What Happens When Your Most Important Capability Belongs to Someone Else?

The current debate surrounding Anthropic’s Fable 5 and Mythos 5 models has been framed largely as a dispute about export controls, national security, and advanced AI capability. The controversy began after Anthropic announced that a U.S. government directive required the company to restrict access to the models for foreign nationals, prompting the suspension of the systems while discussions continued about the underlying security concerns and policy rationale.

Regardless of where one stands on the merits of the decision, the episode has sparked an important conversation about who should control access to increasingly powerful AI systems and under what circumstances. Yet focusing exclusively on whether the restriction was justified risks obscuring a more important lesson.

What happens when critical organizational capabilities become dependent on systems that can be restricted, modified, withdrawn, or governed by actors outside the organization?

That question sits beneath the Anthropic controversy, but it extends far beyond Anthropic. It is increasingly relevant to every organization that relies on cloud providers, software platforms, supply chains, managed services, and artificial intelligence. As organizations embed AI into critical workflows, governance is becoming less about oversight and more about operational capability.

The distinction matters because many organizations still approach governance as a collection of policies, review boards, and compliance requirements. AI is exposing a broader reality.

The issue is not whether a model is capable. The issue is whether the organization is capable of managing the dependencies, authorities, and risks that emerge when advanced technologies become part of how work gets done.

It would be easy for commercial organizations to view the Anthropic dispute as a policy issue that affects AI companies rather than enterprise users. That would be a mistake.

When governments restrict access to advanced capabilities, when providers alter model behavior to comply with regulations, or when geopolitical tensions reshape technology markets, organizations that have embedded those capabilities into critical workflows experience the consequences immediately. A model that identifies vulnerabilities, accelerates software development, supports research, or enables security operations does not become less important simply because the disruption originates outside the enterprise.

Once a capability becomes integrated into the operating model, external decisions become internal operational challenges. The Anthropic debate is therefore not simply about export controls. It is a reminder that organizations increasingly depend on capabilities they do not fully control.

This is not a new phenomenon. Modern organizations routinely rely on infrastructure, suppliers, and service providers that sit beyond their direct authority. What is changing is the nature of the dependency. AI systems are no longer limited to storing information or facilitating communication. They are increasingly involved in analysis, decision support, workflow orchestration, software development, cybersecurity operations, and other activities that directly influence how organizations execute their missions.

As a result, questions that once appeared technical are becoming governance questions.

Governance is often treated as something separate from operations. It is associated with policies, approvals, risk reviews, compliance exercises, and audit functions. Those mechanisms matter, but they are not governance itself.

Organizations do not succeed because they have policies. They succeed because they possess capabilities.

Financial capability allows organizations to allocate resources effectively. Product capability enables them to transform ideas into offerings customers value. Cybersecurity capability allows them to manage risk while sustaining operations. Talent capability enables them to attract, develop, and retain people who can execute the mission.

Governance belongs in the same category.

Governance is the organizational capability that maintains alignment, accountability, visibility, and control as conditions change.

It allows leaders to understand where authority has been delegated, how decisions are being made, what dependencies exist, how outcomes are monitored, and when intervention is required. Strong governance capabilities enable organizations to adapt without losing coherence, while weak governance capabilities often remain invisible until a disruption exposes them.

This distinction helps explain why many organizations struggle with AI adoption despite investing heavily in technology. The challenge is rarely access to tools. More often, it is the absence of the organizational capabilities needed to manage those tools as they become embedded in core operations.

Most organizations can identify their technology stack, their major vendors, and their key business processes. Far fewer can identify the capabilities those systems support.

A software development organization may increasingly depend on coding assistants and AI-generated code review. A security team may depend on AI-assisted detection, triage, and analysis. Legal teams may rely on AI systems to accelerate contract review, while customer service organizations may depend on conversational AI to scale support and manage growing volumes of customer interactions.

The important question is not which tools are being used. The more important question is which organizational capabilities would degrade if those tools disappeared tomorrow.

That distinction matters because organizations often track vendors more effectively than they track dependencies. They know who they are paying, but they do not always know which capabilities have become operationally essential. As AI adoption accelerates, this visibility gap becomes increasingly significant because capabilities that once depended entirely on people are beginning to depend on a combination of people, systems, models, and automated workflows.

Most organizations spend significant time inventorying technologies, vendors, and risks. Far fewer inventory capabilities. Yet capabilities are what ultimately determine whether the organization can execute its mission. The question leaders should be asking is not simply which technologies they rely upon. It is which capabilities they cannot afford to lose.

History provides several examples of technologies that began as useful tools before becoming critical infrastructure.

A decade ago, many organizations viewed cloud providers as optional technology vendors. Today, Amazon Web Services, Microsoft Azure, and Google Cloud underpin enormous portions of the global economy. Few leaders would describe those platforms as optional because they have become foundational components of modern operations.

The July 2024 CrowdStrike outage demonstrated how quickly dependencies become visible when something goes wrong. A faulty software update affected millions of Windows devices and disrupted airlines, hospitals, financial institutions, government agencies, and businesses around the world. While the incident was widely discussed as a cybersecurity event, it was equally a lesson in dependency concentration and operational resilience. Organizations discovered that a capability they viewed as routine had become deeply embedded in their ability to operate.

The SolarWinds compromise revealed a similar dynamic from a different angle. The attack exposed the extent to which organizations relied on software supply chains they neither owned nor fully understood. What initially appeared to be a cybersecurity incident ultimately became a broader lesson about visibility, dependency management, and organizational resilience.

The Anthropic situation raises a similar question for AI.

If organizations rebuild critical workflows around advanced AI capabilities, what happens when those capabilities change, become restricted, or disappear? More importantly, how quickly can the organization adapt without compromising performance, accountability, or mission execution?

The answer depends less on the technology itself than on the organization’s governance capability.

Much of the conversation around AI governance focuses on policies, vendor assessments, acceptable use guidelines, and compliance controls. Those elements are necessary, but they address only part of the challenge.

Organizations are not merely purchasing software. They are delegating authority.

Sometimes that delegation is narrow. An AI system summarizes information, drafts content, identifies patterns, or recommends options. Increasingly, however, organizations are delegating more consequential responsibilities. AI systems may prioritize security alerts, recommend remediation actions, generate production code, review contracts, evaluate transactions, coordinate workflows, or interact directly with customers.

As AI systems become more capable, organizations will continue expanding the scope of delegated authority. This creates a governance challenge that differs fundamentally from traditional technology adoption because the central question is no longer whether employees are allowed to use a tool. The central question is who or what is exercising authority within the organization, under what conditions, with what constraints, and with what mechanisms for accountability and intervention.

Delegating authority to an AI system also means accepting that the capability itself may evolve over time. Model updates, policy changes, new safety mechanisms, altered behaviors, and shifting regulatory requirements can all influence how a system performs long after an organization has integrated it into critical workflows. The challenge is not simply trusting today’s outputs. It is understanding how governance will function when tomorrow’s system behaves differently.

Operational governance exists to answer those questions. It includes understanding where authority has been delegated, maintaining visibility into dependencies, monitoring outcomes, preserving accountability, and ensuring continuity when systems, vendors, or assumptions change. The specific implementation will vary across organizations, but the objective remains consistent: preserving control while benefiting from increasingly autonomous capabilities.

Governance is often portrayed as a mechanism for restriction. In practice, effective governance serves a different purpose.

It preserves agency.

Modern organizations will always depend on capabilities they do not fully own. They depend on suppliers, infrastructure providers, software vendors, financial institutions, cloud platforms, and strategic partners. These dependencies are not inherently problematic. The challenge emerges when those dependencies become invisible.

When leaders cannot identify which capabilities are operationally essential, they lose the ability to make informed decisions about resilience, redundancy, investment, and risk. They may continue operating efficiently for a period of time, but they are increasingly vulnerable to disruptions they do not fully understand.

This is where the Anthropic debate becomes particularly valuable. Regardless of where one stands on the underlying policy dispute, the episode demonstrates how quickly access to a critical capability can become subject to forces outside an organization’s control. Regulatory actions, geopolitical developments, provider decisions, pricing changes, security concerns, and technical updates can all alter the conditions under which capabilities remain available.

Organizations cannot eliminate that uncertainty. They can, however, build the governance capability required to manage it.

Organizations do not need a perfect AI governance program to begin strengthening their governance capability. They do, however, need a clearer understanding of where AI has already become embedded in the business and what dependencies are emerging as a result.

A useful starting point is to conduct a capability review rather than a technology review.

Begin by identifying where AI has become operationally necessary rather than merely useful. Many organizations can list the AI tools they have approved, but far fewer can identify the business functions that would slow down, degrade, or stop functioning if those tools disappeared tomorrow.

Next, map where authority has been delegated. Which systems are influencing decisions, generating recommendations, prioritizing work, interacting with customers, writing code, approving actions, or triggering downstream processes? The objective is not to eliminate delegation. It is to understand where it exists and whether the organization has sufficient visibility into how those decisions are being made.

From there, assess concentration risk. Which capabilities depend on a single provider, model, integration, or workflow? Organizations routinely evaluate supplier concentration in other areas of the business because they understand the risks associated with overreliance. AI dependencies deserve the same level of scrutiny.

Organizations should also examine resilience. If a critical capability became unavailable because of a provider outage, pricing change, regulatory action, security concern, or model restriction, what would happen? Is there a fallback process, an alternative provider, or a human-led workflow capable of maintaining continuity until the disruption is resolved?

Finally, review accountability. When AI systems influence decisions or actions, can the organization explain what happened, identify who remains responsible for the outcome, and intervene when necessary?

These questions are not bureaucratic exercises. They help organizations understand whether they are building durable capabilities or accumulating hidden dependencies. More importantly, they reveal whether governance exists as an operational capability or merely as a collection of policies and approvals.

The Anthropic dispute will eventually be resolved, replaced, or forgotten. Another model will emerge. Another provider will face scrutiny. Another capability shock will dominate the headlines.

The deeper lesson will remain.

Organizations are increasingly embedding critical capabilities into systems they do not fully control. As AI becomes more capable, organizations will delegate more authority to it. As they delegate more authority, those systems will become more deeply embedded in how work gets done.

At that point, governance is no longer about approving technology. It is about preserving organizational agency.

The organizations that succeed in the next decade will not necessarily be those with access to the most advanced technologies. They will be those that understand the capabilities those technologies support, the dependencies those capabilities create, and the mechanisms required to remain aligned, accountable, and resilient when conditions change.

In an era of increasingly autonomous systems, resilience becomes more than a business continuity objective. It becomes a governance objective. Organizations that understand this will be able to adopt AI aggressively without surrendering control. Those that do not may discover that

Capability without resilience is simply dependency by another name.

What capability does your organization rely on most, and what would happen if you lost it tomorrow?

Leave a comment