I was talking with an executive recently about how AI adoption is happening across their organization. His description was pretty simple:
"Every team wants to experiment with AI. A team comes up with an idea, builds a quick MVP, and lets people try it internally to see if it actually solves the problem. If it doesn't get traction, they just move on to the next idea."
Sounds harmless, right?
Until you look at what happens in between.
Because when a team is building something "just for an experiment" nobody wants to spend six weeks figuring out production permissions for something that might never ship.
So teams do what makes sense in the moment. They start small. Build the prototype first. Figure out access, security & governance later if it gets traction.
The problem starts when the prototype works. If the prototype works, security gets involved. The team wants to move quickly because people are already relying on it. And something that was easy to build becomes surprisingly difficult to productionize.
When the project quietly dies
And sometimes the project doesn't even make it that far. Everyone stops talking about it. But the experiment/infrastructure does not always disappear as cleanly as the idea did.
- The agent may still have an LLM connection.
- It may still have API credentials.
- It may still have access to tools.
- It may still be generating API calls and consuming tokens.
- Scheduled jobs may still be running.
So you can end up with something strange: The business has abandoned the project, but the system hasn't necessarily stopped existing.
Two very different realities
This creates two very different realities inside an enterprise:
- What the C-suite thinks is happening: AI Strategy → Security Review → Controlled Experiment → Approved Deployment
- What often happens on the ground: Department Problem → Quick Prototype → Permissions Later → More Access → Real Usages → Security Scramble
And this isn't just something I heard from one executive. EY's 2026 Technology Pulse Poll found that 78% of technology leaders say AI is moving faster than their organization can manage the risks. Even more interesting: 52% of department-level AI initiatives are operating without formal approval or oversight.
That second number is the one I keep thinking about. Because when we talk about AI governance, we often imagine a system where every AI project goes through a central review before anything gets built. But that's not how experimentation actually works. We've already seen what happens.
I think governance should start the moment a prototype starts touching real infrastructure, not when it officially gets the production tag.
Froda AI provides runtime governance infrastructure for autonomous AI systems — so an experiment is discovered, scoped, and accounted for from its first real API call. Request a demo.
