There is a sentence I hear in almost every AI governance conversation, and it is almost always wrong. The sentence is: "We have controls in place."
Controls are not authority. Configuration is not authority. A setting that limits what a system will do is not the same as a decision that a named person made and will answer for. The confusion between these things is where most AI governance failures live.
AEBOK draws a five-rung ladder: setting, control, policy, boundary, authority. Each rung adds exactly one thing the rung below lacks. A setting exists. A control enforces. A policy was decided. A boundary applies a policy to one system's decisions. Authority is a boundary with a named owner and a review date.
The three-question test
When someone tells you they have controls in place, ask three questions. Who decided the limit the control enforces? Is that decision written down somewhere a board member could read it? And who answers if the system acts on it and something goes wrong?
If the answer to any of those questions is "the system" or "the vendor" or "I'm not sure," you have a control. You do not have authority.
Why this matters at scale
A single AI system making a thousand decisions a day is not a technology problem. It is a governance problem at a scale most organizations have never faced. The question is not whether the system is accurate. The question is whether the organization has decided what it may decide.
AEBOK holds that every commit point, every moment where a system's analysis becomes an action the business must answer for, needs the same paperwork we have always given people. What may be decided. Where it must stop. Who answers.
Configuration can enforce that. It cannot replace it.
Rabi Jay is the founder of The Autonomous Enterprise Institute and author of books on enterprise technology across the ERP, cloud, and AI eras. He writes The Autonomous Enterprise newsletter and hosts The Road to the Autonomous Enterprise, a daily show on AEBOK, the management standard for delegating decisions to AI.