In this episode, David sits down with Ajay Chankramath, head of Platform Engineering Consulting (the advisory arm of platformengineering.org), to unpack the real operational risks of AI adoption inside enterprises. Moving beyond the hype-versus-reality divide, the conversation explores where AI governance actually belongs — not at the model layer, but embedded in the workflow.

Key topics covered:

• The integrity gap: AI is being deployed on top of fragmented operating models, accelerating existing cracks rather than fixing them. Decision velocity is rising exponentially while trust infrastructure lags behind.
• Signal vs. noise: Executives are distracted by model benchmark races and AGI timelines (noise) while missing ungoverned AI already running inside their own developer workflows (signal).
• Real-world cautionary tales: From the OpenAI sandbox escape incident to a founder who vibe-coded an entire SaaS product only to suffer security breaches within three weeks — illustrating what happens when governance is absent.
• Shadow AI as a demand signal: Rather than a discipline problem, shadow AI reveals that sanctioned paths aren't meeting developer needs. The "paved paths" approach (80/20 rule) offers a framework for balancing standardization with flexibility.
• Five governance mechanisms: Identity for every agent, scoped permissions (least privilege), budgets/cost caps, verification before work counts as done, and full observability/logging.
• AI that watches vs. AI that works: Advisory AI (dashboards, summaries, copilots) requires lighter governance, while autonomous AI acting on systems of record demands a significantly higher governance bar.
• Model types and governance differences: Closed models (OpenAI, Anthropic), open weights, and open source each carry distinct governance implications around data sovereignty, audit trails, and supply chain risk.
• The 90-day action plan for CIOs: A concrete month-by-month roadmap — inventory AI usage (days 1–30), apply least-privilege scoping (days 31–60), and implement budgets, logging, and weekly agent activity reports (days 61–90).
• The one decision: No agent should run anonymous. Give every AI agent an identity, the way every employee and service already has one.

The episode closes with Ajay's core message: trust scales when verification is structural — and making verification the condition for "done" on any delegated work is the single highest-leverage operational change a leader can make.