The Control Gradient

1. Why this exists: the control gap

Classic EA was designed for human-paced processes: review boards, periodic audits, documents describing the intended state. AI deployments change continuously, at machine speed, between reviews.

Organizations that try to close this gap fall into one of four recognizable failure patterns:

• Ghost Control: the practice documents a state of the enterprise that no longer exists.
• The Bottleneck: human review is inserted at every decision point; engineers route around it; a shadow AI estate grows faster than the governed one.
• Fire Fighting: control failures are found reactively, through incidents, audits, or regulatory findings.
• Tool Chasing: each failure is met with a new point solution; there is no architectural coherence.

The answer to the control gap is not more control of the same kind. It is control that runs at the speed of the systems it governs.

2. Why at the EA level, not software or application architecture

EA operates across three functions that no lower level covers:

• Strategy: the direction, and the boundaries within which AI is permitted to operate.
• Enablement: the methods, standards, and tooling that put the strategy into practice.
• Oversight: continuous conformance, at scale.

Software architecture governs one system. Application architecture governs one application. Neither has the scope to bring coherence to resource allocation across the enterprise. Starting at EA level is not bureaucracy. It is how you avoid spending twice.

3. The three layers

The three layers are simultaneous, not sequential. A mature enterprise governed by the Control Gradient operates all three at once, and each governs a different category of decision:

• HITL (Human-in-the-Loop): high-risk, non-formalizable decisions that carry accountability.
• HOTL (Human-on-the-Loop): operational control that requires human oversight at key points.
• HOOTL (Human-out-of-the-Loop): routine, frequent, formalizable decisions that can be safely automated.

What each layer delivers

HITL delivers value before any operational layer is deployed. It introduces formal exception management: every deviation from a standard is approved, time-limited, and has a named approver and an expiry date. It introduces measurement with ownership: every KPI has an accountable team and a link to a business outcome.

HOTL gives the blast radius of a proposed change in seconds, not in days of asking teams. Standards are enforced as code at every deployment, not at the quarterly review. The Specification Engine: the Digital Twin generates specifications for AI coding tools, so software is architecturally compliant from the first commit, once the twin has reached the maturity gate defined in the roadmap.

HOOTL monitors every deployment continuously. Drift is detected and, within approved rules, corrected before it becomes an incident. What the system cannot correct, it escalates to HOTL with a classification and a recommended action. Every autonomous action is recorded as a change record and traceable to a human decision. Authority to correct autonomously is not assumed; it is earned.

Implementation sequence. The order is fixed: HITL, then HOTL, then HOOTL. The design of all three is concurrent: HITL carries machine-readable interfaces from the start; HOTL carries the quality-check infrastructure that HOOTL will later use. Each layer is described by a reference model (data dictionary, classes, associations).

4. How the layers connect: three flows

The reference models show the three layers as separate structures. In operation they are connected by three simultaneous flows:

• Authority flow, downward. HITL decisions become HOTL policy-as-code, which becomes HOOTL quality-check thresholds. Every autonomous action traces back to a human decision.
• Exception flow, upward. HOOTL escalates what it cannot handle to HOTL; HOTL escalates strategic exceptions to HITL. Exceptions are signals, not failures.
• Feedback flow, closed loop. Business outcomes update metric baselines, which refine standards, which improve enforcement, which produces better outcomes.

These three flows operating simultaneously are what make the enterprise self-controlling.

The Semantic Enterprise Graph is the enterprise modeled as typed nodes (capabilities, services, data products, teams, infrastructure) and typed dependencies: queryable, traversable, and always current. It replaces static diagrams with a machine-navigable structure, and it is what enables blast-radius computation in seconds, policy-as-code enforcement, and drift detection.

The Enterprise Digital Twin is a continuously updated, machine-queryable model of the entire enterprise: every capability, service, data product, team, dependency, supplier, and infrastructure component. The Semantic Enterprise Graph is its data structure. The twin answers three questions: what changed without authorization, what a proposed change would break, and what should happen in response. It is re-observed from live telemetry: CMDB, cloud inventory, CI/CD, source control, observability, identity and access management, security scanners, data lineage, financial operations platforms.

5. The three reference models

Each layer is specified as a reference model, not a slogan. The views below are the ones printed in the book. Each is read the same way: the question it answers, the main path through it, and the pivot, the one element on which the layer turns.

HITL, Human-in-the-Loop

How does human intent become a machine-enforceable rule?

HOTL, Human-on-the-Loop

How does the Digital Twin evaluate a proposed change, and what goes through a human, what flows on automatically?

HOOTL, Human-out-of-the-Loop

How does drift get corrected on its own, and when is it handed to a human?

The complete class models behind these views, with all attributes and operations, are part of the advisory work.

Comments and suggestions

Building a framework like this is a demanding undertaking, and differing views on its content and its method each have a legitimate claim. Comments and suggestions from colleagues are welcome at [email protected].