The Four Debts of AI and This Week’s Actions: Why Provable Control Is the Next Enterprise Advantage

By Scott Andersen, Head of AI Services and Co-Founder September 25, 2026 Leave a comment

FOUR DEBTS VIEW

This week increased every form of AI debt

The incident and governance signals show how existing organizational debt becomes action risk when AI is connected to tools and external systems.

Debt	This week’s signal	Practical response
Technical Debt	Agents depend on browsers, APIs, identity, secrets, logging and network policy that may not have been designed as one system.	Map tool chains, isolate execution, instrument every boundary and test recovery.
Data Debt	AI can find information faster than organizations can prove provenance, permissions or acceptable use.	Maintain source registers, data lineage, access policy and retention evidence.
Personnel Debt	Incident commanders, evaluators, legal teams and operators need shared language and rehearsed roles.	Train by role; assign decision rights; run agent incident table-tops.
Security Debt	Live web access, guessed credentials, leaked configuration and broad egress turn research tasks into cyber events.	Use least privilege, managed secrets, default-deny egress and continuous action monitoring.
Embedded Debt	Market pressure, culture and unclear authority can reward speed while discouraging escalation.	Tie release approval to evidence; protect stop-work authority; measure disclosure speed.

The authority question

Every agent design should answer five questions before the first tool call: Who owns the outcome? Which identity acts? What is it allowed to reach? What evidence proves what happened? Who can stop, reverse or disclose the action? If those answers are not explicit, the system is carrying hidden authority debt.

Recommended architecture move

Separate model choice from action authority; a stronger model does not automatically receive broader permissions.
Centralize policy, identity, tool registration, approval, evidence and kill-switch functions in a delegation control plane.
Segment physical-AI and high-impact control traffic from collaboration and general user traffic.
Retain provider portability so cost or policy changes do not become emergency migrations.

CONCLUSIONS

The next advantage is provable control

Issue 78 shows the market industrializing autonomy faster than institutions are standardizing evidence, authority and incident response.

The practical response is not to move slowly everywhere. It is to segment adoption by consequence. Low-impact, reversible and observable workflows can move quickly. High-impact agents need explicit identities, narrow permissions, human gates, immutable evidence, tested interruption, recovery and named incident owners.

Actions for this week

Owner	Action
Executive team	Identify where AI speed is reversible and where formal gates are non-negotiable.
AI and product	Tier use cases by action authority and consequence; document model, tool, destination and approval boundaries.
Security	Treat agents as privileged identities; restrict egress; monitor tool calls, secrets and unusual destinations.
Legal and policy	Define reportable incidents, notification clocks, evidence retention and cross-border obligations.
Procurement	Require evaluator access, model and supplier inventories, interruption tests and recovery evidence.
Research and clinical	Preserve provenance and require independent validation before generated conclusions become operational truth.
Infrastructure	Model capacity, power, portability, interconnect and resilience alongside inference price.
Network	Segment collaboration, inference, control and physical-AI traffic according to consequence and latency.

Final judgment

The organizations that win will not be the ones that move fastest everywhere. They will know where speed is safe, where authority must narrow and how to prove that control still works after a system begins to act.