Jon W. Hansen, FCIPS · Procurement Insights | Hansen Models™ · October 2026
This week, three well-made graphics on AI governance crossed my feed. One from Gartner on context engineering. One from Dan Storbaek on moving AI governance from the server room to the boardroom. And one from AI For Leaders on bringing shadow AI agents into the light.
Each is clear, thoughtful and worth reading. Each also shares one picture of the organization: a map that can be declared in advance, with AI then governed against that map. Below, each original appears on the left, with full credit, under the heading How the industry views the AI world. On the right, under How Hansen knows the AI world, is how we see the same subject, and where we have seen it fail, not just today but in every technology era we have covered since the early ERP days.
1. Context engineering
The 10-second takeaway: Gartner engineers context in advance, from what the organization can declare. We discover the context nobody declared by tracing back when real outcomes depart from expectations.
Graphic: Gartner, “Why Enterprise AI Success Depends on Context Engineering,” posted by Gartner for IT on LinkedIn, October 2026. © 2026 Gartner, Inc. and/or its affiliates.
Gartner makes two important points: context is dynamic and situational rather than a static repository, and undocumented processes and institutional knowledge are a leading cause of agent drift. Its unified context framework assembles context from intent, general knowledge, persistent data, dynamic state, interaction history and tacit knowledge.
Through Hansen eyes, three points can fail. Everything is multiplied by intent, so if the declared intent is not the operation’s real one, the error multiplies through every term. Dynamic state captured at one moment ages quietly without outcomes feeding back. And tacit knowledge enters only when someone declares it. The condition that decides an outcome is often one nobody thought to declare. It is not captured in advance. It is discovered, when an outcome departs from what was expected and someone traces back to find out why.
2. Moving AI governance to the boardroom
The 10-second takeaway: The boardroom model learns after the crisis, puts one name on the risk, and treats shadow AI as a threat to manage. We start with Phase 0™ before deployment, read shadow tools as operational evidence, and let firm fences learn from every outcome.
Graphic: Dan Storbaek, CEO, Secure Privacy, “AI Governance: Moving from the Server Room to the Boardroom,” posted on LinkedIn, October 2026.
Storbaek is right that AI governance is not an IT problem, and that shadow AI is a leadership issue rather than a technical glitch. His model moves through three phases, from technical adoption through crisis-driven awakening to boardroom oversight, supported by three pillars: definitive accountability, transparent decision-making and continuous risk adjusting.
Through Hansen eyes, the second phase is the failure itself: the organization learns because something broke. A named executive on every outcome absorbs the risk, and people under that exposure protect themselves with overrides and extra review steps. Continuous risk adjusting is the right instinct, but drift measured against the documented operation corrects toward the map, not the actual, real-world territory. And shadow AI treated only as a threat loses its value as evidence: people route around systems that don’t serve the work. The Hansen sequence starts earlier, with Phase 0™ before anything is deployed, and keeps learning from every outcome.
3. Shadow AI agents
The 10-second takeaway: Every room in your house can be clean, but the pipe is leaking in the hallway. Govern the crossings where the strands intersect, not just the isolated rooms.
Graphic: AI For Leaders, “6 Moves That Bring Shadow AI Agents Into the Light,” posted by Adam Danyal on LinkedIn, October 2026.
This one contains a line I fully agree with: an approved tool tells you what is allowed; a governed agent tells you what actually happens. Its six moves are practical: find every agent, give each a named owner, map what it can reach, rate the cost of failure, grant only what the job needs, and keep a human on sensitive actions.
Through Hansen eyes, each of those six rooms can be governed well and the outcome can still fail, because failures happen in the corridor between them, where the strands cross. In a 1998 defense maintenance operation, every function did its job as measured, and next-day delivery still sat at 51 percent against a 90 percent requirement. The failure was made of routine actions, each too small to need sign-off. Tracing back from the outcome found the crossing no room could see: the time of day the part orders arrived.
What all three leave off the map
All three graphics govern the map well. The outcome is decided in the territory. Declared context can be engineered. Undeclared operating reality, including shadow AI and technology workarounds, must first be discovered.
Related reading:
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
Related
Three Good Maps of AI Governance, and What Each One Leaves Off the Map
Posted on October 23, 2026
0
Jon W. Hansen, FCIPS · Procurement Insights | Hansen Models™ · October 2026
This week, three well-made graphics on AI governance crossed my feed. One from Gartner on context engineering. One from Dan Storbaek on moving AI governance from the server room to the boardroom. And one from AI For Leaders on bringing shadow AI agents into the light.
Each is clear, thoughtful and worth reading. Each also shares one picture of the organization: a map that can be declared in advance, with AI then governed against that map. Below, each original appears on the left, with full credit, under the heading How the industry views the AI world. On the right, under How Hansen knows the AI world, is how we see the same subject, and where we have seen it fail, not just today but in every technology era we have covered since the early ERP days.
1. Context engineering
The 10-second takeaway: Gartner engineers context in advance, from what the organization can declare. We discover the context nobody declared by tracing back when real outcomes depart from expectations.
Graphic: Gartner, “Why Enterprise AI Success Depends on Context Engineering,” posted by Gartner for IT on LinkedIn, October 2026. © 2026 Gartner, Inc. and/or its affiliates.
Gartner makes two important points: context is dynamic and situational rather than a static repository, and undocumented processes and institutional knowledge are a leading cause of agent drift. Its unified context framework assembles context from intent, general knowledge, persistent data, dynamic state, interaction history and tacit knowledge.
Through Hansen eyes, three points can fail. Everything is multiplied by intent, so if the declared intent is not the operation’s real one, the error multiplies through every term. Dynamic state captured at one moment ages quietly without outcomes feeding back. And tacit knowledge enters only when someone declares it. The condition that decides an outcome is often one nobody thought to declare. It is not captured in advance. It is discovered, when an outcome departs from what was expected and someone traces back to find out why.
2. Moving AI governance to the boardroom
The 10-second takeaway: The boardroom model learns after the crisis, puts one name on the risk, and treats shadow AI as a threat to manage. We start with Phase 0™ before deployment, read shadow tools as operational evidence, and let firm fences learn from every outcome.
Graphic: Dan Storbaek, CEO, Secure Privacy, “AI Governance: Moving from the Server Room to the Boardroom,” posted on LinkedIn, October 2026.
Storbaek is right that AI governance is not an IT problem, and that shadow AI is a leadership issue rather than a technical glitch. His model moves through three phases, from technical adoption through crisis-driven awakening to boardroom oversight, supported by three pillars: definitive accountability, transparent decision-making and continuous risk adjusting.
Through Hansen eyes, the second phase is the failure itself: the organization learns because something broke. A named executive on every outcome absorbs the risk, and people under that exposure protect themselves with overrides and extra review steps. Continuous risk adjusting is the right instinct, but drift measured against the documented operation corrects toward the map, not the actual, real-world territory. And shadow AI treated only as a threat loses its value as evidence: people route around systems that don’t serve the work. The Hansen sequence starts earlier, with Phase 0™ before anything is deployed, and keeps learning from every outcome.
3. Shadow AI agents
The 10-second takeaway: Every room in your house can be clean, but the pipe is leaking in the hallway. Govern the crossings where the strands intersect, not just the isolated rooms.
Graphic: AI For Leaders, “6 Moves That Bring Shadow AI Agents Into the Light,” posted by Adam Danyal on LinkedIn, October 2026.
This one contains a line I fully agree with: an approved tool tells you what is allowed; a governed agent tells you what actually happens. Its six moves are practical: find every agent, give each a named owner, map what it can reach, rate the cost of failure, grant only what the job needs, and keep a human on sensitive actions.
Through Hansen eyes, each of those six rooms can be governed well and the outcome can still fail, because failures happen in the corridor between them, where the strands cross. In a 1998 defense maintenance operation, every function did its job as measured, and next-day delivery still sat at 51 percent against a 90 percent requirement. The failure was made of routine actions, each too small to need sign-off. Tracing back from the outcome found the crossing no room could see: the time of day the part orders arrived.
What all three leave off the map
All three graphics govern the map well. The outcome is decided in the territory. Declared context can be engineered. Undeclared operating reality, including shadow AI and technology workarounds, must first be discovered.
Related reading:
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
Share this:
Like this:
Related