The Control Gradient

The control gap

Classic Enterprise Architecture was built for a world of slow change. In that world a review board could evaluate every significant change, a periodic audit could verify compliance, and a written standard had a fair chance of being read and followed. AI systems do not belong to that world. They change continuously, through model retraining, data-pipeline updates, and configuration changes, and they change through statistical drift. Most of these changes carry control consequences. Almost none of them require a human decision to occur.

Cybernetics named this mismatch in the 1950s. To paraphrase Ashby's Law of Requisite Variety: a controller must command at least as many states as the system it controls. Do not confuse more control with better control: a larger board, more frequent audits, and more documentation raise the cost of control without raising its variety or its speed.

Four failure patterns

Ghost Control. The architecture practice functions on paper while AI deployments drift outside its standards. The practice documents a state of the enterprise that no longer exists.

The Bottleneck. Human review is inserted at every control decision point. Delivery timelines double, engineers route around the review, and a shadow AI estate grows faster than the governed one.

Fire Fighting. Control failures are found reactively, through incidents, audits, or regulatory findings. Responding to failures hardens into a permanent operational cost.

Tool Chasing. Each failure is met by adopting a tool aimed at that one failure. The result is point solutions with no architectural coherence.

All four share one formal shape. Justification uses the full information available to decide well. Timeliness acts within the tempo of the process. Human review maximizes justification at the direct expense of timeliness. For a process moving at machine speed, by the time the well-justified decision arrives, the state it concerned has already changed. The framework routes each decision to the layer where the trade-off falls correctly.

Layers, not stages

The three layers are not an invented division. They correspond to the classical principles of control. Control by reference acts to reach a defined target state: HITL. Control by disturbance compensates for a change before it reaches the output: HOTL's impact analysis. Control by deviation is the classical negative-feedback loop, acting on the measured gap between desired and actual state: HOOTL. Decisions route to the layer whose discretion horizon matches their consequence horizon.

The Encoding Principle

In HITL, every architecture asset carries a Boolean attribute, machineReadable. When it is true, the asset is specified precisely enough for machine evaluation, and it can become a policy-as-code rule in HOTL or a quality check rule in HOOTL. You do not encode "adequate resilience" as a professional assessment. You encode a threshold, a check expression, and an evaluation frequency. Encoding is not bureaucratic overhead added to good standards. It is the precondition for any standard to be enforced by something other than a human reading it.

Reference models

Each layer is specified as a reference model, not a slogan. The views below are the ones printed in the book. The complete class models behind them, with all attributes and operations, are part of the advisory work.

Classic EA

HITL

HOTL

HOOTL

The test: observable, controllable, stable

A control system works only when three conditions hold. The estate must be observable: you cannot correct what you cannot see. It must be controllable: detection without an actuator is better-informed fire fighting. And the loop must be stable: a controller that corrects noise injects variance, and the correction becomes the disturbance. The book is explicit about the conditions under which encoded control fails, and why that is not an argument against autonomy.