Your company runs on rules nobody ever wrote down

Think about the last person you hired into a real role. Not a junior. Someone senior, someone you were glad to get. Now count the months before they stopped starting questions with "sorry, quick one, how do we usually handle this?"

Four months. Six. Sometimes more.

They were not slow. They were doing the only thing a person can do inside a company where most of the rules live in people's heads. They watched. They asked. They guessed. They got one thing wrong, someone corrected them in a hallway, and they filed it away for next time. That is how a human learns "how we do things here."

You have probably never written most of it down. Neither has anyone else. And for years that was fine. The people compensate.

Then you decide to put AI into the business, and the whole thing stops being fine.

There is a certain kind of company where this runs for a decade and nobody sees the risk. The rules live in the people, the people stay, and the business runs on memory. It works right up until the day it has to run on something else.

Design the controls around the agent

The kind of constraint architecture a company normally postpones until it has hundreds of engineers becomes an early requirement the moment agents are involved. The constraints are what allow speed without decay.

Strip the engineering words out of that sentence. The rules are what let you go fast without the whole thing quietly coming apart.

The model can interpret a request, but its instructions do not guarantee compliance. Enforce authorization in the downstream systems, validate inputs and outputs, and require human approval for consequential actions. OWASP describes these controls for excessive agency.

Written policy and enforced permission are separate

A new employee absorbs the unwritten ones. They pick up that this client always gets a call before an email. That this invoice never goes out without a second set of eyes. That you do not promise a delivery date on a Friday. Nobody documented any of it. The person learned it by being human in the room.

Missing context can produce a confident error. Even a written rule can be misinterpreted. Use representative examples, adversarial cases, duplicate-action protection and a tested escalation path.

A first agent project is a useful test of how explicit the workflow really is. It exposes gaps that should be resolved before the system can act.

They will rebuild internal tools because they suddenly can. Their agents will invent a fresh way of doing something that already had a company standard nobody remembered. The sprawl multiplies before anyone imposes order. Companies are about to re-learn, in fast motion, lessons that used to take a decade and a few hundred employees to arrive at.

The need for documentation follows operational risk and dependencies, not a universal engineering headcount threshold. Start with the rules whose failure would affect clients, money or access.

Agents break that math. The moment you hand real work to a machine, the need for explicit rules arrives years earlier than it used to. A forty-person company now hits a problem that used to belong to a four-hundred-person one.

So the instinct in the room is usually "let's slow down, let's not bury ourselves in process, process kills momentum."

I understand it. In most companies, process really did become a tax. Someone added an approval in 2021 that no longer protects anything, and three people still route a document through it out of habit. Of course you are suspicious of more rules.

But that suspicion is aimed at the wrong target. A rule that no longer protects anything is a tax. A rule that tells a fast machine where the edges are is the reason you can let it run at all. Same word, opposite jobs.

Explicit boundaries let the team test whether a machine is safe to use for a particular task. They need enforcement and monitoring after launch as well as documentation before it.

If you are thinking about putting AI into your operations this year, the real first step is not choosing a tool. It is writing down the game your company actually plays. What gets decided, and by whom. What never leaves the building without a human looking at it first. And the rules everyone follows that no one has ever said out loud.

That work is uncomfortable, and it buys you more than anything else you can do before a single agent goes live. Do it, and the constraint stops being a cost. It turns into the thing that lets the rest of the business move without you standing over it.

That is the conversation worth having before the tools arrive, not after they have made a confident mess of the parts you never wrote down. If you want to map where your company's rules actually live, and what has to become explicit before you automate anything, that is exactly what a first session is for.