They measured what the room allowed And wrote the finding down The bars were in the instrument And the instrument was sound
The week ran one mechanism through six rooms. A dog on a lead short enough to end the search. Six departments each removing one risk and nobody owning the remainder. A map of workarounds that turned out to be a design document. A system that learned which true sentences the building could stand. A person absorbing everything the architecture declined to build. A gate with a name on the hinge.
A synthesis owes the practical residue, so here is the uncomfortable part first. This desk has spent the week describing organisations that produced a disappointing AI result, and it is going to argue that the result was real and correctly measured, and that it was about something other than what everybody thinks.
That is a narrower claim than it sounds, and it is easy to overclaim into nonsense, so the guardrails go up before the argument does.
The result everybody quotes
MIT's Project NANDA published The GenAI Divide: State of AI in Business 2025 and produced the statistic of the year: the overwhelming majority of enterprise generative AI pilots delivered no measurable return, against tens of billions of dollars of investment.
The number travelled because it was useful to two opposed audiences at once. It confirmed the sceptic's view that the technology is overhyped. It confirmed the vendor's view that everyone else's implementation is bad. Both readings skip the report's own diagnosis, which is more interesting than either.
The barrier the authors identify is learning. The systems in these deployments do not retain feedback, do not adapt to context, and do not improve over time. They call it the learning gap and locate it in the tools.
Set that beside the week. Retention removed by Privacy, for a defensible reason. Context removed by Legal, for a defensible reason. Cross-record inference removed for a lawful-basis reason nobody had time to assess properly. Adaptation prevented by an approval chain that rejects any output which would require somebody to reopen a decision. Improvement over time prevented by the absence of any mechanism through which a person's correction becomes anything other than an edit in a document.
The report describes those as properties of the systems. In a great many buildings they are procurement outcomes, policy outcomes, and the residue of arguments between departments that neither side lost.
The same report found the overwhelming majority of employees using personal language models for work regardless. So the buildings that returned nothing measurable were, at the same time, full of people getting value out of the same technology through a browser tab. That is a single organisation running two configurations concurrently and reporting the results of one of them.
Naming the tested thing
An AI trial does not test a model. It tests a configuration, and the configuration has at least eight components in it: the model, the tools it can reach, the context it receives, the memory it keeps, the permissions around all of that, the formation of the people using it, the review structure, and the organisation's tolerance for being told something it did not want to hear.
Change any one of those and the result changes. Which means the finding attaches to the configuration, and the sentence we tried AI and it did not help is missing seven of its eight subjects.
Incidence is the instrument Who's On The List left for this. Never ask what a rule prohibits. Ask who ends up carrying it. Run it across the week and the answer is consistent: the reviewer reconstructing the case file, the community monitor whose retaliation complaint got summarised into neutrality, the employee servicing permission debt in unpaid hours. None of them wrote the policy. None of them had standing to contest it. All of them are carrying it.
The counted world is the second instrument and it does the heavier lifting here. When a restriction goes in and the numbers improve, ask whether the harm fell or whether it left the measurement. Indoors, the version is sharper. When an organisation restricts AI and its incident count stays clean, the risk did not evaporate. Cross-case inference moved from a system that could have been logged into a person's memory, which cannot be. Evidence handling moved from an audited pipeline into a copy-paste no one can reconstruct. The thinking moved to a browser tab that appears in no report.
The dashboard improved. The organisation became less legible to itself. Both statements are true and only one of them is in the pack.
The counterclaim, given its day
The easy version of this argument is wrong and this desk is not making it.
A failed trial is not secretly a success. Some models are genuinely poor fits for the work in front of them, and no permission architecture is responsible for that. Some workflows should stay human, and the correct finding is to leave them alone rather than to widen an envelope until something can be automated. Some capability will never justify its integration cost, and an organisation that decides so after a careful trial has governed well. Plenty of disappointing pilots were disappointing because the thing did not work.
The arc becomes propaganda the moment every poor result gets blamed on the cage, and there is a whole consulting industry currently making exactly that move, since it converts every failure into an argument for more spending.
So the correction stays narrow. Name the tested configuration before claiming what the result means. If the model never saw the evidence, never kept the context, never reached the system where the work lives, and was never permitted to say the thing that would have mattered, the trial produced accurate data about a configuration nobody designed and nobody owns.
The honest comparison is between configured operating envelopes rather than between model labels. Two organisations running the same model can be running two different systems, and at present nothing in the way any of this gets reported would let you tell.
What the cage measured
Which is where the week's title finally does its work.
The restriction architecture is not only an obstacle. It is an instrument, and it took a measurement. Read its dimensions back and they describe the institution rather than the technology.
How far it was willing to let intelligence approach consequential work. Which risks it could name well enough to fit a control to them, and which it handled by removing everything nearby. Whether anybody would own the composition of its restrictions, or whether the composition remained the property of nobody. How much hidden labour it expected a person to absorb without booking it. And whether it could tolerate being contradicted by something it had paid for.
That last one is the load-bearing measurement and almost nobody takes it deliberately. An organisation that has trained its systems, through ordinary use, to deliver only findings the building can stand, has learned something about itself that no engagement survey would ever have surfaced. The tool became an unusually precise instrument for measuring institutional tolerance for bad news, and the reading came back low, and the reading was filed as a successful adoption.
It did not test AI at work. It tested AI inside the institution's present permission architecture.
What this desk actually thinks
No hedging on the last morning.
Restriction intensity is not a measure of governance. That is this week's version of last week's finding, and the two sentences are the same sentence at different altitudes. Hugging Face became safer by gaining access to less restricted capability because the refusal reached the defender and not the attacker. An organisation becomes better governed by letting capability near the work with an owner on it, receipts under it, and a person who can stop it, because the alternative is not less risk. It is risk that has moved somewhere nobody is counting.
The direction worth building toward has not changed since Counting Gardens: capacity that returns to the human side, a crossing governed rather than sold, intelligence as infrastructure rather than tenancy. What this week adds is that the governing has to be done by somebody, in writing, with a name attached, in both directions.
And the thing the arc is not recommending, stated plainly because implication is where beige gets in. Not more autonomy for its own sake. Not the removal of guardrails. Not a general presumption in favour of access. Not the argument that a disappointing pilot proves the organisation was too cautious, which is the version a vendor would like you to take away and which this desk considers approximately as honest as the version it spent the week correcting.
What it recommends is a ledger and an owner. For every restriction: the risk reduced, the capability removed, the human labour created, the failure made harder to observe. For every envelope: purpose, memory, tools, evidence, owner, standing, and the trigger that closes it. For every trial result: the configuration it was a result about.
None of that requires anybody's permission to start, which is most of its value.
The two questions that fit in a pocket
The week leaves the same shape the last one did, because the mechanism is the same mechanism.
Who carries this control? Not who wrote it. Who absorbs the hours, reconstructs the context, and holds the accountability for the gap it created.
Is the improvement still inside the measurement? Or did the work simply relocate to a place the dashboard cannot see, where it will stay until it appears in a form nobody enjoys.
Neither question requires anybody's cooperation to ask. Both of them can be asked in a corridor by somebody with no authority whatsoever, which is why they are worth more than the framework they will eventually be turned into.
The handoff
Next week the arc goes further into the building, and it gets to be funnier, because the material is genuinely absurd once the architecture underneath it has been established.
Everything this week described has a lived texture. The demonstration that runs beautifully and touches nothing. The email whose every sentence has been sanded until it could not offend a tribunal or inform a colleague. The summary generated for a meeting where the decision was taken in the corridor beforehand. The system introduced to the organisation as a colleague and issued the access of a guest.
This arc supplied the causal account of why that architecture is produced by sensible people. The next one shows what it feels like to work inside it, which is a different job and needs a lighter hand.
The machine may have failed the trial. The trial also measured the room that conducted it.
Companions
- The week: The Leash, The Safe Useless Thing, The Permission Surface, The Housebroken Oracle, The Human in the Display Case, The Control That Can Say Yes.
- The arc this one follows and the condition it carries: The Remedy Went the Forbidden Way and the Exit arc entire.
- The settlement being tested indoors: Counting Gardens and the Symbiosis arc.
- The result and its diagnosis: MIT Project NANDA, The GenAI Divide: State of AI in Business 2025.
- The measurement instruments: Dashboard Goodhart and The Experiment Nobody Authorized.
- The person the whole week was about: The Liability Sponge and the Humane Loop arc.
These notes come out of Sociable Systems, a practice that reads AI-shaped documents the way a hostile reviewer will, before a lender or a court finds the gap. The argument has an operational form: the Interim Protocol sets out four rules for AI use in environmental and social deliverables, covering disclosure at touch-point grain, evidence custody, the phrases no automated screening may settle, and a hostile read before anything ships. Free, and written to be cited or retired once institutional guidance arrives.