Governance Is an Engine, Not a Brake

Governance Is an Engine, Not a Brake

Published on Oct 14, 2026

#thought-leadership#bridge#governance#financial-services#ai

Governance Is an Engine, Not a Brake

Why the Right Controls Make Delivery Faster, and the Wrong Ones Just Make It Late

A sleek dark enterprise delivery machine rendered as a high-performance engine, with glowing purple decision pathways, evidence channels, and readiness gauges driving forward motion, while a rusted parking brake lever sits disengaged in the foreground.

Governance that only knows how to stop the car isn’t protecting the business. It’s just the most expensive way to arrive late.

Most of us have done it at least once.

You back out of the driveway, merge onto the highway, and spend anywhere from ten seconds to ten miles wondering why the car feels like it’s towing a refrigerator. The engine is fine. The transmission is fine. Then a little red light finally gets your attention.

Parking brake. Still on. Ugh.

Nothing was actually broken. You were paying full price for fuel to go slower, while cooking the one component designed to keep you alive in a worst case scenario. It’s not also called the emergency brake for no reason!

So, to get to the point: this is analogous to a lot of enterprise technology governance.

Not because governance is bad. Because, somewhere along the way, a lot of organizations decided the job of governance was to resist motion, and then act surprised when the business learned to drive around it.

Here’s the uncomfortable part. When the business routes around governance, it rarely does so on a slow Tuesday. It does so when the deployment is urgent, that one executive (you know the one!!!) is impatient, and the risk is highest. That’s precisely when you need the controls to work.

The latest data says this isn’t a hypothetical. And it says something else too: organizations that run governance as infrastructure aren’t moving slower. They’re getting more code into production, faster AND safer.

The Short Version

If you only remember six things from this article, make them these:

  • A policy that nobody follows under pressure isn’t governance. It’s a museum exhibit.
  • In a September 2026 EY survey, 98% of large-company AI leaders reported having formal AI governance policies, but 47% said their organization had skipped the process for urgent deployments.
  • DORA’s research found heavyweight external change approvals hurt delivery performance, with no evidence it lowers change failure rates.
  • Databricks reports that organizations using AI governance get more than 12 times as many AI projects into production.
  • One set of controls for everything fails both ways: it smothers low-risk work and under-protects high-risk work. Proportion is the whole game.
  • Good governance does five things: assigns decision rights early, defines readiness up front, produces evidence as a byproduct, scales controls to risk, and puts a clock on escalation.

Yes, I Have Spent an Entire Article Defending Brakes

A Formula 1 car braking hard into a corner at night, carbon brake discs glowing orange through the wheels, captured with motion blur that shows the car still carrying tremendous speed into the turn.

The fastest cars on earth have the best brakes on earth. That isn’t a coincidence. It’s the reason they can be driven that fast.

In one of my favorite and most well-received recent articles, all I did was talk about kill switches, sandboxes, and the uncomfortable question of who stops an AI agent when it goes off-script. So, it’s a fair question:

Joe, are you now arguing against brakes?

Nope. Not even a little bit.

A Formula 1 car can go from 200 mph to a complete stop in under three seconds. source Drivers don’t treat that as a limitation. They treat it as permission. Because they trust the brakes, they can carry more speed deeper into the corner and brake later than anyone running with something less reliable.

The brakes are part of what makes the car able to go so fast.

What nobody does in Formula 1 is drive the whole lap with the brakes lightly dragging, just to be safe. Nobody applies identical braking pressure at the hairpin and on the main straight. And nobody waits for a committee to convene before the braking zone.

That’s the distinction we are championing with this article. Brakes engineered into a high-performance system are a feature. Governance that only knows one move, applied everywhere, at the same pressure, regardless of the road, is a parking brake someone forgot to release.

98% Have a Policy. Almost Half Skip It. At The Worst Possible Time.

A glossy, polished governance policy binder displayed under glass like a museum artifact, while in the background a stream of glowing deployment packets bypasses it along a side channel and flows straight into production.

When the process is too slow for urgent work, urgent work stops using the process. That’s the worst possible moment for it to happen.

In September 2026, EY published an AI risk and governance survey of 202 senior AI executives at organizations with at least $1 billion in annual revenue. source

Ninety-eight percent said they have formal AI governance policies in place.

Forty-seven percent said their organization had previously not followed its AI governance process for urgent deployments.

Let that one sit for a minute. The governance existed. It was documented. Presumably someone presented it to a committee with a very confident slide. And when the stakes went up and the clock got loud, nearly half of these organizations stepped around it.

Buckle up, friends. It gets even worse.

Among organizations using agentic AI, 26% admitted they can’t detect unauthorized AI agents operating internally. Over a third (36%) had experienced an AI incident or failure with a materially negative impact. And roughly two-thirds said they lacked the internal expertise to evolve, implement, or design effective AI governance controls.

EY’s Richard Jackson summed it up neatly: organizations are “applying yesterday’s governance rules to today’s interactions with AI.”

I’d go one step further. A governance process that gets bypassed during urgent deployments has achieved something genuinely impressive. It slowed down all the routine work, then vanished for the dangerous work.

That’s not a control. That’s a toll booth on the road, which nobody uses when they’re in a hurry.

The Research Already Picked a Side

This debate isn’t new. Software delivery fought it a decade ago and the data came back with a verdict.

DORA’s research on change approval found that heavyweight approaches, like external change approval boards or a senior manager signing off on every change, have a negative impact on software delivery performance. It also found no evidence that a more formal, external review process was associated with lower change failure rates. source

Think about what that means. The ritual slowed everything down and didn’t make anything safer.

Worse, the slowdown created its own risk. Heavy approvals push teams toward larger, less frequent releases, and bigger batches carry bigger blast radii when something goes wrong. DORA found that hypothesis was supported in the data. Organizations with formal external approval processes were found to be 2.6 times more likely to be low performers. source

So, what worked instead? Peer review captured in the development platform, supported by automation that catches bad changes early: continuous testing, continuous integration, monitoring, and observability. DORA also found that simply helping teams understand the existing approval process improved performance. Clarity was a performance accelerator all by itself.

Now fast-forward to AI.

Databricks’ 2026 State of AI Agents report, drawing on more than 20,000 organizations on its platform, found that companies using evaluation tools get nearly 6 times more AI projects into production. For companies using AI governance, it’s more than 12 times. source

Twelve times.

I’ll grant the obvious caveat, because credibility matters more than a headline. That’s a vendor-reported correlation, and organizations that are mature enough to govern AI are probably mature in other ways too. Governance isn’t the only variable.

But here’s what nobody is producing: data showing that ungoverned AI is racing into production at scale and staying there. The organizations shipping the most AI are the ones that built governance into the delivery system. The ones running governance as a separate ceremony are still trying to get off the POC train.

It’s the same lesson, in a new decade, with bigger stakes.

One Speed Limit for Every Road

A split highway scene at dusk: on one side, a calm school-zone street with low speed markers and close supervision; on the other, an open interstate with high-speed lanes, guardrails, and automated monitoring gantries, both clearly part of one governed road network.

Nobody sets the same speed limit for school zones and interstates. Governance that treats a document summarizer agent like a payment processor agent will fail at properly governing either one.

In May 2026, Gartner put a name on one of the most common governance failures I see: treating everything the same. source

Gartner’s Shiva Varma said enterprises are treating AI agent governance as binary, either locked down or fully trusted, and called that the root cause of failure. The result is two failure modes running at the same time. Simple agents get over-restricted, which slows delivery and drives shadow development. More autonomous agents get under-restricted, which increases operational, security, and compliance risk.

Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps identified only after production incidents.

Read that again. The forecast isn’t “governance slowed us down.” It’s “we found out our governance didn’t fit the risk after something really bad happened as a result of the gap.”

Gartner’s answer is proportional governance: classify agents by autonomy level and trust boundary, then match controls to each level. A read-only agent that summarizes documents gets lightweight baseline controls. As agents move toward advising, acting, and operating with more autonomy, the controls deepen.

This is not a radical idea. Every Financial Services firm already does it with people. A new analyst doesn’t get the same system access as the head of treasury operations, and nobody calls that bureaucracy. It’s just how authority works.

And the gap is wide. Deloitte’s 2026 State of AI in the Enterprise found only about one in five companies has a mature governance model for autonomous AI agents. source Informatica’s 2026 survey of data leaders found three out of four organizations admit their governance hasn’t kept pace with AI adoption. source

The uniform-control approach feels safe because it’s simple to explain. If simple and safe were the same thing, this stuff sure would be easy.

What an Engine Actually Does

A clean executive infographic of a governance engine with five interlocking components labeled Decision Rights, Readiness Defined Up Front, Evidence as Exhaust, Proportional Controls, and Escalation With a Clock, all driving a single output shaft labeled Governed Flow.

An engine is a set of parts that convert energy into controlled motion. Governance should do the same thing with decisions, evidence, and risk.

So what separates governance that drives delivery from governance that drags it?

In my experience, five things. None of them are exotic. All of them are routinely skipped.

1. Decision Rights Before Decisions

Most delays I’ve seen in large programs weren’t caused by bad decisions. They were caused by no decision. Nobody knew who owned the call, so the call bounced between forums until the calendar made it for them.

An engine assigns decision rights before the decision shows up. Who decides, by when, using what criteria, and who gets consulted versus informed. When that’s clear, a decision takes a day. When it isn’t, it takes three steering committees and a pre-read that nobody read.

2. Readiness Defined Up Front, Not Discovered at the Gate

The most expensive governance moment in any delivery model is the gate where a team discovers, for the first time, what “ready” actually meant.

If the criteria for release readiness, control evidence, and acceptance aren’t known when the work starts, the tollgate isn’t a checkpoint. It’s an ambush. Good governance publishes the exit criteria at the entrance.

3. Evidence as Exhaust, Not Homework

If your teams spend the two days before a review playing hero ball, and using forensic archaeology skills to capture and aggregate evidence, your governance is generating work, but not confidence.

Mature delivery systems produce evidence as a byproduct of doing the work: approvals captured in the platform, test results attached to the change, traceability from requirement to deployment, and audit trails generated automatically. That’s DORA’s point about peer review captured in the development platform. The evidence is real because nobody had to manufacture it.

4. Proportional Controls

Routine, low-risk, reversible changes should flow through a fast, automated lane. High-risk, irreversible, customer-impacting changes should get deeper scrutiny, more evidence, and a human with real authority.

The crucial skill here is not simply building controls. Any organization can build controls. The skill is deciding which work earns which controls, and being honest when something has been over-governed (or under-governed) for years out of habit.

5. Escalation With a Clock

Every governance model has an escalation path. Very few have an escalation clock.

An engine says: if this risk isn’t resolved in five business days, it moves up the escalation chain automatically. If a decision has been pending for two weeks, that’s a signal, not a status. Decision latency is one of the most useful metrics, and hardly anyone tracks it. You can learn more about program health from your lack of decisions than another status glowing green.

Financial Services Should Go First, Not Last

Regulated industries tend to assume they’ll be the last to modernize governance. I’d argue they have the most to gain.

Regulators care about outcomes and evidence: changes authorized, duties segregated, risks identified, controls operating, and a trail that proves it. None of those requirements say that the evidence must be produced by a weekly meeting where 40 people watch someone scroll through a spreadsheet.

DORA explicitly addresses segregation of duties: the requirement that someone other than the author approve a change can be met through peer review captured in the team’s development platform. source The objective of the controls must survive. The theater doesn’t have to.

This matters more now than it did five years ago. Heck, maybe more than it did five WEEKS ago.

AI-assisted development is increasing the volume of change. Agents are starting to author code, open pull requests, and take actions in production systems. A governance model built around humans reviewing everything in a monthly forum was already struggling. At machine volume, it doesn’t just struggle. It collapses, and then the business routes around it.

The Parking Brake Test

A dashboard close-up of an enterprise cockpit with a glowing red parking-brake warning light, surrounded by delivery gauges showing decision latency, pending approvals, and evidence freshness, with a hand reaching to release the brake.

Most organizations don’t need less governance. They need to notice which parts have been dragging since they pulled out of the driveway.

Want to know whether your governance is an engine or a parking brake? Ask these questions, and answer honestly.

  • When the business is in a hurry, does work go through governance or around it?
  • Do teams know the exit criteria when the work starts, or when they reach the gate?
  • Does a low-risk, reversible change wait in the same line as a high-risk, irreversible one?
  • Is the evidence produced by the work, or recreated for the meeting?
  • How old is your oldest pending decision, and does anyone know?
  • Can anyone name something that our governance prevented last quarter? Can anyone name something it accelerated?
  • If you removed one approval step tomorrow, would anyone be able to prove it ever caught anything?

If most of your answers made you wince, the car isn’t broken.

The brake is just still on.

Where This Connects

When I introduced BRIDGE, I described it as the Balanced Release & Integrated Delivery Governance Engine.

Those last two words are not an accident.

CLEAR exists because readiness should be defined when intent is captured, not discovered at the gate. RADAR exists because escalation should be triggered by signals as they emerge, not by the status deck weeks later. BRIDGE connects decisions, evidence, readiness, and value so governance moves with the work instead of waiting for it at the end.

It also connects to the lightweight tollgates argument from Governance Without the Monolith, and to multiple articles I have published recently about the additional challenges of Agentic AI. Your AI agent’s job description defines its authority. The kill switch defines how you stop it. Proportional governance decides how much of either it needs.

That’s the whole system. Engine and brakes, engineered together.

What Good Looks Like

A calm, modern enterprise delivery operations floor where work flows smoothly through clearly lit lanes of different speeds, automated evidence streams follow each change, decision owners are visibly assigned, and a small number of high-risk items receive focused human review.

Mature governance is mostly invisible. Work moves quickly, risk gets attention in proportion to its size, and nobody rebuilds evidence the night before a review.

The mature version doesn’t look like a bigger governance office. It looks quieter.

Decision rights are published, and pending decisions have owners and deadlines.

Readiness and exit criteria are defined when work is approved, not when it arrives at the gate.

Evidence is generated by the delivery platform and is available on demand.

Controls are tiered by risk, autonomy, and reversibility, and the tiers get reviewed so old habits don’t fossilize.

Low-risk changes flow through automated lanes. High-risk changes get real scrutiny from people with real authority.

Escalations move on a clock, and decision latency is tracked like a key delivery metric, because it is one.

Urgent work goes through governance, because governance is faster than the workaround.

That last one is the real acid test. Not whether governance exists, but whether people choose it when they’re in a hurry.

Final Thoughts

Somewhere along the way, a lot of enterprises started measuring governance by how much it prevents. How many approvals. How many reviews. How many people in the room.

That’s measuring a car by how hard it is to drive.

The research has been pointing the same direction for a decade. Heavy, uniform, ceremonial governance slows delivery and doesn’t reliably make it safer. Governance built into the work, scaled to the risk, and focused on decisions and evidence gets more into production and keeps it there.

AI raises the stakes on both sides. More change, faster change, and change authored by systems that don’t attend meetings. A governance model that relies on everyone slowing down is about to discover that nobody plans to.

So keep the brakes. Make them excellent. Put them exactly where the risk lives.

Then take the parking brake off and let the engine do its job.

Join the Conversation

Where has governance actually made your delivery faster?

Where is it still running with the parking brake on?

When your organization is under pressure, does work go through the process or around it?

What’s the oldest pending decision in your program right now?

And has anyone ever proven that your heaviest approval step caught something the lighter ones would have missed?

I’d like to hear the honest version, especially the one that starts with, “Well, technically we have a policy for that.”

About the Author

Joe Mack is a Technology Consulting Senior Principal specializing in technology leadership, enterprise SDLC transformation, release management, deployment governance, and delivery optimization for household name Financial Services companies. Joe is also a lifelong self-learner and builder of systems, and Free Tier Life is one of the ways he is trying to turn those experiences and instincts into something other people can actually use.

Bibliography