AI Governance for Business Systems: The Layer Nobody Built

TL;DR: AI is already configuring parts of your Salesforce, Conga, and HubSpot instances, and almost nobody has decided who checks that work before it ships.  The fix isn’t slowing AI down; it’s building the layer that was always supposed to sit between a recommendation and production: an inspection point.  That’s an AI Readiness Assessment up front and a standing governance review built into managed services, not a one-time audit.

Every company we work with has someone using AI inside their business systems right now, and almost none of them have decided who’s responsible for checking the work.

That’s not a knock on any one client.  It’s just where we are.  AI showed up in Salesforce orgs, in Conga templates, and in HubSpot workflows faster than anyone had built a process for reviewing what it produced. A few years ago, if someone wanted to change how contracts were approved or how a lead was routed, that request went through an admin, maybe a consultant, or a change control process with an actual approval step.  Now someone opens a chat window, describes what they want, and the system starts producing a configuration.  No queue.  No second set of eyes.  No governance, because governance was built for a world where changes moved slowly enough for a person to catch them.

We saw this play out with a client recently.  Someone on their team, without a deep Salesforce or Conga background, started using AI to configure part of their contract process.  Not maliciously, not even recklessly by their own standard.  They had a problem, AI gave them a path that sounded right, and they followed it.  The trouble is that “sounds right” and “is right” aren’t the same test, and the person running the AI had no way to tell the difference.  That’s not a failure of the tool.  It’s a failure to have no one in place to catch it before it ships.

This is the part that gets missed in most of the AI conversations happening in boardrooms right now.  Everyone’s asking which tool to adopt, which model performs best,  and how to roll out AI across the team.  Those are fine questions.  But they’re not the question that actually determines whether AI helps you or quietly damages your systems.  The real question is whether anything stands between what AI recommends and what goes into production.  Right now, for most companies, the answer is nothing.

We’re not against citizen development.  Giving business users more ability to solve their own problems is a good thing, and AI genuinely expands what a non-technical person can attempt.  But more power without more structure just means people can break things faster than before. A business user with no Salesforce architecture background, making declarative changes by hand, was once limited by how much damage they could cause in a day.  AI removes that speed limit.  It doesn’t remove the need for someone who understands why the system is built the way it is.

That’s the layer we think is missing, and it’s the layer we think firms like ours exist to provide.  Not as a brake on AI adoption.  As the equivalent of a building inspector who shows up after the framing is done and checks whether the foundation is actually sound, before anyone moves in.  Clients can use AI to move fast.  Someone still has to look at what got built and ask whether it will hold up in six months, whether it aligns with how the rest of the system works, and whether it’s the kind of decision that needs sign-off before it touches production data.

Practically, that means a few things for how we’re restructuring engagements going forward.  It means an AI Readiness Assessment before a client leans harder into AI-driven configuration, so we know where the guardrails need to go before something breaks, not after.  It means a governance review as a standing part of managed services, not a one-time audit, because the risk isn’t a single bad decision, it’s an accumulation of small ones that nobody was checking.  And it means being honest with clients that if their team is going to use AI to touch Salesforce, Conga, or HubSpot directly, someone with real platform expertise needs to be in the loop on what gets deployed, even if that slows things down slightly in the short term.

None of this is about distrust of AI.  We use it constantly, and it’s made us faster in ways that are hard to overstate.  But speed was never actually the scarce resource in enterprise systems work.  Judgment was.  AI didn’t change that.  It just made it much clearer how many organizations never built a place for judgment to sit.  That’s the gap we think is worth naming, and we intend to fill it.