The new shape of enterprise work: AI, agents, & shadow work

I started this year with mostly curiosity about what was happening with AI agents.

I’ve obsessed over automation for much of my career: first as an IT leader and later in product. I’ve spent years thinking about how to remove repetitive work, orchestrate processes, and let technology take some of the weight off people. So, the idea of software doing work on someone’s behalf wasn’t particularly new. What felt different was how easy it had become.

In a relatively short period of time, I could create task workers that were personally useful. They could organize information, prepare drafts, conduct research, test ideas, and move pieces of work forward without requiring me to wire everything together in the way I would have before. The output wasn’t always impressive. Some of it was garbage. What impressed me was how dramatically the barrier to creating useful automation had changed.

The vanishing friction

Historically, friction acted as a kind of governor. Building meaningful automation required technical knowledge. You needed to understand systems, APIs, permissions, data structures, and all the unpleasant details between a good idea and something that worked.

The friction is disappearing.

From better tools to force multipliers

We’re not just giving employees better tools anymore. We’re enabling force multiplication through the ability to create task workers... the ability to create extensions of ourselves at will. That changes a lot about the way we should think about AI in the enterprise.

For the last few years, much of the conversation has understandably focused on AI as a new category of application. Employees use ChatGPT. Developers use coding assistants. Designers use generative tools. And now organizations need to know which models are being used, where data is going, and whether those services have been approved. That visibility is critical.

Without that visibility, you have a Shadow AI problem. You can’t govern something you don’t know exists.

Beyond visibility, AI is also rapidly compressing the amount of time it takes to do anything. Look at the security conversation. AI is making vulnerability discovery, analysis, exploit development, and response faster. Attackers are using these capabilities. Defenders are too. The economics and the timelines are changing.

Yet many enterprise operating models still assume humans are the pacing function, and that needs to change. Enterprise processes exist for good reasons, but the amount of time available to move through them is shrinking.

The real issue isn't the tool—it's the work

And finding AI is only the beginning. The bigger issue may well be the work itself.

An AI tool may summarize a document. An AI agent may research a problem, access enterprise data, recommend an action, invoke another tool, or hand to work to a completely different system for execution. Each individual step may look perfectly normal.

The browser sees a browser session... The identity platform sees an authentication... The endpoint platform sees activity on a device... The ITSM platform sees a ticket... The automation platform sees a workflow...

Each system has a piece of the truth. But who has the whole story?

Naming the problem: Shadow work

That creates a different kind of blind spot that I’ve started thinking about as shadow work. All the work-shaped things happening outside the traditional visibility or authority structures of the enterprise. It can be performed by people, scripts, automations, agents, or some combination of them.

That doesn’t make it inherently bad. Much of it will be incredibly valuable. People will use these capabilities to move faster, eliminate repetitive tasks, make better decisions, and create completely new ways of working. But useful work can still become consequential work, and that distinction is going to become increasingly important.

We’ve seen technology sprawl before. Every major platform shift produces it. SaaS did. Mobile did. Cloud did. Automation did. Agents are different because what sprawls may not simply be another application. It may be something capable of reasoning over context and influencing what happens next.

That’s why I don’t think Shadow AI is exactly the same as Shadow IT. Shadow IT was often something you could eventually find and put a box around. With AI, the thing you need to understand may be a chain of prompts, model calls, files, APIs, browser sessions, plug-ins, tools, automations, and human handoffs that together produce an outcome.

The applications themselves may even be approved. The work may not be.

A workforce without badges

This is also why the emerging workforce looks different from the one most enterprises were designed to manage.  We're used to a world where workers have badges. Now some are going to be made of prompts, tokens, tools, APIs, and context.

Non-human work isn’t new, of course. Scripts and bots have been around forever. The difference is that traditional automation generally has an expected shape. Agents can take a broader goal, consume context, make intermediate choices, and adapt along the way. That puts them somewhere between software, automation, operator, and assistant, with work increasingly flowing between all of them.

A person may establish a goal, and an agent may research the problem. Another system may recommend an action, and an automation may then execute it. And a completely different team may remain accountable for the result.

Governance has to move closer to the work

Governance has to move closer to the work itself, especially as AI changes the speed of operations.

The answer can’t simply be to automate everything because blind automation can create a different category of failure. We also shouldn’t confuse the presence of a person in the workflow with the presence of judgment. A human rubber-stamping a recommendation they don’t understand isn’t meaningful governance.

Speed matters, but so does judgment. And judgement requires context. A system may know that an actor is technically permitted to perform an action, but that doesn’t necessarily mean the action should happen.

People make bad decisions. Administrators make mistakes. Even deterministic automations executing exactly as designed can still cause damage when the surrounding context changes. AI simply increases the number of actors capable of participating in those decisions and the speed at which they can act.

Like I said, just because something can happen doesn’t mean it should.

And I think that is where the AI governance conversation eventually has to go.

Visibility will always be essential. Organizations need to understand what is operating across the enterprise. But seeing isn’t enough. Enterprises also need to understand the work those systems are participating in. They need enough authority to influence consequential actions. And enough history to reconstruct what happened afterward.

Why this keeps happening

Across years working in endpoint management, security, digital experience, and automation—and now AI—one thing has remained clear to me. The enterprise is still porous and fragmented. That fragmentation was expensive when humans were doing most of the work, and it's impossible to ignore now that agentic systems are doing it, too.

To be clear, AI didn't create these problems. But it is accelerating them, exposing obscurities and artificial friction that were already there.

The path forward

The next phase of enterprise AI can’t just be about adding intelligence to more applications. We need a new operating model designed for the agentic enterprise.

The hybrid workforce is arriving. Time for the systems and processes to catch up.