Every enterprise now runs software that decides. Models summarize, agents act, and both do so against an architecture that nobody has written down in a form a machine can consult. Governance lives in documents; execution lives in systems; the gap between them is where the next decade of enterprise risk will be paid for.
Enterprise AI has a vocabulary for models and a vocabulary for risk. It has no vocabulary for the thing between them. That thing is the knowledge of what an organization is, how it is built, what it has decided, and what it would take to prove any of that to a machine at the moment the machine acts. We call the absence the control gap, and the three scenes this document opened with are the gap seen from three chairs. The agent cannot consult what was never written for it. The board cannot be answered from a record that does not exist. The acquirer cannot price what the seller cannot show.
The gap is not a lack of policy. Most large organizations have more governance documents than anyone can read. It is a lack of a governed, consultable record of the architecture those documents are meant to govern. A policy says what should be true. An architecture diagram says what was true when it was drawn. A control framework says what must be evidenced. None of them can answer, at runtime, a question an agent is about to act on.
#Three vocabularies, no translator. The board asks about posture: are we exposed, are we ready, can we prove it. The architect answers in systems, interfaces and dependencies. The engineer, and now the agent, works in calls, permissions and data. Each vocabulary is correct in its own frame. None of them translates into the others without a person doing the translation by hand, and that person's translation is the governance. When the person is in the room, the organization has governance. When the person is not, it has documents.
#Governance by document. The prevailing practice is a periodic survey. Assessors ask, owners answer, a scorecard is produced, and the organization is scored on what its people believe about it. The practice has three costs. It is stale on the day it ships, because the architecture moved while the survey ran. It cannot be consulted by a system, because a slide is not an interface. And it is unfalsifiable, because nobody can trace a score back to the evidence that produced it; the score is a consensus, not a computation.
The costs are paid in familiar currency. A transformation program stalls because nobody can say which dependencies the new platform will break. An audit finding arrives as a surprise because the control that was attested to on paper was never wired in practice. The same assessment is commissioned three times in a year, once for the regulator, once for the board and once for an acquirer, and the three answers disagree. Each of these is the control gap, paid for in time and credibility.
Those costs were tolerable when the only consumers of governance were people, who read slowly and act rarely. They are not tolerable when the consumers are agents, which read nothing they are not given and act continuously. An agent cannot open a policy binder before it provisions a resource or drafts a commitment. Either the governance is available as something the agent can call, or the agent acts on an assumption.
#Why the gap is acute now. Regulators have begun to ask for evidence of control over AI systems rather than statements of intent. Auditors ask how a decision was made and what it was checked against. Acquirers ask what they are buying when the thing being bought runs on models the seller does not own. Each of these questions has the same shape: show me the governed state of the enterprise and the evidence behind it. Almost no enterprise can answer in that shape today, and the ones that can answer do so by hand, once, for one audience.
The remainder of Part I argues that this gap will not be closed by better models, that it belongs to a layer of its own, and that the layer has a name.