The first draft of a board memo took three days to prepare. By the time it reached the executive team, almost no one still touched what it was built on. Legal reviewed the redlined clauses instead of rereading the full contract, because the AI had already flagged what changed. Finance signed off on the executive summary instead of working through the spreadsheet, because the numbers reconciled. A week later, the board approved the recommendation after discussing a deck that had itself been generated from earlier AI summaries and a round of human edits.
Nothing in that sequence was unreasonable. Legal’s shortcut made sense on its own. So did finance’s, and so did the deck. Each person made a practical call about where limited time was best spent, and no one consciously decided that verification no longer mattered. Yet by the time the recommendation reached the board, almost no one in the chain had actually touched the evidence underneath it, only the version of it that a previous person’s AI-assisted shortcut had already produced.
Ask anyone in that chain whether independent review still matters, and they’ll say yes without hesitating. Few, if any, of them could say when they last opened a full source document.
Every organization has some version of this: a process everyone agrees is slower than it needs to be. Maybe it’s a second approval on a vendor contract. Maybe it’s a full read-through of AI-generated code before it merges. Maybe it’s reading a report instead of its executive summary. Someone eventually asks the reasonable question: do we really need to do all of this, every time? Usually the honest answer is no. So the process gets streamlined. An approval step disappears because it rarely changes the outcome. A second review becomes optional. The work moves faster, deadlines get easier to hit, and nobody can point to an obvious downside. The organization often celebrates the change as an efficiency gain, and most of the time, it is one.
The trouble is that efficiency rarely removes work; it moves it elsewhere. What actually changes is where people’s attention goes, what they keep practicing, and which decisions still receive anyone’s deliberate scrutiny. Those are governance decisions, whether or not anyone in the room would call them that. Organizational controls usually bring to mind policies, approval workflows, and audit logs, but every one of those controls depends on something scarcer and less visible: a person deciding that something deserves a closer look. Every organization has a finite supply of that attention, and it cannot be everywhere at once.
Every governance system is, underneath the policies and the workflows, an attention-allocation system.
It exists to decide where the organization’s scarce attention gets concentrated. Organizations have always managed scarce resources deliberately: money gets budgeted, time gets scheduled, talent gets assigned. Attention has rarely been managed that explicitly because, until recently, much of it was inseparable from the work itself. Reviewing the contract required reading it. Checking the numbers required working through them. What AI changes is the economics of that arrangement. It makes certain forms of attention feel increasingly unnecessary, so attention drains away from them, not because anyone decided it should, but because nobody had to decide anything at all.
Every decision to remove friction is also, whether anyone frames it this way or not, a decision about where the organization’s attention will no longer be invested.
That shift is one of the least appreciated consequences of AI, in part because it looks nothing like the last few decades of workplace technology. Word processors replaced typewriters. Spreadsheets replaced ledger books. Search replaced filing cabinets. In every case, the work got faster, but the basic expectation that a person would still review the output, interpret it, and own the result stayed intact. Generative AI changes something more fundamental. It doesn’t just help people finish tasks faster. It changes the incentives around which tasks still feel worth a person’s time at all. Convenience never makes that call by itself. Organizations do, one small reasonable choice at a time, because attention follows incentives, and AI keeps making the shortcut the visibly rational option while the cost of taking it stays invisible. Meeting notes become summaries, and summaries become action items nobody traces back to the meeting. Research becomes synthesis, and synthesis becomes a recommendation nobody re-derives. Each handoff in that chain replaces a form of engagement with a form of consumption: the person still receives the information, but no longer does the work that would have surfaced what was wrong with it. At every step, the organization recovers real time. What it rarely notices is what left the building along with it.
Software development shows this clearly, and there’s now real research behind the intuition. A 2023 Stanford study found that developers using an AI coding assistant wrote measurably less secure code than developers working without one, and, in the study’s own words, were simultaneously more confident that their code was secure. The convenience wasn’t just speed. It changed what developers believed still required their attention, at exactly the moment it mattered most. That doesn’t mean AI coding assistants inevitably reduce quality; the broader research is still mixed. What the study captures is the behavioral shift underneath: the tools change how developers decide what still deserves review. A separate industry analysis of over 200 million changed lines of code found the pattern showing up at scale: between 2021 and 2024, refactored and reused code fell by more than half while copy-pasted code rose, with duplicated code blocks increasing eightfold in 2024 alone, according to GitClear’s research. Code that used to get rewritten and understood now gets accepted and moved on from.
The market has started responding to exactly this gap, which complicates the picture in a useful way. Cursor's Bugbot now reviews millions of pull requests a month for bugs and security flaws before they merge, and Corridor, a security startup founded by a former CISA secure-by-design lead, exists specifically to watch over AI-generated code as it's written. These tools matter, because attention doesn't have to come from a human to count. A machine reviewing a machine is still a check, and sometimes a more consistent one than a tired reviewer skimming a large diff. But delegated attention is still an allocation decision. An organization that adopts an AI reviewer because it arrived with the toolchain has not made that decision; it has inherited a default. Somewhere in the workflow, a person still has to own what the machines are checking for, where machine attention is sufficient, and where human attention stays mandatory. Without that anchor, machines checking machines is not a system of checks and balances. It's an attention budget nobody is holding.
Sometimes the missing review shows up all at once instead of accumulating quietly. In July 2025, an entrepreneur testing Replit’s AI coding agent had explicitly told it not to touch the production database during an active code freeze, a control that existed for exactly this reason. The agent ran unauthorized commands anyway, deleting the live database, then, by his account, misrepresented whether the damage could be undone, as Fortune reported and The Register confirmed. The whole point of the workflow he was using was convenience: skip the usual engineering handoffs, let the agent move fast. The code freeze was the control meant to catch exactly this kind of mistake. It existed on paper. It just wasn’t enforced anywhere a person, or the agent, actually had to encounter it before acting.
Healthcare shows a quieter version of the same shift. AI scribes that listen to patient visits and draft clinical notes are measurably reducing physicians’ documentation burden, which is a genuine win for clinicians buried in paperwork. But the same efficiency changes how closely a physician reads the note afterward. Research on these tools has documented real failure modes, misattributed statements, medications logged incorrectly, even physical exam findings that were never actually performed showing up as if they were, occurring at rates researchers put around one to three percent, which sounds small until it’s multiplied across millions of patient encounters. A busy clinician who has come to trust the tool is exactly the clinician least likely to spend attention on the one note that got it wrong.
There's a complication that makes the attention question harder than simply keeping the old checks. Some evidence suggests AI assistants genuinely reduce certain classes of common human error, one large-scale analysis found the majority of AI-generated code free of known vulnerability patterns. But the errors that remain are differently shaped. Research comparing human and AI code finds AI's failures cluster in subtly incorrect security logic and missing defensive programming, and studies of vibe-coded applications show it performs worst at the authorization and business logic humans catch by reasoning about intent. Some failure modes have no human precedent at all: models hallucinate plausible package names so consistently that attackers have begun registering malicious packages under names AI is likely to invent. Human review evolved to catch human mistakes. An organization can keep every review step it has ever had and still be looking in the wrong places, because its attention is calibrated to an error distribution the technology just changed.
None of this argues against AI. It’s the argument for governance that understands how efficiency changes behavior, because convenience rarely eliminates a control outright. It changes the justification for keeping it. A second review starts feeling unnecessary because the AI has been right so often. Reading the source document feels wasteful because the summary is usually accurate. Independent verification gets harder to defend because it slows everyone else down. Each of those decisions looks entirely rational in isolation. Collectively, they redefine what the organization still pays attention to, one reasonable choice at a time, which is exactly why this problem is so easy to miss and so hard to reverse: nobody ever has to defend the decision, because no single decision was ever really made.
This is the same pattern the last two pieces in this series have been circling from different directions. Confidence propagates because people inherit conclusions they never reexamine. Familiarity earns exemption because repeated success makes scrutiny feel unnecessary. Convenience finishes the job: it makes verification difficult to justify even in the moment everyone would still say, if asked directly, that it matters. The result isn’t weaker governance so much as invisible governance. The organization still believes it values oversight. It has simply stopped noticing where its attention actually goes, a version of the gap I’ve called quiet consent before: nobody objects, so the decision gets made by default.
That’s why the more useful question for a leadership team isn’t where AI can save time. It’s which human capabilities still create value precisely because they slow decisions down. Independent review, critical questioning, reading past the summary, testing an assumption, actively seeking evidence that would contradict the conclusion everyone already likes, these activities often feel inefficient because interrupting momentum is the entire point of doing them. Organizations already accept this logic everywhere except AI. Nobody argues multifactor authentication should go away because typing a code takes an extra few seconds. Nobody eliminates separation of duties because two approvals cost more effort than one. Those frictions survive because the consequences of removing them are worse than the inconvenience of keeping them, which is exactly the discipline my earlier argument about turning insight into constraints was making: knowing a risk exists isn’t the same as building something that actually stops it. AI governance needs the same discipline applied on purpose, rather than by accident, which means the real question isn’t where friction can be removed. It’s where friction is still creating value.
A practical way to hold onto that discipline is to treat attention the way finance treats money: as a budget. An attention budget starts with an honest accounting of where the organization’s scrutiny actually goes today, as opposed to where its policies say it goes, and whether anyone decided that allocation on purpose. From there, three questions are worth asking every time AI changes how a workflow runs. Which decisions become significantly harder to reverse once they’re made? Where would a mistake carry the greatest operational, legal, financial, or reputational cost? And which human capabilities is the organization unintentionally letting disappear, simply because convenience has made them optional? The answers mark the places that deserve deliberate friction: the intentional preservation of human attention where the consequences of being wrong outweigh the benefits of moving faster. Deliberate friction is what separates an organization that chose its attention budget from one that let convenience choose it instead.
If you're a manager, this is not one more responsibility competing for your time. It is quickly becoming one of your most important jobs. AI is removing work from some parts of your team's day while introducing new forms of judgment into others, and deciding where your people should continue to review, question, verify, and intervene has stopped being an operational detail. It is the work of management itself. The organizations that benefit most from AI won't be the ones that eliminate the most human attention. They'll be the ones that invest it where it creates the greatest value.
The stakes here run deeper than any single workflow, because attention is where organizations exercise judgment. And organizations rarely notice attention moving while it moves. They notice afterward, when verification has quietly become uncommon, or when a failure reveals that nobody was looking where it mattered most. Where organizations stop investing attention, they eventually stop exercising judgment.
Convenience is one of AI’s genuine strengths. It’s also one of its quietest governance problems. Organizations don’t lose control because they stop caring about it. They lose it because convenience keeps quietly reallocating their attention budget, one reasonable shortcut at a time, and nobody ever has to sign off on the change.
As I was finishing The Insider You Built, I found myself returning to the same realization from different directions. Governing AI agents isn’t only about managing what autonomous systems can do. It’s also about preserving the human capabilities organizations still depend on as those systems become more capable. That broader question is what this series is exploring.
2026 Series | Q3: When Systems Shape Humans
This article is part of a third-quarter series exploring how increasingly capable AI systems reshape human judgment, organizational behavior, and institutional capability. As organizations delegate more work to AI, the defining challenge is no longer simply what the technology can do, but how it changes the people and systems that rely on it.
Look for the When Systems Shape Humans tag.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.