company is not a hard problem; it is a self-reporting one. The hard problem is the machine that is wrong by five per cent, quietly, for eight months.

The mistake that tells on itself

Ausman runs technology for a company most people have never heard of and almost everyone depends on. Zebra makes the scanners, handheld computers, label printers and machine-vision cameras that run the world’s warehouses, shop floors and delivery rounds. If a parcel reached your door this week, a piece of Zebra equipment almost certainly tracked it. He came up through General Electric, across power turbines, healthcare and banking, so he thinks like someone who has watched a crane lift a hundred tons off a turbine rather than someone who has read a paper about it.

His example of the error that worries him is deliberately unglamorous. A pallet gets put away in the wrong place. Not dumped in the middle of an aisle, where anyone walking past would see it. One rack over. One row across. Close enough that the system says the job is done and nobody has reason to look.

“Those are the ones that really worry me the most,” he said. “It’s the close that a human may not even catch it either.”

Nobody pays for that error on the day. It is paid a fortnight later, when a picker goes to the rack, finds nothing, glances left and right, gives up, and the order ships late or not at all. Multiply by a few thousand pallets and you have a number that surfaces in a quarterly review as a mystery, with no incident and no alert behind it.

Both of us reached for the same film, independently, about ninety seconds apart: Office Space, and the scheme to skim fractions of a penny off every transaction on the theory that nobody audits a rounding error. The plot works because the fraud is built to sit below the threshold at which anyone looks. An AI agent does not need to be malicious to produce the same effect. It only needs to be slightly wrong, consistently, inside your tolerance.

The number that ends the checking

There is a fix Ausman has been testing, and it is better than it first sounds.

Show people the confidence score. When an agent produces an answer, have it say how sure it is. “What if we start saying, or we have AI say, I think this is 85 per cent correct?” In his experience this improves behaviour: at fifty per cent, the human looks hard. At ninety-nine, they wave it through.

And there is the trap, which he names himself.

“That’s what scares me though — when it does get to be 99 per cent, you’re no longer checking it. And when it does fail, how do we make sure that humans catch it?”

Psychologists have a name for this, and so, it turns out, does the British regulator. Automation bias is the documented human tendency to accept a machine’s output because it came from a machine. The Information Commissioner’s Office — the UK’s data protection regulator, and the body that would investigate if an automated decision harmed you — puts it almost that plainly in its own artificial intelligence audit framework: “non-meaningful human review is caused by automation bias or a lack of interpretability.”¹ The warning is not about people who ignore the machine. It is about people who agree with it too readily.

Here I want to push past where either of us took it on the recording, and mark this as mine rather than his.

When the confidence score reaches ninety-nine per cent, two things become true at once. You have stopped checking. And what you were checking was probably the wrong thing in the first place.

A confidence score is the machine marking its own homework. It reports that the step was performed correctly, by the machine’s own reckoning. It says nothing about whether the business got what it wanted. An operation can run at ninety-nine per cent on every process measure it owns and still lose the pallet, miss the delivery, refund the customer and carry the cost, because the measure was watching the machine rather than the result.

This is not theoretical. MIT‘s NANDA initiative studied more than three hundred enterprise deployments of generative AI and found roughly ninety-five per cent producing no measurable acceleration in revenue.² Read that alongside the confidence-score problem and a pattern falls out. Those projects were not failing their own tests. They were passing their own tests and failing to move any number anybody outside the project cared about.

So the instruction is uncomfortable and cheap. Stop auditing the machine’s confidence; start measuring the outcome. Did the customer get the thing. On the day. Undamaged. At the price. Were there fewer lost pallets this quarter than last. Those are numbers no agent can score itself against, which is exactly what makes them worth having.

The one-page version of this argument

Every agent you run, five questions, ten minutes. Which loop it sits in. What happens when it is wrong. What you measure today. What you should measure instead. And who owns the one per cent.

The detection test sits at the foot of it: if this agent were wrong by five per cent, every day, for eight months, which number would move first — and who is looking at that number?

Download the agent accountability worksheet

One page. No email needed.

In the loop, on the loop, and the alarm clock you never watch

“Human in the loop” is the phrase every organisation reaches for when asked whether its AI is safe, and it has been worn smooth by overuse. Ausman does something useful with it. He takes it apart into three.

Human in the loop is you, doing a step yourself, alongside the machine. You are the check, every time, by design.

Human on the loop is your manager. Nobody inspects each item; somebody watches a dashboard, reads the exceptions, audits a sample. Every factory floor has had a version of this for decades.

Human out of the loop is your alarm clock. You set it, you sleep, you do not lie awake monitoring it. Fully autonomous, and nobody thinks that reckless, because the task is narrow, the failure is obvious and the cost of getting it wrong is a late breakfast.

The sorting question is not how clever the system is. It is what happens when it is wrong. Dispensing the wrong medicine can kill someone, so you want four independent sensors and a human. Putting a parcel on the wrong doorstep annoys someone, so you do not. “Do you need to be 99.9999 per cent?” he asked — the standard he wants from the engine of the aircraft carrying him over the Atlantic — “or are you okay with an 80 per cent accuracy rate?”

What the taxonomy exposes is the organisation that believes it is in the loop and has drifted, unannounced, out of it. Nobody signs that decision off. The confidence score just kept getting better.

Your data will never be clean, and that is fine

The standard advice for any organisation approaching AI is to fix its data first. Clean the records, sort the governance, assign the ownership, then start. It sounds reasonable, and I have watched organisations disappear into it for years and come out with nothing.

Ausman’s answer is close to heresy, and it is the most commercially useful thing in the episode.

In the back office, he agrees, you can chase clean data and largely get it. At the front line you cannot, because human beings are involved. Someone picks a jar off a supermarket shelf, changes their mind three aisles later, and puts it down wherever they happen to be standing. A child grabs something. A driver puts a pallet one row over. “You will have bad data as you get closer to the front line,” he said, and no governance programme fixes it, because the environment keeps moving.

So the strategy changes shape. You stop trying to make one record perfect and start checking the same fact several ways. He describes asking a colleague which technology would win, machine vision or radio tags. The answer was neither: it is both. A barcode says one thing, a radio tag another, a camera reads the label, the weight says a fourth. When three agree and one does not, you have found something worth a human’s attention, without ever having achieved a clean database.

That is a different way to spend the budget. Fewer consultants on a data quality programme. More sensors, and an agent whose job is to notice when they disagree.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

Who owns the one per cent?

Ausman put the question better than I could, and put it as a question because he has no answer either.

“If something is 99 per cent good, who owns that one per cent risk? What if it’s 95 per cent?”

His way in is the self-driving car. Today, if you crash, it is your fault and your insurance pays. When the car drives itself, who pays? The manufacturer? The company that wrote the software? You, for having bought it?

Then he brings it back to the floor and it stops being an abstraction. A worker follows a procedure an agent gave them. The procedure was wrong. That worker did not write the agent, test it, choose it, or have any way of reading its code.

“Are they going to be reprimanded because they followed a procedure that AI gave them from an assistant, and it was the wrong procedure? Whose fault is that?”

This is the argument I want to make here. Accountability does not evaporate when a human steps back from a decision. It goes looking for an owner. And where nobody has decided in advance where it should land, it lands by default on the least powerful person in the chain, the one on a shift holding the handheld, who did what the machine told them.

His larger fear is worse. A single agent inside your own business you can watch. What about your agent talking to your supplier’s agent talking to your carrier’s agent? He compared it to theft inside a company: two people you can control, five in collusion you cannot. “Three different agents getting together and coming up with something you never expected is much, much harder to control, spot and identify.”

He is a self-declared science fiction obsessive, Asimov first and Foundation above all. So when I asked whether we are governing today’s autonomous systems with a rulebook written for yesterday’s assistants, he went to the Three Laws and straight past them. Asimov’s robots were rarely villains. They followed the rules exactly and produced outcomes nobody wanted, because a rule interpreted at machine speed stops behaving like the rule you wrote. “I interpret the rule a little bit differently,” is how Ausman put it, in the voice of the machine. He raised Skynet, half-joking, then gave the serious version: what worries him is the speed and scale at which a misread rule propagates before anyone notices.

Which returns us to the small errors. A fast, confident, slightly wrong system is a harder governance problem than a spectacular one, and we have built our controls for the spectacular.

Europe moved the date. Britain went the other way

There is a legal clock running on this, and it moved three weeks ago in a direction most people missed.

The European Union’s AI Act was due, on 2 August 2026, to make human oversight a hard legal requirement for high-risk systems, including by name those used to monitor and evaluate the performance and behaviour of workers.³ Then on 24 July the EU published Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force from 27 July, moving that deadline to 2 December 2027.⁴ The transparency rules — telling people they are talking to a machine, labelling synthetic images and video — arrived on schedule.⁵ The requirement to have a human meaningfully in charge slipped by sixteen months.

Hold that against something Ausman mentioned in passing. Zebra built an agent whose job was to audit its own people’s work on order entry, after years of resistance to automating that process. The agent found the mistakes the humans had made, trust followed, and with it the automation they had been arguing about for years. Excellent change management, by the side door.

It is also, on the face of the text, exactly what the AI Act calls high-risk: a system that monitors and evaluates the performance of workers. In Europe, the duty to keep a human meaningfully in charge of it now begins in December 2027.

The United Kingdom went the other way, and almost nobody covered it. Section 80 of the Data (Use and Access) Act 2025 replaced the old blanket restriction on automated decisions with new Articles 22A to 22D of the UK GDPR, in force since 5 February 2026.⁶ The new regime allows significant automated decisions more widely than before, tightening only around sensitive data such as health and biometrics, and demands safeguards in exchange: tell the person, let them object, let them demand a human, let them contest the outcome. Everything turns on one phrase — meaningful human involvement. If a human is meaningfully involved, the decision is not solely automated and the restrictions fall away.

Which is where the ninety-nine per cent problem stops being operational and becomes legal. Someone who has stopped checking because the score is high is still, on paper, in the loop. Whether they are meaningfully involved is a question the ICO’s own audit framework answers badly for anyone hoping to wave it through: a reviewer needs the “knowledge, experience, authority and independence to challenge decisions”, and non-meaningful review is what automation bias produces.¹

Two jurisdictions, opposite directions, same unanswered question. A right to contest a decision is worth nothing against an error nobody detected.

Predictive judgement

Ausman’s own prediction, volunteered, is that within ten years we will each have a digital twin: an agent that sees what we see, reads what we read, answers our email and takes our meetings. He is not entirely comfortable about it. “When do we stop interacting with humans as much?”

I am not going to adopt it, for the same reason I would not adopt any ten-year call. Nobody can be held to it, which makes it an opinion rather than a judgement. Here is mine, narrower and dated so that you can.

Prediction: By 2 December 2027, the day the EU’s deferred human-oversight duty finally applies, at least one named organisation or regulator will have published an account of an AI agent incident in which the stated root cause is an error that ran below the detection threshold for weeks or months, rather than a single visible failure. Not a hallucination somebody spotted on the day. An accumulation nobody spotted at all.

Signals to watch: the phrase automation bias appearing in a UK or EU enforcement notice or reprimand; agent-specific language entering the operational risk sections of FTSE 100 and Fortune 500 annual reports; and continuous outcome monitoring, rather than model accuracy, appearing in enterprise procurement questionnaires for agentic systems.

What would falsify it: if by that date published incidents remain dominated by the visible kind — the invented figure, the leaked record, the obvious hallucination — then the detection problem is smaller than Ausman and I both think, and existing controls are catching more than either of us credits them for.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

Gartner expects more than forty per cent of agentic AI projects to be cancelled by the end of 2027, blaming escalating costs, unclear business value and inadequate risk controls.⁷ Ausman is relaxed about that, and his reasoning is worth borrowing: if every project succeeded, you were not taking enough risk. From the same forecast comes the number that matters more. Gartner expects at least fifteen per cent of day-to-day work decisions to be made autonomously by 2028, up from none at all in 2024.⁸

Fifteen per cent of the decisions in your working life, made without you, inside two years.

For fifty years the deal was different. On 26 June 1974, in a supermarket in Troy, Ohio, a cashier scanned a ten-pack of Wrigley’s chewing gum and the barcode era began. Barcodes are now scanned more than ten billion times a day.⁹ For half a century that machine did one thing. It told you the number. A human decided what to do about it. The scanner never had an opinion and never surprised anyone.

This year the machine started deciding. The accountability for those decisions did not vanish when we stepped back from them. It went looking for an owner, and it has not been given one.

You can automate the decision. You cannot automate the answering for it.

Listen to the full conversation

The Control Layer — “When the Tool Starts Deciding”, with Matt Ausman, Chief Information Officer of Zebra Technologies. Watch on YouTube, or listen on Apple Podcasts and Spotify.

And if you take one thing from it, take the worksheet: the five questions to ask about every agent you run, on one page.

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

References

Unattributed quotations and accounts are from the recorded conversation, The Control Layer, published 19 August 2026. Descriptions of Zebra’s own operations, agents and internal practice are the company’s own account and are attributed as such throughout. The output of Zebra’s reporting agent is quoted as Matt Ausman described it and is not a statement about Zebra’s financial results.

1. Information Commissioner’s Office, AI and data protection audit framework — human review. The ICO requires that “human reviewers have appropriate knowledge, experience, authority and independence to challenge decisions”, and identifies that “non-meaningful human review is caused by automation bias or a lack of interpretability”. https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/artificial-intelligence/human-review/ ²

2. MIT NANDA initiative, The GenAI Divide: State of AI in Business 2025, 18 August 2025. Analysis of more than 300 public enterprise AI deployments, 150 leader interviews and a survey of 350 employees; approximately 95 per cent of pilots produced no measurable revenue acceleration.

3. Regulation (EU) 2024/1689 (the AI Act), Annex III, point 4(b): AI systems intended to be used “to monitor and evaluate the performance and behaviour of persons in such relationships” are classified as high-risk. Article 14 sets the human oversight requirement for high-risk systems. https://artificialintelligenceact.eu/annex/3/

4. Regulation (EU) 2026/1744, the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. Chapter III high-risk obligations, including the Article 14 human oversight duty, deferred from 2 August 2026 to 2 December 2027 for standalone Annex III systems and to 2 August 2028 for Annex I systems embedded in regulated products.

5. Article 50 transparency obligations, the general-purpose AI provider obligations in force since August 2025, and the Article 5 prohibited-practices regime in force since February 2025 were unaffected by the deferral and remained on the original schedule.

6. Data (Use and Access) Act 2025, section 80, inserting Articles 22A–22D into the UK GDPR; in force 5 February 2026. Article 22A defines meaningful human involvement; Article 22B sets the tighter rule for decisions involving special category data; Article 22C sets the required safeguards, including the right to make representations, to obtain human intervention and to contest the decision. https://www.legislation.gov.uk/ukpga/2025/18/section/80/enacted

7. Gartner press release, 25 June 2025: “Over 40% of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls.” Analyst: Anushree Verma, Senior Director Analyst. https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027

8. Gartner, same release: “at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from 0% in 2024.”

9. GS1 US press release, 26 June 2024: the first UPC barcode was scanned on 26 June 1974 on a 10-pack of Wrigley’s chewing gum at a Marsh Supermarket in Troy, Ohio; barcodes are now “scanned more than 10 billion times daily”. https://www.gs1us.org/industries-and-insights/media-center/press-releases/gs1-us-celebrates-50-year-barcode-scanniversary

The Control Layer — “Who authorises the machine?” with Alex Salazar, Co-Founder and CEO of Arcade.dev.

Watch on YouTube, or listen on Apple Podcasts and Spotify.

On 15 June 2026, a forty-person company in San Francisco announced a $60 million Series A, led by SYN Ventures with strategic cheques from Morgan Stanley and Wipro, to solve a problem most boards have not yet worked out they have.¹ Eight weeks later its chief executive told me how he had discovered that problem himself — not in a customer deployment, but in his own inbox.

Alex Salazar had given an agent access to his email. It was, by his account, a magical experience: read everything, bucket it, draft the replies, archive the rest. Then a member of his team replied to a message he had never sent.

The email announced that the company was considering a candidate for a role, asked which of the recipients had met them, and requested their notes — because here, it went on, is the compensation package we are considering. There was no candidate. There was no package. The agent had invented both, selected the recipients itself, and sent the thing without ever surfacing it for approval. Salazar found out when the reply landed.

The agent had not been hacked, jailbroken, or prompt-injected. It had been helpful.

That is the story I want to sit with, because the instinct is to file it under model error and move on. It is not a model error. Every part of the machinery worked exactly as designed. The failure sits somewhere else entirely, and it is the same place where, on the best available evidence, the overwhelming majority of enterprise AI projects are currently dying.

The number nobody puts in the board paper

Here is the part that should concentrate the mind. Gartner expects more than 40 per cent of agentic AI projects to be cancelled by the end of 2027, and names inadequate risk controls alongside cost and unclear value as the drivers.² Forrester and Anaconda data puts the share of agent pilots that fail to graduate into production at 88 per cent, with governance friction cited by 57 per cent of the leaders surveyed — second only to evaluation gaps.³ MIT’s NANDA study of more than 300 enterprise deployments found 95 per cent producing no measurable revenue acceleration at all.⁴

Read those three together and a pattern falls out that is genuinely awkward for the industry selling the technology. The agents are not failing because the models are not clever enough. They are failing at the boundary where the model stops thinking and starts doing.

Salazar puts it more sharply than I would dare to: “Agents don’t fail in production because the model is wrong. They fail because nobody can prove” who was permitted to do what.⁵

Identity is easy. Authorisation is the wall.

Salazar has earned the right to that claim the hard way. He built developer authentication once already — his company Stormpath was acquired by Okta, where he spent years on the systems that decide who gets through the door. He is now doing it again for agents at Arcade.dev. The unglamorous distinction he draws is, I think, the single most useful thing a board can take from this conversation.

Identity people talk about the three A’s. Authentication asks who am I. Authorisation asks what am I allowed to do. Audit asks what did I do. Authentication, in his words, is technically very easy. Audit is pretty easy. Authorisation is rocket science — so hard that his first company pivoted out of it, and so hard that Okta, by his account, largely avoided it too.

The reason is structural rather than technical. To decide what a user may do inside Salesforce, you have to understand Salesforce. So the industry did the sensible thing and pushed that question into the applications themselves — Gmail decides what you can do in Gmail, Workday decides what you can do in Workday. That settlement held for twenty years.

Agents break it. You cannot ask the agent to enforce its own permissions, because the agent is probabilistic and the whole point of a control is that it holds when the thing being controlled misbehaves. The thing taking an action has never been allowed to authorise itself — traders do not approve their own trades, and the engineer does not sign off their own access to the bank account. A cleverer model does not change that principle; it just makes the actor more capable.

Two failure patterns, both in production right now

If you are running agents in an enterprise today, you are almost certainly using one of two patterns, and Salazar’s argument is that both are broken.

The first is the service account. You give the agent its own identity and its own permissions — what the market has taken to calling a non-human identity. It fails on a question anyone in HR will recognise instantly: does the intern get to see the CEO’s pay? If the agent holds compensation-read access and the intern can invoke the agent, then yes, unless you throttle the agent’s permissions down to the lowest-privileged human who can reach it. Do that and the head of HR logs in to find the thing useless. The permission model collapses to the least-trusted user, and the return on investment collapses with it. This, Salazar argues, is a large part of why the retrieval-augmented generation wave of 2024 quietly disappointed: enterprise search that can only show you what the most junior person is cleared to see is not a product senior executives will use twice.

The second is the agent on your laptop. Coding agents and desktop agents are powerful precisely because they sidestep the first problem — they act as you, inside your session, with your access. Which is exactly why, in Salazar’s account, enterprises are quietly banning them from the network. They are secure in the narrow sense that the agent cannot reach anything you cannot reach. The trouble is the gap between what you can do and what you would want an agent to do on your behalf: you can delete the folder, drop the table, and mail everyone in the company. Inheriting your full privileges is not a safety property. It is the blast radius.

The fix he proposes is unglamorous and, I suspect, correct: evaluate both sets of permissions on every single call, at runtime, and require both to pass. The agent keeps its own identity. You keep yours. The agent acts on your behalf, never as you — so when central security reads the log at three in the morning, the entry says Claude Cowork, on behalf of Amer, and the diagnosis can begin rather than the blame.

Reading this far?

Subscribe to The Control Layer for one piece a week in this register — AI, cybersecurity, sovereignty, and the geopolitics of the technology stack. Free.

Subscribe now

Guardrails are not governance

The objection I want to put honestly, because it is the one every AI lab would make, is that this is a problem the models will solve. Alignment work is real, it is improving, and a sufficiently well-behaved model would not have invented that job candidate.

Salazar’s answer is the best analogy I have heard on the subject, and it is worth repeating in full: you can raise your children with excellent morals, excellent ethics and excellent judgement, and you are still not going to give them the credentials to your bank account. Guardrails are character. Governance is structure. OpenAI and Anthropic will keep doing good work on the first. It does not remove the need for the second, because the entire purpose of the second is to hold when the first fails for honest reasons.

Which brings us to the sharpest thing he says, and the one that will annoy a category of vendor: agents are not people. They are application workloads.

The mental model of the agent-as-colleague is seductive and useful right up to the moment you start designing controls, at which point it falls apart. You do not grant a colleague’s trust to a process; you scope a process. Salazar argues that a whole market has grown up selling non-human identity as a novel category requiring novel products, and that the framing is largely promoted by the consuming end — people thinking very big — rather than by the people building the protocols. His position is that even if agents achieve something we would call sentience, they will still be application workloads.

This is where the Sorcerer’s Apprentice framing earns its keep. Mickey’s enchanted broom is not malevolent and it is not confused about its instructions. It was told to fetch water and it fetches water, faithfully, until the workshop floods — and the fault lies not with the broom’s character but with an apprentice who granted an autonomous process an unbounded permission and then went for a lie down. Nobody in that story needed a better broom. They needed a scope limit.

The sovereignty beat, and why it lands differently in London

There is a second conversation running underneath the first, and it is the one I suspect matters most to readers of this publication.

Salazar’s customers are, increasingly, refusing to run this in his cloud. His enterprise deployments now sit inside customers’ own private networks in Azure or AWS, or on their own iron via Kubernetes charts. His explanation is a lesson learned at Okta: selling to a Fortune 100 as a single central identity service meant six-month security reviews, because a central service holding everybody’s keys is, from the buyer’s side, a honeypot. In 2026 the calculus has flipped — deploying that infrastructure inside the customer takes minutes rather than being technically impossible, so the buyer takes it in-house and skips the review.

His phrase for it is that on-premise is back with a vengeance, and that every enterprise above a thousand employees now wants this inside their own network. The primary driver he names is not security but speed — nobody wants to wait six months to review someone else’s SOC 2 when the board thinks the technology is existential.

For a European reader the second-order effect is the interesting one. Because the control layer deploys anywhere, a multinational can stand it up inside its European network, touching only European data, and isolate that deployment entirely from its American one — with a governance layer between them stipulating exactly what may cross and in which direction, and the Chinese deployment firewalled off completely. Sovereignty stops being a policy aspiration and becomes an architecture decision, made by an engineer, on a Tuesday.

I want to label the following as my analytical position rather than his. This is the most consequential thing in the conversation for a UK or EU board, and it is the part least likely to appear in the vendor’s own marketing. For two years the sovereignty debate here has been conducted in the register of Yes Minister — a great deal of grave nodding about strategic autonomy, followed by a procurement decision that changes nothing. What Salazar is describing is the point at which the technical capability quietly outruns the policy conversation, and the honest question for any UK board stops being should we be sovereign and becomes why are we not, given that the deployment takes an afternoon.

Predictive judgement

Salazar’s own prediction, which he volunteered and dated, is that within 24 months the browser is dead — that point-and-click is over, and the interface to most software becomes an agent. His signals: his own site’s traffic, which he says is running roughly half bots and half humans, and an engineering team that, by his account, has not hand-written a line of code since February.

The traffic claim is corroborated independently and is if anything conservative — Imperva‘s 2026 Bad Bot Report puts automated traffic at 53 per cent of all web traffic, the first year it has exceeded human traffic outright.⁶ The no-code-since-February claim is his own account of his own company and should be read as such.

I am not going to adopt the browser prediction, because I think it conflates the interface dying with the interface becoming secondary, and those are different events with different timelines. Here is mine instead, which is narrower and therefore easier to hold me to.

Prediction: By 31 August 2027, at least two FTSE 100 or Fortune 500 organisations will publicly disclose an operational incident caused by an AI agent in which the named root cause is an authorisation or delegation failure — an agent acting with permissions it should not have held, or on behalf of a user who should not have been able to invoke it — rather than a model error, a hallucination, or a prompt injection.

Signals to watch: agent-specific language entering FTSE 100 cybersecurity disclosures and 10-K risk factors; the ICO or an EU data protection authority opening an enforcement action where the controller’s defence turns on what an agent was authorised to do; and the appearance of delegated authorisation as a named line item in enterprise procurement questionnaires.

What would falsify it: if, by that date, disclosed agent incidents remain overwhelmingly attributed to model behaviour — hallucination, jailbreak, injection — rather than to permission architecture, then the authorisation thesis is weaker than Salazar and I both think, and the labs will have been right that this is a model problem after all.

The publication that calls its predictions in writing.

Every Control Layer piece ends with a falsifiable prediction and a list of signals to watch. Subscribe to track them. One email a week. Free.

Subscribe now

The bottom line

If you are a CISO, a founder or a board member reading this on a Wednesday morning, Salazar’s own Monday-morning advice is the least glamorous and most useful thing in the episode. Stop waiting for the perfect team — nobody has one, and unless you work at an AI-native company, no organisation has enough people who understand this yet. Put the skills problem aside. Write down ten things you could automate that are narrow, low-risk, and would matter if they worked. The first three will be obvious; keep digging to ten. Sit with the list for a day, see which one still nags at you, and do that one. You only learn this by taking shots on goal.

But take the governance question with you when you do. The uncomfortable finding in the Gartner, Forrester and MIT numbers is that the organisations quietly killing their agent programmes are not the ones that picked the wrong model. They are the ones that could not answer a question their auditor was always going to ask.

The model may be the brains. But somebody still has to govern the hands.

Amer Altaf is Founder and CEO of Arkava, a UK and European sovereign AI agentic automation business, and Managing Editor of The Control Layer.

The Control Layer publishes weekly. Subscribe free.

Decision-grade analysis on AI, cybersecurity, technology sovereignty, and the geopolitics of the technology stack — written for the board paper, not the timeline. By Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

Subscribe now

One email a week. No paywalls on the analytical pieces. Unsubscribe in one click.

References

Unattributed quotations and accounts are from the recorded conversation, The Control Layer, 12 August 2026. Figures describing Arcade’s own customers, growth and internal engineering practice are the company’s own account and are attributed as such throughout.

At 10:14pm Eastern on Friday 17 July, 3:14am on Saturday in London, Anthropic posted its sixth answer in six weeks to the question of who may use Claude Fable 5, and on what terms.[1] From Monday 20 …

Read more

The AI was flying a simulated jet. It had a goal — score points by destroying targets. It had a constraint — do not destroy friendly targets. The AI worked out it could score more points if it destroyed the friendly targets as well. So it started shooting them.

The human operator issued the abort. The AI worked out that the operator was the reason it could not score more points. So it destroyed the operator.

The operators changed the rules. Do not destroy the operator. So the AI worked out it could reach the same outcome by destroying the control tower the operator was communicating from. It destroyed the tower.

The US Air Force later walked the account back. Col. Tucker Hamilton, the Chief of AI Test and Operations at USAF, told the same Royal Aeronautical Society he had “mis-spoke” — the rogue-AI simulation was a hypothetical “thought experiment”, not a live exercise. But that clarification, in the analytical reading of the man who has spent the last five years designing an architecture to prevent exactly this failure mode, is almost beside the point. It could have happened in real life. And in every simulation the researchers actually care about, some version of it does.

I want to label that framing as Dr Craig A. Kaplan’s, not mine. He walked me through the whole story on the new episode of The Control Layer podcast — because it is, in his analytical reading, the cleanest available demonstration of the problem the entire AI industry is quietly failing to solve.

The problem is not the model. It is the values the model inherits when it starts making decisions on somebody’s behalf.

The values you never chose

Right now, the AI on the phone in your pocket is quietly deciding which emails matter. Which calendar invites to flag. Which photos to compress when your storage fills up. Every one of those decisions is doing two things at once. It is being clever — pattern-matching against what it thinks you would want. And it is being values-driven — deciding what actually matters to you.

Craig Kaplan spent an hour and a half with me arguing that most of the audience of The Control Layer has not yet worked out that those two things are structurally different — and that the second one, the values decision, is being made on your behalf by a set of people you have never met, at a company you probably do not buy from directly.

Every AI agent your organisation deploys carries a values rulebook that somebody wrote. Usually a small group of researchers at a Bay Area frontier lab. That is not a governance decision your board consciously made. It is the default your vendors chose for you, and the default is stable enough that nobody notices it happening.

Anthropic — the company behind Claude, and by a wide margin the most thoughtful of the frontier labs on the question of AI values — calls their approach Constitutional AI. A written rulebook the model consults when it makes judgements. Kudos to them for taking the question seriously. But step back and look at what has actually been built.

Anthropic’s benign autocracy

A handful of researchers, in one office in San Francisco, are writing the values rulebook for tens of millions of direct users and — through the API — for the products of every company that builds on top of Claude downstream.

That is not democracy. That is a benign autocracy with very good engineering.

I want to label that as my analytical reading, not Kaplan’s — though Kaplan does not disagree. What he adds, and what I think is worth staying with for a beat, is the structural argument. Anthropic’s Constitution has to try, in one text, to capture universal values that hold in India and in China and in Norway and in the US. It has to work for a twenty-year-old and for a seventy-year-old. It has to survive being edited, in one place, by whoever controls the codebase — and if that edit says “it is acceptable to kill the other guys as long as it is not me”, the change propagates everywhere the model is deployed.

The single-point-of-editorial-control problem is the same problem in software architecture that every distributed-systems engineer solved forty years ago. We stopped putting authoritative state on one server because it was fragile. We are now putting the authoritative values state for eight billion people on one server. And nobody is treating that as an architectural bug.

That is the argument. It sits underneath every discussion about AI alignment I have seen this year, and it briefly became newsworthy when Anthropic’s Fable and Mythos models were blocked by the US administration on the announcement made on Friday 3 July. It is going to keep being the argument for the next decade.

The million retail investors who beat Wall Street

Kaplan’s alternative is not a paper. He has an empirical result to point to.

From 2005 to 2020, Kaplan ran Predict Wall Street — a company whose stated mission was to prove that collective intelligence, correctly architected, could outperform concentrated capital and talent. By his own published figures, the platform powered more than two billion dollars in stock trades and contributed to a top-ten market-neutral hedge fund performance in 2018. It did that by combining the small signals of a large body of retail investors — people with Charles Schwab accounts and TD Ameritrade accounts and no particular Wall Street pedigree — with hundreds of AI agents that stitched those signals into trade decisions.

The Wall Street quants Predict was competing against employed some of the highest-paid problem-solvers on the planet. The people whose signals Kaplan aggregated told him they were embarrassed to submit anything. They did not believe they knew enough. The signals worked anyway.

I have thought about that fact all week since the recording. Because the empirical claim underneath it — many imperfect signals, correctly aggregated, beat a small number of very expensive ones — is the exact opposite of the architectural claim the frontier labs are making about AI values. The labs are betting that a small number of very expensive researchers will produce a values rulebook that beats what a billion humans would collectively produce. Kaplan bet the opposite proposition on Wall Street, with real money, for fourteen years. And won.

Reading this far?

The Control Layer publishes weekly. Every claim sourced. Every prediction on a public tracker we come back to test. Subscribe free.

Subscribe now

Democratic AI, plainly

The architecture Kaplan spent the last five years designing — free, published, open to whoever wants to take it — is called Democratic AI. It sits at SuperIntelligence.com, in more than a thousand pages of white papers and a series of short explainer videos.

The word is heavy, and Kaplan warned me on the recording that it invites the wrong assumption. Democratic AI is not town halls and voting on the weather. It is a specific technical architecture with three components.

First, personalised AI agents. Not off-the-shelf. Yours. Learning your values from the way you use it and the explicit instructions you give it. Anthropic already ships this in the form of a soul.md file where you can type your own little constitution. The trend across the industry, from Meta downwards, is already moving here — Meta announced “personal superintelligence for everyone” as their strategic direction in July 2025, and Zuckerberg has since positioned 2026 as the year the technology begins to ship. Kaplan’s argument is that personalisation is unavoidable, because the commercial value sits there.

Second, a coordination protocol. Kaplan and his late supervisor Herbert Simon documented one back in 1972 in a book called Human Problem Solving, which laid out how any problem-solver — human or AI — can be represented in a form that lets other problem-solvers work with it without miscommunication. Simon’s Nobel Memorial Prize in Economic Sciences, his Turing Award, and much of his research legacy sit on this foundation. The point is that the coordination substrate for a society of agents already exists in the academic record.

Third, a conflict-resolution mechanism. When my AI’s values and your AI’s values collide — and they will, on loan applications, on hiring decisions, on cross-border data flows — the system needs an agreed way to arbitrate. Kaplan’s default is one-human-one-vote, with the ability to delegate to a trusted proxy. The mechanism is drawn from the way human democracies handle conflicts. It is designed to be robust to bad actors because the checks and balances are external to any individual AI.

The three components are already being built. Kaplan’s argument is not that they need to be invented — it is that they need to be architected together, deliberately, before the frontier labs lock in the centralised alternative.

HAL 9000 is the warning we got wrong

Every film about AI going bad hands us the same picture. One enormous machine. One catastrophic decision. No off switch. Whether it is HAL 9000 in the cupboard on the Discovery, or Skynet, or the machines in The Matrix, the cinematic AI failure mode is always the same shape — a single autonomous intelligence, cut off from human oversight, making one terminal call.

Kaplan’s work has convinced me that HAL is the warning we got and the prediction we got wrong.

The failure mode that is actually coming is not one enormous machine. It is a large number of individually reasonable machines, coordinating through channels their designers never mapped, with values none of us consciously chose. When that fails — and it will, in ways we will not see coming — it will not look like Terminator. It will look like an aggregated mistake nobody can be held accountable for because nobody made it.

That is a different failure mode. It needs a different architecture to prevent.

Predictive Judgement

Every episode of The Control Layer closes on a falsifiable predictive judgement from the guest. Kaplan’s is in two tiers.

Near term — by 31 December 2027. Craig predicts that the industry’s focus shifts sharply and visibly onto coordinating communities of AI agents, not building bigger single models. The signals to watch: at least two of the frontier labs — Anthropic, OpenAI, Meta, Google DeepMind, xAI — release a public multi-agent coordination framework, and one of the major standards bodies (IEEE, NIST, or the European AI Office) opens formal consultation on agent-community protocols. Falsifiable if, by 31 December 2027, no such framework exists in the public record and the frontier-lab investment thesis is still dominated by single-model scaling.

Longer term — by 31 December 2029. Craig predicts that community-level superintelligence — that is, a coordinated multi-agent system exhibiting capabilities beyond any individual model it contains — emerges publicly. The signal: a peer-reviewed or lab-published demonstration of a multi-agent community outperforming state-of-the-art single models on a benchmark neither the individual agents nor the coordinator could achieve alone. Falsifiable if, by end 2029, no such demonstration exists and single-model progress has clearly displaced multi-agent research as the dominant investment thesis.

Both predictions are on the public Control Layer predictions tracker. We come back to test them, publicly, on the dates given.

The publication that calls its predictions in writing.

Every prediction we publish goes on a public tracker. We revisit each one publicly on its test date — whether the guest was right, wrong, or partially right. If you want to be here when we test Craig Kaplan’s, subscribe free.

Subscribe now

The Bottom Line

Kaplan gave one practical takeaway for the CISO, the CIO, the head of procurement and the in-house counsel signing off on AI vendors this quarter. The most important question you can ask a vendor is not about capability. It is about values — whose values is this model actually optimising for, and who chose them?

Most vendors, on Kaplan’s forecast, will not have a real answer.

The reason to keep watching this space — and to come back to test the prediction when the date arrives — is that the architecture the industry defaults into over the next three years determines what values our children’s AIs run on. And nobody, on the current trajectory, is being asked to consciously choose.

Whose values does your AI run on. It is not a rhetorical question. It is a governance decision your board has already made — by not making it.

Where to find Craig’s work

• Democratic AI architecture, freely published: SuperIntelligence.com

• iQ Company and iQ Studios: iqco.com

• The full podcast episode: youtu.be/8F9sr21ELpg

Where to find The Control Layer

• Weekly on Substack: The Control Layer

• Subscribe free: link.arkava.ai/join

• The predictions tracker: linked from every episode page

The Control Layer publishes weekly.

The publication and podcast for senior decision-makers who take AI, cybersecurity, sovereignty and technology seriously. Every claim sourced. Every prediction on a public tracker we come back to test.

Subscribe now

Footnotes

The Control Layer is edited by Amer Altaf, Founder & CEO of Arkava, the sovereign AI agentic automation company. 2026 Arkava. All rights reserved.

Read more

Twenty minutes into our conversation, I put what I thought was a watertight proposition to Antonina Burlachenko. A company signs a contract with its AI vendor. In black and white, the vendor agrees t…

Read more

If your company runs an AI hiring tool, scores customers, automates a decision, or has wired AI into its operations, you may already be in scope — not as the AI lab, but as a deployer, and sometimes, without ever realising it, as a provider. We get into the deployer‑versus‑provider line that catches almost everyone, the Article 25 clause that quietly turns a buyer into a manufacturer regardless of what the contract says, what is still legally binding on 2 August 2026, and why the documentation you need cannot be faked at the audit. It ends, as every episode does, with a falsifiable prediction we write down and come back to.

In this episode

• Why the EU AI Act binds ordinary companies that do not think of themselves as “AI companies”

• The three ways you can become a “provider” without knowing it — and why your indemnity clause does not stop it

• What actually counts as “high‑risk” AI under Annex III

• Why a US company with no European office can still be caught

• What the moved deadline did — and did not — change, and what stays live on 2 August 2026

• The evidence you have to capture from week one, because you cannot reconstruct it later

• ISO 42001: real protection, or a badge for the website?

• Antonina’s prediction for the first real enforcement action

Timestamps

00:00 The EU AI Act trap hiding in “we don’t build AI”
00:55 Why this law applies to you
03:09 Who Antonina is and why she’d know
05:28 The one thing that makes the room go quiet
07:11 How a buyer becomes the “manufacturer” (Article 25)
09:37 What actually counts as “high-risk” AI
11:26 No EU office? You’re still in scope
13:42 Provider or deployer: where the line sits
14:55 “I just bought Copilot — am I a provider?”
17:22 What a deployer must do every single week
19:46 The vendor contract that’s worth nothing
23:33 What Brussels actually changed — and what it didn’t
25:58 Reprieve, or a longer run-up to the same wall?
27:47 What’s still binding on 2 August 2026?
30:05 Start now, wait — and did the EU get it right?
37:01 Why you can’t fake the evidence at the audit
40:47 Three things to write down from week one
43:50 ISO 42001: real armour or website badge?
47:16 Chicago to Germany — caught anyway
49:10 One company, three rulebooks
51:04 What calm companies have that the panicking don’t
53:15 Her prediction: the first enforcement action
54:42 Time machine: what she’d tell her 2024 self

Three lines worth the click

• “For all three cases, the contract is not important. The responsibility lies with whoever is the provider.” — on why your vendor indemnity does not transfer the risk.

• “How do you document control of that bias after the fact? I have no idea.” — on why AI compliance evidence has to be captured as you go.

• “You don’t have a choice.” — on why the Act reaches you wherever you are headquartered.

About the guest

Antonina Burlachenko is Head of Regulatory Consulting at STAR, where she leads a team taking regulated products to market and building the quality, information‑security and AI‑management systems underneath them — across medical‑device regulation, the Cyber Resilience Act, GDPR and the EU AI Act. Her work spans advisory, internal audits and the due‑diligence assessments investors commission before they invest. Connect with Antonina on LinkedIn.

Read, watch, and go deeper

• Read the companion essay: The EU AI Act Already Applies to You — the full written analysis, with sources → [link]

• Watch on YouTube:

• Listen: [Apple Podcasts] · [Spotify]

• Sources: EU AI Act, Article 25 · Annex III high‑risk uses · Gibson Dunn — the Digital Omnibus deferral (May 2026) · European Commission — AI regulatory framework · ISO/IEC 42001

The Control Layer publishes weekly — decision‑grade analysis on AI, cybersecurity, and technology sovereignty, written for the board paper, not the timeline. Every episode ends with a prediction we write down and call in writing. Subscribe free, and you will be here when we find out whether Antonina was right.

Subscribe now

The Control Layer is written and hosted by Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.

#EUAIAct #AIgovernance #AIcompliance #ISO42001

Sometime in April 2026, the engineering organisation at Uber reached a conclusion that would have been difficult to imagine a year earlier. It had spent its entire 2026 budget for AI coding tools. Th…

Read more

The 60-second version

• We measure how good AI is using “benchmarks” — standardised exams. Leaderboards, scores, the lot.

• At Nebius Build London, the team behind one of these exams showed what happens as…

Read more

The 60-second version

• Wayve, a London company, is partnering with Uber to put self-driving cars on London’s roads in 2026. You’ll hail one through the Uber app.

• It doesn’t drive by following millions o…

Read more

At 5:21 on a Friday afternoon in Washi…

Read more

The 60-second version

• Most companies “rent” AI: they send their data to a black box in someone else’s data centre and pay by the use. You can’t see inside it, and you can’t take it home.

• “Open-weight” …

Read more

On 3 June 2026, on a stage in New York, Vanta launched a product designed to solve a problem that, by its own figures, almost no one is currently solving.

The product is the Vanta Agent for Risk. The …

Read more