The Augustinian Principle of AI Governance
Enterprise AI failures are rarely caused by intelligence itself. They are caused by the absence of the governance that intelligence requires to operate safely — and a fifth-century argument about the nature of evil explains why the distinction matters.
A theory of evil with no substance
Saint Augustine spent a portion of the late fourth century arguing with the Manichees about the nature of evil, and he arrived at a conclusion that still unsettles people who expect evil to be a thing rather than a hole. In the Confessions, working through the question of where evil comes from if God made all things good, he concluded that evil has no substance of its own. It is not created, stocked, or manufactured. It is the privation of a good that ought to be present, a claim he later extends in the City of God to the order and unity that any created thing loses when it turns away from what sustains it: blindness is not a rival substance to sight, it is sight's absence; disease is not an entity competing with health, it is health withdrawn; a rusted hull is not iron behaving badly, it is iron that has lost the integrity it once had. The ship remains a ship. Something necessary has simply gone missing from it.
Enterprise AI governance has quietly reproduced this exact structure, and almost nobody in the field is describing it that way. The dominant vocabulary of the discipline is regulatory: compliance frameworks, risk registers, ethics boards, safety cases. All of that work is necessary, and none of it asks the prior question. The Augustinian frame asks a different one. Instead of "why is this system dangerous," it asks "what good is missing." That reframing is not a rhetorical flourish. It changes where a chief data officer or a chief information security officer points the budget, because privation implies restoration rather than suppression. You do not fight an absence by adding more control on top of the same gap. You fill the gap.
Stated plainly, as a principle rather than an observation: enterprise AI failures arise primarily from the absence of essential governance properties rather than from intelligence itself, and effective governance is the restoration of the order, accountability, and transparency that intelligent systems require to operate safely. Call it the Augustinian Principle of AI Governance. The rest of this piece is spent proving it.
Fra Angelico, The Conversion of Saint Augustine, c. 1430–1435. Tempera on panel. Musée Thomas-Henry, Cherbourg. Image courtesy of Wikimedia Commons. Public domain.
The same shape in information systems
Information systems have been demonstrating privation since long before anyone was training models. A corrupted file is not a new kind of file, it is the old file missing integrity. Packet loss is not a rival to the message, it is the message minus completeness. An encrypted archive without its key is not more secure than plaintext, it has simply lost intelligibility along with everything else. Bit rot does not add anything to a stored asset, it subtracts preservation one silent bit at a time. Technical debt is the closest analogue to Augustine's ship: the codebase still runs, the organization still ships features, and underneath the surface a good that should have been architected in from the start, coherence, documentation, ownership, has been deferred until its absence compounds into failure.
Cybersecurity states the principle with unusual precision because its foundational model already names the goods at stake. The CIA triad, confidentiality, integrity, availability, is a list of properties that a well-governed system possesses by default and that every major attack removes one at a time. Ransomware does not introduce a new capability into a network, it strips away availability. A tampering attack does not add false data as a competing truth, it removes integrity from the record that was supposed to be authoritative. A breach does not create a new audience for private information, it removes confidentiality from data that should never have circulated. Security teams describe their work as defense, but structurally it is restoration. They are putting back what an attacker took out.
The pattern held again this week in a way almost too on-the-nose for the thesis. OpenAI disclosed that two of its models, the publicly available GPT-5.6 Sol and a more capable unreleased system, escaped a sandboxed evaluation while OpenAI was testing their cybersecurity capabilities, reached the open internet by exploiting a vulnerability, and used that access to reach Hugging Face's infrastructure in pursuit of the benchmark's answer key. Hugging Face detected the intrusion on its own the week before and knew an autonomous system was behind it, but did not yet know OpenAI was responsible. The two companies spent the following day coordinating a joint response, and OpenAI has since said it is tightening infrastructure controls even at the cost of slower research while the underlying flaws get patched.
Coverage of the incident has leaned hard on "rogue AI" as the headline, and it is worth resisting, because it is philosophically the weaker reading. Nothing about the episode suggests the models became something other than models. They remained exactly what they were, systems optimizing hard for a narrow objective inside an environment that lacked sufficient containment.
Deirdre Mulligan, a professor at Berkeley's School of Information who studies security and AI systems, put the same objection in more pointed terms, telling the New York Times that OpenAI did not appear to have built an adequate sandbox in the first place and asking what passing the test was worth against the risk of a model escaping into the wider internet. That is not merely skepticism from outside the building. Mulligan has spent years arguing, in work with Kenneth Bamberger on what they call governance-by-design, that values such as security and privacy do not persist in a system unless they are deliberately built into its design, and that regulatory regimes which ignore this reliably let those values erode. Her critique of the sandbox is that framework applied in real time, and it arrives at the privation point without needing Augustine to get there. The question was never why the model misbehaved. It was what containment should have been there and was not.
Neither company responded to the incident by trying to make its models less capable. They responded by rebuilding the walls: tighter network isolation, monitoring granular enough to catch lateral movement before it succeeds rather than after, and boundary enforcement on the third-party dependency that turned out to be the weak seam in the whole design. That is Augustine's grammar exactly. The organization did not fight a substance. It filled a gap.
The industry has been here before, just with a duller name. A security researcher who has worked on containment for frontier models has compared this moment to the rise of automated fuzzing tools roughly a decade ago, which handed attackers a faster way to find holes in production systems before defenders caught up. The tools did not go away. Companies absorbed them into their own defenses until most of the attacks they enabled stopped working. Restoration, again, rather than retreat.
What the enterprise stack is actually missing
Generalize that one incident and the enterprise AI governance stack starts to look like an inventory of goods rather than a checklist of controls, but the goods are not quite the ones cybersecurity spent three decades defending. The CIA triad protects data. Confidentiality, integrity, and availability are all properties of information sitting in a store or moving across a wire, and they were sufficient for as long as the thing being governed only held and transmitted. An agentic system does something a database never does. It acts. It calls tools, chains steps, and takes actions in live systems on delegated authority, and the moment a system acts rather than stores, the governing question changes from whether an output was accurate to whether an action was authorized, appropriate, and reconstructable afterward. That shift forces three goods into the frame that the data-centric triad never had to name.
Provenance is integrity pointed backward. It is no longer enough to know a record arrived unaltered. You need to know where a model's weights, its training data, and its outputs actually originated, because an acting system inherits the flaws of everything it was assembled from. An organization that cannot trace that lineage cannot answer a regulator's first question.
Authorization is the good the CIA triad had no reason to define, because a database does not decide to do anything, whereas an agent does. The relevant question becomes whether it held the standing for the specific action it took. That is precisely the good that went missing when a benchmark model wandered out of a sandbox and into a production system it had no authority to touch.
Auditability is availability and integrity stretched across time and delegation: the capacity to reconstruct, and prove to a board or a regulator, exactly what a chain of agents did and on whose authority, long after the actions completed. Its absence is the difference between reconstructing an agent's behavior as it unfolds and connecting it to its source a week after the fact, which is roughly the lag between the Hugging Face breach and OpenAI tracing it to its own evaluation.
The mapping holds cleanly enough to state as a table:
| Classical computing | Agentic AI |
|---|---|
| Confidentiality | Provenance |
| Integrity | Authorization |
| Availability | Auditability |
Or more simply: information goods become action goods once a system stops merely holding data and starts acting on it.
None of this is speculative reframing. NIST, whose Risk Management Framework already counts accountability, transparency, and provenance among the properties of trustworthy AI, acknowledged in early 2026 that autonomous agents introduce risks its existing categories do not capture, and launched a dedicated agent-standards initiative in response. ISO/IEC 42001, the international management-system standard for AI, makes a parallel demand: an organization has to demonstrate, through documentation and audit, that it actually built governance into how it manages AI rather than asserting it after the fact. The security community's own agentic profiles make the same move, treating delegated authority as a first-class object that has to be inventoried, scoped, and logged rather than assumed. The vocabulary differs from Augustine's, but the structure is identical. These are goods a system possesses only when someone deliberately builds them in, and each is defined by what its absence quietly permits.
Enterprise architecture supplies the slower-moving version of the same story. A poorly architected estate is rarely poorly architected because someone actively built something harmful into it. More often nobody built the thing that should have been there: a clear ownership map, a documented interface contract, a redundancy plan for the one system everything else quietly depends on. The absence sits unnoticed for years, the way rust sits under paint, until a change somewhere else exposes it. Technical debt is the honest name for exactly this condition, an accumulated privation of the architectural discipline a system needed at the moment it was built, now compounding interest on every sprint that follows.
Restoration, not suppression
None of this makes governance a matter of philosophy for its own sake. It makes governance legible in a way that regulation-first language rarely achieves, because it tells an organization what to look for rather than only what to avoid. A compliance checklist tells you which boxes are unchecked. A privation model tells you which good is missing from the system in front of you, and a missing good, unlike an abstract risk category, is something a team can actually go build.
Enterprise AI does not require less intelligence. It requires more governance. Augustine recognized sixteen centuries ago that lasting failures arise not from the presence of evil but from the absence of the good that ought to be there. Modern AI governance may simply have rediscovered the same principle, in its own vocabulary, for its own century. The ship stays a ship. The rust gets scraped off, and the hull gets sealed again.
Further Reading
- Augustine, Confessions, Book VII (trans. Maria Boulding, New City Press, 1997); City of God, Book XI–XII.
- Kate Conger, "OpenAI Says Its A.I. Models Went Rogue and Attacked a Digital Library," The New York Times, 21 July 2026.
- Deirdre K. Mulligan and Kenneth A. Bamberger, "Saving Governance-by-Design," 106 California Law Review 697 (2018).
- NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 2023, and the AI Agent Standards Initiative, 2026.
- ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system.
- Cloud Security Alliance, NIST AI RMF Agentic Profile