The Ontology Imperative - Building Trustworthy Agentic AI: The Mandate

3c – When the Container Fails: Vertical Integration, Liability, and the CDO Mandate in Practice

Frédéric Verhelst — Wed, 27 May 2026 06:10:45 GMT

Reading time: ~25 minutes

Where this article picks up

Article 3b established the architecture. Eleven layers, four zones, two structural gates, the minimum viable ontology, and the four sovereignties that determine whether the CDO mandate is real or advisory. It closed with a claim and a procurement test: any one sovereignty captured by the vendor returns the mandate to the vendor regardless of the organisational chart. The mandate cannot be bought. It must be held.

The fourth, jurisdictional sovereignty, was added in June 2026; the postscript to Article 3b records why.

This article moves from the framework to the conditions under which it operates. The Stack has a silent premise about how the container is built and who builds it. The premise fails in two distinct ways the framework alone does not address: vertical integration where one actor controls every sovereignty layer at once, and the foundation model layer where constraints sit inside model weights no external party can audit. The framework still holds; the question becomes where the CDO’s mandate ends and external governance must begin.

The argument then turns to operations. The discipline the agentic stack needs already exists in mature regulatory regimes and has for decades. The insurance market is pricing the gap publicly in 2026. Boards can operate around the attribution question without waiting for it to close. The delegation model scales across three modes from governed infrastructure to fully autonomous operation. The C-suite reporting line is not a status question; it is a structural requirement, and the RACI objection dissolves under examination. The series closes with six questions the board can ask today to locate where the framework is missing in its own organisation.

When the silent premise fails

The Stack presupposes a silent premise: the container-author and the container-operator are separate entities. The CDO authors the ontology, defines the contracts, writes the SHACL shapes, and wires the provenance. A different entity executes agents within that container. The container is independent of the agent. Governance holds because the enforcement layer is operated by someone different from the entity whose behaviour it constrains.

Vertical integration collapses that separation. The Tesla case is the cleanest demonstration. Tesla holds all four sovereignties. Semantic sovereignty: a proprietary operating system from vehicle control to user interface. Enforcement sovereignty: a proprietary inference chip running in the fleet today, with successors in development. Execution sovereignty: fleet data flowing into Dojo training and back out to the fleet via over-the-air updates. Jurisdictional sovereignty: Tesla owns the platform and the update channel end to end, so the owner has no portability and no insulation from a directive issued to Tesla in its home jurisdiction. No external control point between design and delivery. When the same actor writes the constraints, builds the chip, operates the fabric, and controls the update channel, the independent container is a regulatory fiction.

The mirror failure mode is the opposite case. Tesla shows what happens when one actor controls everything; the more common pattern across industry is the opposite: vehicles, factories, and platforms that depend on the data flowing across hundreds of supplier boundaries where no single actor has the authority to impose semantic structure. The data arrives flat because no one upstream agreed on what the fields mean. The connectivity layer is built; the meaning layer is not. The container is never authored because no one has the authority to author it. Same governance gap as Tesla, opposite cause. The Stack is the answer to both. In the integrated case, the Stack defines where the CDO mandate ends and external governance must begin. In the heterogeneous case, the Stack defines what the CDO must build inside the organisation because no one upstream will build it for them.

The same pattern operates at the foundation model layer, and it touches every enterprise that deploys LLMs. Training data curation and system prompts fix what the model knows and does not know. Constraints sit inside the model weights, auditable only by the entity that trained them. Inference runs on proprietary infrastructure with no external control point. The EU AI Act Article 26 addresses a separation that vertical integration dissolves.

In May 2026, the same vertical integration extended into the implementation layer. Anthropic announced a $1.5 billion joint venture with Blackstone, Hellman & Friedman, and Goldman Sachs, embedding Anthropic engineers directly inside mid-sized companies to deploy Claude into core operations. OpenAI announced a parallel venture the same day, The Development Company, at $4 billion with backers including TPG and Bain Capital. The model provider, the engineering capacity, and the deployment relationship now sit inside one counterparty. The pitch undercuts traditional systems integrators on speed. The procurement reality is that semantic, enforcement, execution, and jurisdictional sovereignty compress into a single vendor. When the firm implementing your agents also provides the model that runs them, embedding more engineers does not close the governance gap. Without a semantic layer the organisation owns, agents operate against meaning the organisation cannot define, constrain, or audit. The contract is borrowed at every layer.

This matters for the CDO mandate in a specific way. The Stack as written is the correct framework for organisations that sit downstream of vertically integrated providers, which is most of them. The enterprise’s enforcement chain at Layers 3 through 7 must still sit on open standards the enterprise controls. But the layer beneath the enterprise stack cannot always be addressed through procurement alone. Where vertical integration holds, the structural gates shift upstream to regulators and sideways to mandated third-party auditors. The argument that systemic operators cannot self-regulate at scale, codified in regulatory frameworks like the EU’s NIS2 Directive and Germany’s KRITIS Umbrella Law, applies to foundation model providers with the same force. That is not in the CDO’s remit. Recognising where the mandate ends and where external governance must begin is part of the mandate itself.

The discipline already exists

A second argument worth naming plainly. The state never caught the fast driver by chasing faster. German road traffic law combines two distinct mechanisms. Under § 7 StVG, the vehicle keeper carries strict liability for damage caused in the operation of the vehicle, independently of who was driving. That is the ex ante allocation. Under § 31a StVZO, where the driver responsible for an offence cannot be identified, the authority can order the keeper to maintain a driver logbook recording every trip, every driver, every date. That is the ex post reconstruction. Common-law jurisdictions reach structurally similar outcomes through vicarious liability and the doctrine of non-delegable duty. The agentic stack needs both: organisational liability ex ante, machine-readable provenance ex post. A functional analogy, not a direct legal mapping. These are not retrofitted controls. They are the grammar of a mature regulatory regime.

ISO 9001 carries the same grammar inside any organisation that runs a certified quality management system. Clause 7.5 requires documented information. Process responsibility sits with named roles, not with individuals, so the accountability survives personnel changes. CAPA, corrective and preventive action, converts incidents into constraint updates the system honours going forward. Root-cause analysis is the method. Traceability is the evidence.

The same compliance pattern, continuous organisational duties, documented measures, named responsibilities, periodic proof-of-compliance, is already in production at critical-infrastructure scale through Germany's KRITIS regime, EU NIS2, US CIRCIA, and equivalent frameworks in the UK and Australia. The Stack is the agentic extension of an existing regulatory grammar, not a new discipline.

The agentic stack needs the same grammar. A keeper’s duty: the organisation is accountable for what its agents do, independent of the agent’s reasoning process. A logbook: machine-readable provenance that reconstructs which contract, which constraint, and which authority structure produced the action. A sanction path: CAPA converted to SHACL update converted to versioned constraint enforcement, with the provenance layer recording the version in force at the time of each decision.

The discipline is there. Qualitätsmanagement has operated on this grammar for three decades. Product liability law for longer. What is missing is the connection between that discipline and the agentic stack. OCEL 2.0 makes event logs technically feasible. EU AI Act Article 14 asks for oversight but does not mandate the logbook; Article 26 places deployer obligations on the operator (operational compliance, log retention, response to substantial risks) but stops short of specifying the machine-readable evidence those obligations require. Directive (EU) 2024/2853, the 2024 revision of the Product Liability Directive, extends EU product liability to AI systems, with Member States required to transpose by December 2026. At mid-2026, evidentiary and attribution mechanisms remain undefined at national level. Boards are required to make architectural accountability decisions before the underlying evidentiary standards stabilise in national law. § 93 AktG in Germany, the UK Companies Act 2006 section 174 duty of care, and the US Caremark standard as materially strengthened by Marchand v Barnhill (Delaware 2019) and In re McDonald's (Delaware 2023), where mission-critical risks attract a heightened oversight standard and the absence of demonstrable monitoring may itself constitute evidence of fiduciary failure, each address the board as keeper. All leave unspecified what the keeper's duty entails for agents whose decision path is not reconstructable.

In common-law jurisdictions, the closest analogy is the doctrine of non-delegable duty: certain core obligations stay with the corporate entity and its board regardless of who performs the work. Hiring a vendor does not transfer the duty. Hiring a CDO does not transfer the duty. The doctrine has not yet been definitively applied to autonomous agents, but the structural logic carries: the board is the keeper, and the CDO is the function through which the keeper discharges its duty operationally.

The CDO mandate, correctly scoped, is the institutional bridge between that existing discipline and the capability gap in the agentic stack. SHACL is the machine-readable instance of documented information for agents. PROV-O is the logbook. Preventive controls are the CAPA loop running in real time. What QM solved for physical products and human-operated processes, the CDO solves for agent decisions. Not a new discipline. An extension of an old one, into a layer that did not exist when ISO 9001 was drafted.

The accountability primitives invoked here are private-sector. The public-sector analogue, where answerability runs through statutory and political channels rather than fiduciary ones, is a parallel argument worth its own treatment.

The market has already priced the silent premise

The grammar of ISO 9001 provides the discipline. The market has begun providing the urgency. The architecture of corporate governance has rested for decades on three defensive lines: operational management, independent risk and compliance, independent internal audit. All three operate at human tempo. Agentic AI exposes the absence of a fourth line operating at machine tempo to catch what passes the first three before consequences compound.

Three signals from a single month compress into one diagnosis. The three systems that would normally catch what the others miss are all saying the same thing, and they are all saying it now.

Technology. On April 1, 2026, Adversa AI disclosed that Claude Code’s deny rules silently stopped working when a command chain exceeded fifty subcommands. A developer who configured “never run this” would see the rule enforced at command 50 and bypassed at command 51. The root cause, documented in Anthropic’s internal ticket CC-643, was a performance trade-off: per-subcommand security analysis at higher counts was freezing the UI, so engineers capped analysis at fifty and fell back to a generic prompt above the cap. A newer parser that handled this correctly existed in the codebase but had not been shipped to public builds. Patched in v2.1.90 on April 6. Adversa framed the disclosure in the structural register that matters here: security enforcement and product delivery compete for the same resource. Every safety check costs compute, every permission validation adds latency, and when the cost crosses a threshold nobody had thought to expose, the cost is paid by skipping the check. That is not a bug to be patched once. It is the structural property of probabilistic governance operated at agentic speed.

Frontier lab. On April 21 and 22, 2026, Anthropic confirmed investigating unauthorised access to Claude Mythos Preview, a frontier cybersecurity model released two weeks earlier under Project Glasswing to twelve named launch partners (AWS, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks) and around forty additional critical-infrastructure organisations. Access came through a third-party vendor environment. A model held back as too dangerous for general release, given to trusted partners for defensive work, leaked through a partner within fourteen days. The containment strategy that justified restricted release failed at the vendor boundary.

Insurance market. In the same month, QBE and Beazley introduced sub-limits capping AI-related payouts at around ten percent of total policy limits. QBE’s LLMjacking sub-limit takes a £3.8 million cyber policy down to £188,000 for AI-specific losses. AIG, WR Berkley, and Great American filed with US regulators to exclude AI-related losses from corporate insurance entirely, and ISO introduced AI-exclusion endorsements for CGL policies. Kevin Kalinich at Aon named the underwriting limit publicly: the industry can absorb a single $400 to $500 million loss from a misfiring agent; it cannot absorb correlated losses from an upstream model or vendor failure producing a thousand simultaneous claims.

That is not an insurance-market story. That is the reinsurance-broker version of what the European Systemic Risk Board documented from above in December 2025: model uniformity, procyclicality, correlated failure across organisations running similar foundation models on shared data. This series named the same property earlier from the systemic-stability side. The ESRB saw a financial-stability problem. The reinsurance market sees an insurability problem. Same risk property. Two institutions. One diagnosis.

The move from uncalculable to uninsurable runs through a two-condition test the insurance market applies to every risk it underwrites. Calculable risks are insurable (fire, theft). Uncertainty is still insurable if the underwriter can model it (new technologies). Sub-limits mark the boundary where risk has become uncalculable but the market still offers reduced coverage. Exclusions mark uninsurability. What makes the difference between an uncalculable risk that returns to insurability and one that does not is whether two conditions can be operationally established. The first is a determinable debtor: a named accountable party against whom a claim can be adjudicated. The second is a calculable damage envelope: a bounded scope of what the agent could have done, against which loss can be quantified. Keeper liability in German road traffic law provides the first condition by structural design: the registered keeper is the determinable debtor regardless of who was driving. The agentic stack provides the second condition: the agent contract bounds scope, the SHACL constraints bound permitted action, the provenance layer reconstructs what happened. Both conditions together are what insurance markets need to underwrite a risk at scale. Either one missing turns the risk uninsurable. The stack is the operational form of what insurability requires.

The time asymmetry closes the argument. Attackers act in minutes. The insurance market retreats before the first large systemic loss. Regulators legislate in years. Underwriters are not slow and they are not theorists. They are the market participants with capital directly at risk in the absence of the enforcement chain. Their repricing is the market admission that no enforceable specification exists against which a claim could be adjudicated at current scale. The market cannot insure what it cannot see the organisation govern.

Boards face two pressures at once. On one side, a genuine capability that competitors are deploying, with FOMO that does not pause for governance maturity. On the other, a verdict from underwriters whose business is pricing risk: this risk cannot be quantified at scale and may not be absorbable. Both pressures are real. Boards that respond only to the FOMO deploy ungoverned and inherit the loss when the system fails. Boards that respond only to the risk avoid deployment and inherit the cost of standing still while competitors move.

Four lines of defence. The first three lines were designed for human tempo: operational management, independent risk and compliance, independent internal audit. The fourth line operates at machine tempo because the agents do. Structural enforcement before action, machine-readable audit after. The CDO mandate, correctly scoped, is the seat that holds the fourth line.

The Stack is the fourth defensive line. Eleven layers, defined ownership at each, two structural gates that the CDO and the Process Owner hold between them. The Ingestion Gate does not open until meaning is formally defined. The Deployment Gate does not open until Layers 1 through 8 are in place and the Process Owner has accepted operational custody. The Stack is what allows the organisation to operate agentic capability without inheriting the uninsurable risk that comes with deploying it ungoverned. The first three lines of defence were designed for human tempo: someone monitors the process, someone independent reviews the rules, someone independent audits both. The fourth line operates at machine tempo because the agents do. The CDO mandate, correctly scoped, is the seat that holds the fourth line: structural enforcement before action, machine-readable audit after, the discipline of the existing three lines extended into a new operational tempo. Not blocking. Not abdicating. Operating the capability with the framework that makes operation safe and insurable.

The academic literature has now named this function. A May 2026 survey from Illinois, Meta, and Stanford, "Code as Agent Harness," identifies executable accountability as an open problem: the function that filters, vetoes, escalates, and records agent actions before they reach the real world. The survey defines the function exhaustively but allocates it nowhere. The Sovereignty Chain answers the bearer question the survey leaves open. Semantic sovereignty supplies the filtering criteria. Enforcement sovereignty fires the veto. The Deployment Gate carries escalation. PROV-O records what was decided and under which framework. The CDO mandate, correctly scoped, is the seat that carries all four functions together. The fourth line is not waiting to be invented. It is waiting to be assigned.

The fourth line operates at machine tempo because the agents do.

Governance can operate around the attribution gap

A philosophical objection attaches itself to the structural argument. Behavioural evidence that an agent is capable, adaptive, or coherent does not license claims that the system is actually reasoning, actually understanding, or actually exercising judgement. Interpretability gives better inspection. It does not give the structural property that would license attribution of understanding. The first governance mistake may not be under-regulation or over-optimism. It may be the inferential slide from what the system does to what the system is.

The objection is correct and it does not refute the structural argument. It sharpens why the structural argument is the right one to make. The CDO mandate does not depend on settling whether agents reason in any meaningful sense. It depends on constraining the action space agents may occupy and recording every transition across that space in provenance the organisation owns. SHACL fires or it does not. PROV-O records or it does not. The governance claim concerns authorised actions and machine-readable constraints, not the system’s inner nature. On that ground it remains structurally admissible whether or not the attribution question is ever settled. The framework constrains; the constraints fire before action; the audit chain reconstructs after. That is the only move that survives the uncertainty about what the system actually is.

The delegation model

The mandate as stated above is the floor. How it scales depends on how much autonomy the organisation gives to its agents. The two structural gates apply at any scale of autonomy; the delegation model scales with it.

Mode 1. Governed Infrastructure. A few agents inside a business unit. The Process Owner inside the BU retains operational accountability for outcomes; the CDO defines standard governance contracts and the Process Owner selects from pre-approved templates. The CDO is accountable for the trustworthiness of the agents. The Process Owner is accountable for the work the agents do under their process.

Mode 2. Delegated Governance. One fully agentic workflow end to end inside a business unit. The Process Owner formally delegates technical governance of the agentic portion to the CDO while retaining operational accountability for outcomes. Formal is the operative word: governance charter, board resolution, or equivalent. The Process Owner keeps strategic accountability, the what and the why, plus operational liability when the agentic workflow runs against expectation. The CDO holds operational governance authority over the automated portion, the how and the guardrails. Contract scope reflects the delegated workflow boundary, not the whole BU.

Mode 3. Operational Accountability. A fully agentic division. The BU is demanned except for the human-above-the-loop function and the escalation team. The Process Owner role at the BU level no longer has a human-staffed organisation to manage; the operational accountability migrates upward. The CDO becomes the operational manager of record for what was previously a human-staffed function. Structural consequence: in a demanned division, the CDO, the Process Owner, and the Division Head are the same role. Not three roles cooperating under a RACI matrix. One role. Any other arrangement reintroduces the accountability gap the mode was designed to close. Operating-model practice is converging on the same answer from a different vocabulary: when the operational layer becomes infrastructure rather than staff, custody concentrates.

The delegation model. As autonomy expands, operational accountability migrates upward. The two structural gates apply at every mode; only the delegation scales. In Mode 3, the CDO, Process Owner, and Division Head are the same role.

The COO role itself is showing early signs of the split. In April 2026, OpenAI’s COO Brad Lightcap moved from coordination duties to a new role leading “special projects” focused on complex deals and investments, reporting directly to CEO Sam Altman; operational duties were redistributed across the leadership team. The signal is not that an AI replaced the COO. The signal is that the COO role is splitting in two: a coordination function that increasingly sits in machine-readable infrastructure and a judgement function that concentrates at the top of the organisation. The Stack is what makes the coordination function legible enough to be managed at scale.

The title in Mode 3 is an organisational design question. The label “CDO” carries the legacy of the compliance and pipeline era. An executive holding operational accountability for autonomous business functions has a mandate the current title does not fully describe. The series does not prescribe a new title. What matters is that the accountability is held, named, and organisationally visible. The title follows the function.

Span of control in Mode 3 is addressed through named governance leads inside each demanned BU, reporting to the CDO rather than to a legacy BU reporting line. The CDO is the executive of record. The BU governance lead is the operational arm. This structure prevents the CDO’s span of control from becoming unmanageable as autonomy expands across multiple BUs simultaneously.

The accountability chain in a fully autonomous BU: the Board approves the operating mandate at Layer 11, the CDO defines agent contracts and guardrails at Layers 5 and 6, agents execute within those contracts at Layer 9, the BU Governance Lead manages the escalation team at Layer 10, and the CDO holds operational accountability for the entire chain in their combined Process Owner / Division Head capacity. No gap. No diffusion. One accountable function.

The three modes describe agent autonomy within a single organisation. The cross-organisation case is structurally different and is where agentic AI is entering the mass market: a user instructs an agent operated by Provider A to act against systems operated by Provider B (book a flight, transfer funds, schedule a procedure). Four candidate custodians come into the question. The user is the principal, Provider A operates the agent, Provider B operates the systems, regulators have a coordination mandate. None of them sits in a structural position to carry the liability cleanly. This is precisely the case the April 2026 insurance verdict prices into sub-limits: correlated cross-organisation failures from a single misbehaving upstream agent are uninsurable at scale because no determinable debtor exists. The Stack as written governs agents inside one organisation’s authority boundary. Cross-organisation use cases require an additional layer the industry has not yet built: a federated trust and provenance framework between providers, with attestable contracts that survive the boundary. Boards whose AI strategy includes consumer-facing cross-organisation agents must recognise that the governance gap there is not yet closable by enterprise design alone.

Why the C-suite reporting line is structural

The three-mode scaling makes C-suite membership a structural requirement rather than a prestige question. Each mode depends on a form of authority that only C-suite standing provides.

I held this mandate at TotalEnergies EP Danmark from 2020 to 2025, with my reporting line shifting from CFO to CTO within the same role. The shift was structural. The CFO line read the function as cost containment with measurable risk reduction. The CTO line read it as capability delivery with measurable operational value. Neither was wrong. The function delivered against both mandates because the data discipline was already mature and the team could be repositioned. The next chapter of the discipline does not sit naturally under either. Agent governance is neither pure cost containment nor pure capability delivery. It is custodianship of how the enterprise acts. That custodianship has its own reporting line: the CEO. The CDO mandate as the article specifies it requires CEO peerage; CFO and CTO partnerships remain essential but they are no longer the parent reporting line.

At Mode 1, the CDO needs C-suite authority to hold the structural gates. The CDO’s standards-setting authority cuts across the Data Owners’ Data Domains (business), the CIO’s substrate (infrastructure), the COO’s operating model, and the Process Owners’ deployments. A CDO reporting below C-suite cannot credibly block a deployment a peer or superior has approved.

At Mode 2, the CDO needs C-suite peerage for formal delegation to be enforceable. A function delegating governance authority to a lower-level function creates the exact accountability gap Mode 2 is designed to close. Delegation requires organisational symmetry between the delegating Process Owner and the receiving CDO.

At Mode 3, the CDO holds division-level executive accountability. Below C-suite, that is not organisationally coherent. A sub-C-suite executive holding operational accountability for an AI-native division would report to an executive who does not hold accountability for the work being performed. The CEO reporting line is the only structure that makes Mode 3 legally and organisationally enforceable.

C-suite peerage is not enough on its own. The CDO mandate is held by the CDO and operationalised through institutional partnerships that the C-suite peerage makes possible. The CFO partnership gives the procurement leverage that turns sovereignty requirements into vendor contract terms. The General Counsel partnership makes vendor sovereignty enforceable when contracts are tested. The Chief Risk Officer partnership co-owns the risk tolerance frameworks the SHACL shapes encode. The Board partnership is what charters the gate authority in writing rather than leaving it to inference. These are conditions of the mandate, not extensions of it. The article is describing what the CDO does. The C-suite enables what the CDO does. And as Article 3a argued through the Boeing parallel, the board’s recognition of architectural expertise as a top-table matter is what makes the C-suite-level mandate possible in the first place.

The RACI objection, and why it dissolves

A standard objection attaches to the CDO-centric ownership model. The constraint and authority-encoding layers sit at the intersection of Legal, CISO, and Chief Risk Officer jurisdictions. Without documented RACI intersections across those domains, the objection runs, the model produces an authority vacuum.

The objection assumes that “the CDO owns the agent” is the structural claim. It is not. The structural claim is that the CDO governs the layers that constrain what the agent may do, and the Process Owner accepts operational custody of the agent under those constraints. The RACI dissolves once these are named as the two separate accountabilities they are.

The principal-level RACI for an agentic deployment, framed at the level a board can meaningfully oversee:

The CDO is the only role that touches every layer. Every other role has a bounded footprint. Accountability migrates up the stack, and the two structural gates fire as paired acts — source attests, destination approves.

Operational roles (Data Steward, Data Custodian, BU Governance Lead, escalation team) execute under the principals above and appear in the operational RACI the CDO Playbook develops, not in this board-level matrix. The Data Owner and the Process Owner are both senior business executives accountable for their respective domains; neither reports to the CDO. The CAIO role, where it appears, is a symptom of a CDO mandate that stopped at pipelines and never expanded to cover the governance and capability zones. When the CDO mandate is correctly scoped, the CAIO role is unnecessary because the work the CAIO does in current practice is the CDO’s work to govern and the Process Owner’s work to operationalise. Splitting governance of meaning from governance of agents recreates the accountability gap in a different place.

JPMorgan Chase provides the working example. Teresa Heitsenrether sits on the firm’s Operating Committee as Chief Data and Analytics Officer, with explicit accountability for AI adoption across the bank, and with business-unit data and analytics functions coordinating through her central organisation. There is no separate CAIO at JPMorgan. The title varies across organisations (CDO, CDAO, Chief Data and AI Officer); the structural answer is the same: one C-suite executive with cross-cutting authority over data, analytics, and AI governance. JPMorgan validates the reporting structure the series prescribes. The two-gate architecture established in Article 3b is the next step the industry has not yet taken publicly.

Under Mode 3, the matrix collapses cleanly because the CDO inherits the Process Owner role for the demanned division. The structural separation between accountability roles survives; what changes is the role-holder count, not the role count.

The CDO that is emerging

The first version of this series argued that the CDO mandate would either expand dramatically or collapse. The expansion path has a clearer shape now than when Article 3a was written.

The CDO who owns pipelines and dashboards gets automated. That conclusion holds. The agents will come for the data-plumbing function first, precisely because it is the most rule-bounded layer in the current CDO mandate. But the CDO who owns meaning, contracts, guardrails, and provenance does not get automated. She becomes more central as autonomy expands, for a reason that was implicit in the mandate argument and has become explicit through the comment threads the series has produced.

Every BU that demans a workflow transfers accountability upward to the CDO. That is the Mode 3 argument. But there is a Mode 0 argument that is just as consequential and that applies whether or not any BU ever reaches Mode 3. The alignment of terms and taxonomies across business units is already a governance problem. Agents amplify it. They do not create it. In a human-operated organisation, a procurement manager in one BU and a supply chain lead in another resolve definition drift through a stakeholder model: they negotiate their way through “approved supplier” meaning slightly different things in the two systems. The cost is coordination overhead and occasional errors, absorbed because humans bridge the gap. When agents act on those definitions at machine speed, the negotiation channel is closed. The stakeholder model cannot hold; an authority model must replace it, with the CDO as the single executive holding the cross-BU definition and the agents executing against it. Ambiguity that was once coordination overhead becomes an error rate.

That cross-BU alignment function is the CDO’s even before the first agent deploys. It was always the CDO’s. The agentic era makes it non-negotiable. The CDO is the only executive with both the authority and the technical apparatus to reconcile definitions across business units that do not report to each other. Data management in the traditional sense, covering quality, availability, and access, remains the CDO’s work. The addition is semantic reconciliation across organisational boundaries. That addition does not go away when agents mature. It gets larger.

The role the series has been describing is therefore not a transitional one. It is the CDO role that will remain after the agentic transition has stabilised. Semantic sovereignty is the enduring contribution. Enforcement sovereignty and execution sovereignty are the structure that makes semantic sovereignty operational. Jurisdictional sovereignty is the ground that keeps all three reachable. And cross-BU alignment of terms and taxonomies is the daily work that keeps the semantic layer current as the organisation changes. What Article 3a named as the twelfth discipline, the discipline that DAMA-DMBoK does not yet cover but that boards and CDOs increasingly recognise is required, Articles 3b and 3c together specify in operational form. Eleven layers, four zones, two gates, four sovereignties, three modes, one mandate. The twelfth discipline has an architecture.

Six questions for the board

The questions below compress the argument into six operational tests. Each one targets a different dimension: authority, ownership, enforcement, verification, accountability, and intervention. A "no" on any single question locates a specific gap in the stack rather than a vague concern.

These questions matter at machine speed. Eight years ago, the average time from a vulnerability being disclosed to the first attempt to exploit it in the wild was 756 days. Today it is hours. Human-speed governance cannot close that gap by getting faster. Only enforcement that fires before execution can.

One. For every AI agent currently in production in your organisation, can you reconstruct, within twenty-four hours, exactly what it was allowed to do, what data it acted on, what rules constrained it, and what authority structure stood behind those rules? If you cannot, your agents are operating without an audit trail that survives the first regulator question, the first insurance claim, or the first board enquiry following a consequential error.

Two. In your organisation today, who has the explicit authority to prevent an agent from going into production when it has not met the governance preconditions? If that authority is not named, not chartered, and not at C-suite level, you have policy without enforcement. The deployment will happen, the gap will close politically rather than structurally, and the accountability for what follows will be diffuse.

Three. When the next regulatory change arrives, and one will, can your organisation update the constraints your agents operate under on your own schedule, or are you waiting for your vendor’s product roadmap to comply with your laws? If you are waiting for the vendor, your governance authority is borrowed from a commercial contract you do not control.

Four. For each of your strategic AI platforms, do you have independent, verifiable evidence that the agents ran as specified, or must you take the provider’s word for it? In safety-critical operations, in financial reporting, in any context where a regulator or insurer will ask for proof, the provider’s word is not evidence. It is a representation. The difference matters when the representation is tested.

Five. When an agent in your organisation causes a consequential error, and statistically one eventually will, who gets named in the regulatory action, the insurance claim, and the litigation that follows? If your answer is “we have not decided yet,” the decision will be made for you, by counsel acting after the fact, and the person named will not be the person you would have chosen. The accountable role must be named before the event, charted in writing, and visible to the board.

Six. Once an agent is in production and acting, who can halt it within seconds, on their own authority, without convening a committee? A gate that blocks deployment is not a hand on the switch during operation. If stopping a live agent needs a meeting, the agent keeps acting through the meeting. The halt must rest with a named principal and fire instantly; only the decision to restart should require a second signature.

A board that cannot answer these six questions exposes itself to the standard-of-care question that arrives after any agent-driven loss: did the board provide reasonable governance against the known risk? The insurance market has already documented that the risk is known.

Closing the series, opening the practice

This article closes The Ontology Imperative as a series. Forty-two LinkedIn posts, nine Substack articles, a library of reference PDFs, one mesh diagram. The argument for the CDO mandate at C-suite, grounded in the semantic infrastructure the C-suite seat must hold, is on the field.

The CDO Playbook follows. Where the series specified what the mandate is and why it cannot be bought, the Playbook is the practitioner’s how-to: how to scope the first domain, how to draft the charter, how to run the gates, how to read the audit chain, how to scale from Mode 1 to Mode 3 over time. Wednesday by Wednesday, week by week.

About the author

Frédéric Verhelst, PhD (Applied Physics, Delft) helps leadership teams build the foundations for trustworthy agentic AI. Twenty-five years at the intersection of data, AI, and industrial operations: Head of Data Office at TotalEnergies EP Danmark; digital strategy, value case, and improved production potential for the Tyra Redevelopment at Mærsk Oil, with Shell and Chevron as joint-venture partners at FID, continued through the TotalEnergies acquisition; Inpex Ichthys IOC implementation; integrated operations centres across operators. Currently at Viking Life-Saving Equipment. He serves as an executive advisor to boards navigating agentic AI liability, and partners with C-suites on the design of Chief Data Officer mandates that ensure trustworthy, insurable AI operations. He is currently accepting advisory engagements and non-executive director (NED) appointments focused on corporate AI governance.

Follow him on LinkedIn for the latest posts in The Ontology Imperative: Building Trustworthy Agentic AI, and on Substack for the CDO Playbook.

A note on sources

Several arguments in this article were sharpened through pre-publication review by JeanPaul Goldschmidt, Bo Lora and Simon Collery. The framework also benefited from sustained public engagement on the 42 LinkedIn posts that preceded these articles, where practitioner pushback shaped multiple structural decisions. The structural and market contributions are embedded in the argument, not footnoted to it.

3b – The Capabilities the CDO Must Govern

Frédéric Verhelst — Wed, 20 May 2026 05:58:35 GMT

Reading time: ~29 minutes

Four steps that named the layer and left the owner unnamed

McKinsey published four steps for agentic AI at scale in April 2026. Step two modernises the data architecture, naming the semantic layer as a required component. They identified the layer. They did not name who owns it.

That omission is not new. It repeats a pattern older than the agentic conversation. Of the four resources that compose any enterprise capability (People, Processes, Governance/Organisation, Technology), transformation programmes tend to lead with Technology, because technology is the concrete part, and leave the other three to be filled in later. Governance is the resource most often deferred.

On the Norwegian Continental Shelf, the four-resources framework was developed by the Norwegian Integrated Operations (IO) Center, which validated it across five operators: Shell, ConocoPhillips, ENI, Statoil, and Petrobras. The 2014 IO Center Handbook documented the failure mode: leading with Technology and leaving Governance unspecified produced the same pattern across all five.

Twelve years later, the same omission shows up across the consulting industry. McKinsey’s four-step blueprint names the semantic layer as a required component and leaves the governance question unspecified. Capgemini’s Resonance AI Framework names three strategic dimensions (AI Essentials, AI Readiness, and Human-AI Chemistry), with governance treated as one component within AI Readiness rather than as a named ownership question.

Article 3a made the case for the CDO mandate. This article specifies how the mandate must be implemented: what must exist for an agent to be governable, who must own each part, and where the structural authority of the CDO has to be enforceable. The framework builds on what industrial operations have used for two decades, extended for the agentic era.

This is not an IT architecture manual. It is a liability handbook for the board, written in two registers. The architectural detail is reference-grade, written for CDOs and architects who need to work with the framework. The structural arguments around it are board-grade, written for the executives who must set the mandate the framework operationalises. Boards do not need to master every layer; they need to recognise what is missing in their organisation today and understand why they are legally and financially exposed without it.

The argument works through three layers. This article names the architectural building blocks: eleven capability layers, four zones, two structural gates, the Process Owner as the CDO's counterpart, and the four sovereignties that determine whether the mandate is real or advisory. Article 3c (10 June 2026) names the operational tests: six questions for the board, with the vertical-integration, liability, and reporting-line arguments behind them.

Where the stack comes from

The capability approach is new to the agentic AI conversation. It is not new to industrial operations. Around 2000, the oil and gas industry launched an industry-wide Digital Transformation. In Norway, the Norwegian Oil Industry Association named it Integrated Operations. John Henderson at Boston University laid the conceptual foundation in 1993 (Strategic Alignment Model, with Venkatraman). Tony Edwards adapted this capability thinking to oil and gas at bp in 2006 (SPE 100113, the Advanced Collaborative Environments programme structured around five elements: People, Process, Technology, Physical Environment, Organisation), designed to diagnose why digital initiatives in oil and gas failed when any element was missing. Henderson and Kulatilaka formalised the general framework in 2008 (Principles of Capabilities Platforms). It was picked up at Statoil (now Equinor) and formalised as the IO Success Criteria pyramid by 2010, by then a seven-layer structure from data through strategy. The Norwegian IO Center turned it into an academic and methodological corpus across NTNU, IFE, and SINTEF.

The capability approach informs work I have led for two decades. As VP Real-Time Decision Support at Epsis, I co-authored a position paper with Jan Rogier and Jennifer Sampson for the W3C Workshop on Semantic Web in Oil & Gas hosted by Chevron in Houston in December 2008. The keynote was given by Jim Crompton, Chevron Fellow, who told the audience: “We lost control in the digital world.” Moderating the closing panel, he asked who would be driving the next phase. Our position paper described ERA Decide, a decision-support tool combining ontologies, agent technology, and autonomous task execution on OWL, RDF, and SPARQL. ERA Decide is the architectural precursor of the eleven-layer stack as it applies to agentic AI. Eighteen years on, the agents are arriving. The question has sharpened: who governs the meaning the agent reasons from? The CDO.

On the Tyra Redevelopment, the largest single capital investment on the Danish Continental Shelf, I wrote the digital strategy, the digital value case, and the improved production potential for the Final Investment Decision at Mærsk Oil as executive consultant, reporting to the VP Tyra Redevelopment, working directly with Kurt Normann, former COO of Mærsk Oil and the redevelopment’s executive project advisor, and presenting to the joint-venture partners Shell and Chevron.

The Agentic AI Capability Stack applies the same diagnostic logic to a different question. The question Edwards’s stack answered was how to deliver integrated operations with humans bridging meaning gaps at every decision point. The question this stack answers is what must be built when there is no human at the decision point. Every layer that once depended on a human to resolve ambiguity now requires that resolution to exist in machine-readable form before execution. That is not a marginal change. The stack must be extended at every layer where ambiguity once required human judgement.

The four-resources definition assumed a human present at every decision point. Authority, enforcement, and traceability were supplied implicitly by the people resource. Governance was named as a resource but the work it did was invisible because humans did it in real time. The deeper observation is that humans were doing more than monitoring: they were performing what Bo Lora has called digital archaeology, silently reconstructing meaning at every system boundary, stitching together fragments living in schemas, GUI labels, application logic, validation rules, reports, spreadsheets, historical implementation decisions, and organisational memory. This interpretive work never appeared in a productivity report because outputs were measured, not the friction required to produce them.

Agents do not introduce new semantic complexity. They remove the human middleware that hid existing fragmentation. When that buffer is removed, the debt accumulated over decades of optimising for local execution becomes runtime failure at machine speed. Authority, enforcement, and traceability must become machine-readable, not because they did not exist before, but because the labour that produced them implicitly is no longer there to do it. The stack is what surfaces and governs that debt. It makes explicit where the responsibility lives.

The IO Capability Stack at bp in 2006 (seven layers, human at every decision point) and the Agentic AI Capability Stack v3.0 in 2026 (eleven layers, no human at the decision point). What humans held implicitly in IO becomes seven explicit, machine-readable layers in Agentic AI: meaning, knowledge, contracts, guardrails, provenance, agent connectivity, and agent capability.

Four zones. Three boundaries.

The Agentic AI Capability Stack has eleven layers. Four zones. Three structural boundaries. Two gates. One CDO mandate that holds the governance and capability zones together. It is a capability framework, not a technology architecture: each layer names a capability the organisation must hold, not a software component to deploy. The open standards named alongside (OWL, SHACL, PROV-O, MCP, A2A, NGSI-LD) are sovereignty requirements: industry-wide specifications under independent governance bodies, not products controlled by any single vendor. They ensure the organisation, not the vendor, owns the capability each layer represents.

The Infrastructure Zone covers Layers 1 and 2. Two principals hold joint accountability under DAMA-DMBoK discipline. The Data Owner (senior business executive accountable for the Data Domain) is accountable for what the data means and whether it is fit for purpose within their Data Domain (e.g. Customer, Product, Supplier, Finance), with approval authority over definitions, quality standards, and access policies. The CIO is accountable for the technical substrate the data lives and moves on: databases, pipelines, storage, security, availability. Two operational roles execute under them: the Data Steward (business, under the Data Owner) executes quality monitoring, metadata curation, and issue triage daily; the Data Custodian (IT, under the CIO; not to be confused with the strategic custodian function at the Governance Zone level) operates the technical infrastructure without touching content.

The CDO does not own the data, does not run the infrastructure, but sets the agent-readiness standards (data freshness, semantic compatibility, provenance) that the Data Owner, the CIO, and their respective operational roles must all meet before any data is permitted through the ingestion gate at Layer 3.

The Governance Zone covers Layers 3 through 8. The CDO governs these outright: the meaning architecture, the knowledge representation, the agent contract layer, the guardrail layer, the provenance layer, and the agent connectivity layer. This is where meaning, governance, contract, enforcement, and connectivity live. No co-ownership inside this zone. The CDO is custodian end to end.

The Capability Zone covers Layer 9. Two principals hold joint custody. The CDO continues to set and enforce standards (agent contracts, guardrails, provenance) that any agent deployed at Layer 9 must satisfy. The Process Owner, the senior business executive accountable for the operational process the agent operates within, holds operational accountability for outcomes once the agent is deployed. The Deployment Gate at the Layer 8 / Layer 9 boundary is the formal handover where this transition is recorded. The Capability Zone is the only zone with structural co-ownership inside it, and the structure of that co-ownership is described in detail in the gates section below.

The Organisational Zone covers Layers 10 and 11. Layer 10 is the operating model, co-owned by the CDO and the COO: governance dimension with the CDO, operational design dimension with the COO. Layer 11 is strategy, where the board and C-suite sit and the CDO contributes as a peer on the governance and investment case.

The Infrastructure Zone delivers substrate. The Governance Zone is where agent decisions become enforceable. The Capability Zone is where agents act in the business and the Process Owner inherits operational accountability for what they do. The Organisational Zone is where the work the framework enables connects to operating model and strategy. Three boundaries matter, and they are not all the same kind of boundary. Two are structural gates the CDO holds with a named counterpart. The Ingestion Gate (Zone 1 to Zone 2): the Data Owner attests, the CDO approves. The Deployment Gate (Zone 2 to Zone 3): the CDO attests, the Process Owner approves. Each gate fires as two distinct acts by two named principals, recorded separately. The third boundary (Zone 3 to Zone 4) is an authority transition rather than a gate: the CDO holds outright through Layer 9 jointly with the Process Owner, co-owns Layer 10 with the COO, and contributes as a peer at Layer 11 where the board sits. Nothing fires at this boundary, but it marks where the CDO’s executive authority moves from holding to contributing. Most organisations have invested heavily in the first zone and almost nothing in the second and third. That imbalance is the capability gap agentic AI brings to the surface.

The eleven layers

Each layer names a capability the organisation must hold and the role accountable for it. The W3C and industry standards named (OWL, SHACL, PROV-O, ODRL, MCP) are what the engineering team uses to build the layer. The capability question belongs to the CDO. The specification question belongs to the engineering team. The Stack PDF v3.0 carries the full per-layer specification detail.

Layers 1, 2, 10, and 11 carry roles equivalent to the IO Stack. Layers 3 and 4 repurpose its information layers as formal ontology and knowledge graph. Layers 5 through 9 are new: machine-readable forms of what humans once absorbed implicitly (authority, enforcement, traceability, governed connectivity, and capability under deployment-gate authority).

The eleven-layer structure is retained rather than reduced because each layer names a distinct capability with a distinct owner. Merging adjacent capabilities (for example, contract and guardrail, or ontology and knowledge representation) collapses ownership decisions the framework is built to surface. Removing layers (for example, treating connectivity as substrate rather than a governed surface) discards capabilities the agentic operating mode makes load-bearing. Granularity is the point.

Layer 3. Meaning Architecture. Formal definitions of what terms mean across organisational boundaries, owned by the organisation. Labelled property graphs carry associative links but not formal logic; without an owned formal ontology, agents inherit statistical associations from training data. The CDO owns this outright.

Layer 4. Knowledge Representation. The organisation’s operational knowledge graph: who supplies what, which equipment runs where, which decisions were made under which authority. Grounded in the Layer 3 ontology, queryable by agents. Competitors can license the same LLM; they cannot buy the graph that encodes years of organisational decisions. The CDO owns this outright.

Layer 5. Agent Contract. The authority document for each agent. Defines scope, permitted actions, decision authority, escalation routes, operating envelope. The machine-readable equivalent of a contractor’s statement of work, enforced at Layer 6 and recorded at Layer 7. The CDO owns this outright as Contract Owner. The architectural point Article 3a developed through Juan Sequeda’s policy-as-code-to-the-next-level framing: the rule encoded in the contract operates over meaning encoded in the ontology. With both in place, the constraint holds even when the input is ambiguous. Without the meaning layer, it bends.

Layer 6. Guardrail. Structural constraints that fire before action, not after. Pre-execution action gates. Runtime validation that the action the agent proposes is within its contract. The CDO owns this outright as Contract Enforcer. A clarification on what “guardrail” means here, because the term has been diluted by usage elsewhere: structural guardrails are written against the ontology, not prompt-engineered instructions or RLHF-trained refusal behaviours. Both prompt-based and learned guardrails have been demonstrated repeatedly to be circumventable by adversarial inputs. Structural guardrails fire regardless of how an input is phrased, because they operate on the structured assertion the agent has built, not on the natural language that produced it.

Prompts guide. Guardrails enforce. Structural enforcement is preventive. Monitoring is detective.

Layer 7. Provenance. Machine-readable audit trails of which data, which rules, and which authority produced each agent action. Reasoning chains interrogable by regulators, auditors, and boards without access to model weights. EU AI Act Article 14 asks for oversight to be possible; provenance at the moment of action is what makes substantive oversight possible. Article 26 places the corresponding deployer obligations on the operator: operational compliance, log retention, and response to substantial risks. The Process Owner role this article specifies is the operational form of Article 26 inside the organisation. The CDO owns this outright.

Layer 8. Agent Connectivity. The protocol surface through which agents reach every layer below, covering three patterns: discrete tool invocations (MCP), agent-to-agent task delegation (A2A), and continuous context state via subscribe/notify brokers (NGSI-LD). All three are vendor-neutral open specifications under independent governance bodies. No privileged connection: agents reach the constraint, contract, and provenance layers through the same protocol they use to reach data. Governance is in the agent’s call path. The CDO’s procurement test at this layer is whether the chosen protocol can be replaced without rewriting the layers above.

Layer 9. Agent Capability. Agent deployment, orchestration, and multi-agent coordination. The operational layer where agents execute. The Deployment Gate at the L8/L9 boundary is the formal handover where the CDO attests that the governance preconditions are met and the Process Owner approves operational acceptance. After the gate, the agent operates under joint custody. The CDO continues to enforce the agent’s contract, guardrails, and provenance requirements as built. The Process Owner, the senior business executive accountable for the operational process the agent operates within, holds operational liability for the outcomes the agent produces. The legal grounding for this liability, covering strict keeper liability traditions in Continental European law (Halterhaftung in Germany, with similar regimes in Switzerland and Austria), the non-delegable duty doctrine and vicarious liability principles in common-law jurisdictions, EU AI Act Article 26 deployer obligations, and the 2024 revision of the Product Liability Directive extending product liability to AI systems, is developed in Article 3c. Custody of the agent is custody of the process. Joint custody at Layer 9 is where human-above-the-loop oversight is exercised in practice: both principals follow agent operations continuously, and either may halt unilaterally on threshold breach. Layer 10 grants the authority; Layer 9 is where it runs. The gates section below describes the structural grammar that runs the handover.

Layer 10. Operating Model. The operating model for human-above-the-loop oversight. Roles, decision rights, escalation paths, and the judgement thresholds that L9 custodians apply when deciding whether to halt. The operating model runs on three loops at different tempos: machine tempo (Layer 6 enforces in real time), business-unit tempo (governance and engineering partner on exceptions), and organisational tempo (contracts evolve, framework refines itself). The CDO Playbook develops the three-loops architecture. Co-owned by the CDO and the COO. The partnership is over decision rights and judgement thresholds, not over how coordination happens. Agentic coordination at machine speed is infrastructure that the CDO governs at Layers 3 through 8. The Operating Model layer is where humans decide what runs autonomously, what requires approval, and what escalates. Risk, Legal, and Operations co-author what the guardrails at Layer 6 enforce. The CDO owns the guardrails and holds the gate.

The layers are not a menu. They are a sequence didactically and a mesh structurally. The vertical presentation is what the architecture inherits from the IO Capability Stack and what makes ownership legible at a glance. Inside the Governance Zone, the architecture behaves like a mesh: Layer 3 (Ontology) and Layer 8 (Agent Connectivity) function as hubs that every other governance layer reaches through. A failure at any one governance layer propagates along every edge of the mesh, not upward through the sequence alone. The ladder view shows what to own. The mesh view shows how the governance zone wires together at runtime. Both views describe the same architecture; the choice of view depends on the question being asked. The ownership argument that follows holds under either view: there is no structurally sound way to divide accountability inside the Governance Zone without crossing edges that represent real governance dependencies.

The Governance Zone as a mesh. Inside the Governance Zone, every layer connects to every other through two hubs: Ontology (L3) and Agent Connectivity (L8). Every constraint, contract, and provenance assertion is built against the L3 ontology; every agent action reaches the runtime through the L8 protocol surface. A failure at any node propagates along every edge. The mesh topology is the structural reason the CDO must hold Layers 3 through 8 as a single accountable function.

The Stack is not a thought experiment. Layers 1 through 4 have been built before. I was Programme Manager of the IOHN Joint Industry Project from 2008 to 2012, where twenty-two organisations on the Norwegian Continental Shelf built a digital platform for second-generation Integrated Operations on RDF, OWL, SPARQL, and ISO 15926 as the oil and gas ontology. The IOHN Final Report concluded: “Use the W3C stack for RDF/OWL to carry data, and SPARQL for access”. Fourteen years later, the agentic AI conversation is arriving at the same standards. The Stack adds Layers 5 through 9 to make the discipline operational at machine speed.

The two structural gates

The Stack has two structural gates that operate under one rule: the role accountable for the source layer attests, the role accountable for the destination governance approves. Each gate fires as two distinct acts by two distinct roles, recorded separately, audit-traceable independently. The grammar matches ISO 9001 discipline: two acts, two named people, one audit record. Preventive structural enforcement, not detective monitoring.

The Ingestion Gate at the Layer 2 / Layer 3 boundary. Data crosses from the Infrastructure Zone into the Governance Zone. The Data Owner, accountable for the data domain, attests that the data meets the agent-readiness standards the CDO has set: ontology mapping, semantic compatibility, provenance assertions. The CDO approves admission of the data into the governance estate. Two acts, two named people, one audit record. Skip the Data Owner attestation and admission rests on technical compliance without business accountability. Skip the CDO approval and admission rests on domain accountability without governance authority. Both are required.

At the Ingestion Gate: data without formal meaning is not yet agent-ready data. Most organisations have data lakes, warehouses, and integration platforms that move bits efficiently. They do not have ontologies that define what those bits mean to the agents that will act on them. The Ingestion Gate is the structural commitment that no data flows up to Layer 4 until Layer 3 has formally defined what it represents. This is not a data quality check. Data quality lives at Layer 1. The Ingestion Gate is a meaning contract.

The Deployment Gate at the Layer 8 / Layer 9 boundary. The agent crosses from the Governance Zone into the Capability Zone. The CDO attests that the agent is technically ready: data contracts satisfied, connectivity authenticated, meaning architecture defined, knowledge representation populated, agent contract specified, guardrails connected, provenance wired, agent connectivity governed. The Process Owner approves operational acceptance. The two acts together constitute the handover from CDO custody to joint custody. Skip the CDO attestation and the agent enters operation without the governance preconditions tested. Skip the Process Owner approval and operational liability defaults to no one, which means it defaults to the board after the fact.

At the Deployment Gate, existence is not enough: the layers must be scoped to the specific agent’s authority and under continuous governance at runtime, not defined on paper. This is the step McKinsey’s four steps name but cannot operationalise. Naming infrastructure does not name who holds the gate. An agent that cannot meet the eight Deployment Gate preconditions does not enter production. Not because the CDO has a veto over business decisions. Because the CDO holds the structural authority to verify that the framework’s preconditions are met before an agent acts, and the Process Owner has the structural authority to refuse operational custody of an agent that has not. The same structural pattern that puts financial reporting controls under the CFO under SOX, applied to a domain bound by three current pressures, none reducible to the others: regulatory (EU AI Act, KRITIS, NIS2), reputational (Boeing-pattern cascades), and commercial (clients and counterparties whose contracts depend on agent trustworthiness).

The Process Owner is the destination role at the Deployment Gate. Every agent operates within a business process. Sometimes the agent executes a single step, sometimes a whole workflow end to end, sometimes a portion shared with other agents in a multi-agent workflow. Best practice is to scope individual agents narrowly to specific roles within a process rather than to large multi-purpose mandates. Narrow scope keeps the agent contract concrete, the SHACL constraints tight, the provenance chain clean, and the Process Owner’s custody specific. The custodian of the process is the natural custodian of the agent. That role is the Process Owner: the senior business executive accountable for the operational process the agent operates within.

The Process Owner is the destination-side counterpart of the Data Owner in the gate structure. Where the Data Owner is accountable for data within a Data Domain and attests at the Ingestion Gate, the Process Owner is accountable for a business process and approves at the Deployment Gate. Where the Data Steward executes operational work under the Data Owner, a Process Performer or Process Steward executes operational work under the Process Owner. Both Data Owner and Process Owner are senior business executive roles, typically at VP or SVP grade; neither is itself C-suite. Both report into business unit accountability rather than into the CDO line. The CDO sets standards. The Process Owner carries operational liability. The structural separation is what allows custodian liability to stay with the Process Owner while the technical check runs with the CDO team.

Data Owner and Process Owner are accountability roles, not necessarily different people. In most departments, the manager accountable for the data domain is also accountable for the business process that runs on it; one executive holds both roles. The VP of Customer Operations is Customer Data Owner and Customer Service Process Owner. The structural separation is between the act of attestation (source-side) and the act of approval (destination-side). Auditability comes from naming the act, not from requiring different people to perform each. In Mode 3, the CDO inherits all three role-positions for the demanned division; the gates still fire, with the audit acts remaining distinct even when one executive performs them all.

Halt authority works in parallel after the gate fires. The Process Owner can halt the agent for operational failure (the process is not running correctly). The CDO can halt the agent for governance breach (contract drift, guardrail failure, provenance gap). Either halt is unilateral. Reinstating the agent requires both signatures. In multi-agent workflows, halt propagates along the contract chain: when one agent is halted, downstream agents that consume its outputs under their own contracts pause at their next ontology-bound input check. Halt is not a global stop button; it is a contract-mediated cascade. The Process Owner's halt authority extends across the workflow because the workflow is the Process Owner's custody. The CDO's governance-breach halt extends along the same chain because every agent contract sits under the same governance framework. This is the agentic equivalent of the structural pattern that gives both the Offshore Installation Manager and the HSEQ Director unilateral stop authority on a North Sea installation. The point is not that they always agree. The point is that either can stop unsafe operation immediately.

The level differential between CDO (C-suite) and Process Owner (typically VP or SVP) does not compromise this mechanism. Halt is unilateral by design and survives any seniority gap; the Process Owner does not need the CDO’s permission to halt on operational grounds, and the CDO does not need the Process Owner’s permission to halt on governance grounds. Reinstatement requires both signatures regardless of who is more senior, so seniority cannot break the lock. A dispute over reinstatement escalates through the Process Owner’s reporting chain to a C-suite peer of the CDO (usually the COO or CFO), which is the appropriate forum for resolution. The asymmetry is a feature: the CDO carries enterprise-wide governance standards; the Process Owner carries operational accountability for one business process. Each is the senior authority in their own domain at their own level. The residual risk is cultural, not structural: a Process Owner who defers to a more senior CDO, or a CDO who pressures a more junior Process Owner. Board-level oversight of the gate audit chain closes that residual risk by surfacing the asymmetry if it appears in the halt-and-reinstate record.

A second failure mode appears in complex matrix organisations, particularly under critical-infrastructure regimes (Germany's KRITIS Umbrella Law, the EU NIS2 Directive's operator obligations, similar frameworks in other jurisdictions). The Process Owner sits in a business unit whose C-suite peer does not regard agent governance as part of their portfolio. Escalation stalls not at the Process Owner level but one level up. The structural fix is the same board-level oversight of the gate audit chain: when escalation stalls, the audit chain surfaces the stall to the board as a governance breach in its own right, independent of the underlying agent question.

Both gates’ authority must be explicitly granted in the CDO’s charter and the Process Owner’s role definition, not inferred from organisational structure. A charter that describes the CDO as accountable for trustworthy AI without granting the deployment gate produces the pattern this series has documented over the past six months: policy that cannot be enforced, guidelines that can be routed around, governance that reaches for the problem after it has already happened. A Process Owner role that exists without explicit acceptance authority at the gate produces the parallel failure: an agent in operational use with operational accountability undefined.

That parallel failure has consequences when something goes wrong. When an agent produces a consequential error, regulators, insurers, and boards will ask four questions: who defined what this agent was authorised to do, can you demonstrate it was enforced before it acted, can you trace the meaning the agent reasoned from, and what is the structural change that prevents recurrence. The governance framework that cannot answer those four questions is a document, not a control. The accountability chain that the two-gate structure builds is the operational form of the answer.

One pattern deserves architectural treatment here because most agentic deployments take this form: natural language in (an email, a chat, a transcript) and output that may be natural language (a reply, a recommendation) or a structured action (a booking, an order, a record update, a scheduling decision). The architectural commitment is non-negotiable: flexibility lives at the input boundary; determinism lives at the action boundary. The agent parses natural language into structured assertions referencing the ontology, then validates those assertions against SHACL constraints before any action executes. The parse step is probabilistic and is what LLMs are good at. The validation step is deterministic. The action does not fire if validation does not pass. Stanford research finds LLMs systematically overconfident: nominal 99% confidence intervals cover the true answer only 65% of the time on average across modern models. The architecture does not depend on the model's self-assessment. It depends on the validation step that follows the parse.

The standard data taxonomy (structured, semi-structured, unstructured) is incomplete for agentic AI in two dimensions: form and time. By form, the Stack handles four tiers. Semantic data, meaning RDF triples grounded in OWL ontology on W3C open standards, is the form the Stack reasons over at Layer 4. It can be authored directly by Data Owners at Layer 1 (master data graphs, reference data ontologies, domain-specific KGs) under the CDO’s ontology requirements set at Layer 3. The Stack requires this formal grounding wherever it lives: labelled property graphs without OWL-defined semantics carry relationships but cannot be SHACL-validated against the ontology by construction, which is the difference between an associative store and a substrate the constraint layer can enforce against. Structured data (SQL tables, transactional records) carries explicit schema. Unstructured data (documents, PDFs, archived emails, transcripts) carries no schema. Natural language at runtime is conversational input that arrives without structure.

By time, data of any form enters the Stack through one of two pathways. Stored data enters at Layer 1 and passes the Ingestion Gate at the L2/L3 boundary, with the gate’s mechanism depending on form: schema-to-ontology mapping for structured data, document parsing for unstructured, SHACL validation for semantic data. The data lands at Layer 4. Runtime data enters at Layer 8 through the three connectivity patterns named above: discrete tool invocations, agent-to-agent messages, and continuous context state from subscribe/notify brokers. It is parsed at Layer 9 into candidate structured assertions and passes the same governance chain (Layer 3 ontology grounding, Layer 6 constraint enforcement, Layer 7 provenance) before action. Natural language enters at both pathways: as documents at Layer 1, as user utterances and agent-to-agent text at Layer 8. Different forms take different pathways; the architectural principle is the same: no information enters the agent’s reasoning space without ontology grounding. The Ingestion Gate is continuous, not an event. The CDO holds the gate function across every form and every pathway. The Agentic AI Capability Stack v3.0 carries the full per-form taxonomy.

Authoring bias in ontologies is a known concern in the ontology engineering literature. The structural question for agentic AI is not whether such bias exists but where it can be governed. The three failure modes at the boundary (extraction probabilism, confident mismatch, authoring bias), and the operational architecture for handling each, are treated in a follow-up piece. The two-layer model itself is being operationalised for CDOs as an articulation framework and procurement diagnostic for the CDO Playbook.

The minimum viable ontology

The Stack is a precondition for deployment, not a destination after deployment. An organisation that deploys agents before the Stack is in place produces governance malpractice; the article has spent considerable space on what that looks like. But the Stack is also not a single enterprise-wide mapping programme that must be complete before any agent can be deployed. That is the second governance failure: the mapping that boils the ocean and never delivers.

The minimum viable ontology resolves both. Start with the most consequential agent, the one closest to safety-critical, regulated, or financially material decisions. Build the OWL ontology for that agent’s operational domain. Populate the knowledge graph for that scope. Define the agent contract. Configure SHACL guardrails. Wire PROV-O traces. Apply the full Stack within that bounded operational perimeter. The Ingestion Gate fires for every input within that domain. The Deployment Gate fires for that agent. Governance coverage is whole within scope. Outside scope, deployment is forbidden, because the Stack is not in place there.

The first domain becomes the operational template. The second reuses the ontology where it federates and extends it where it does not. The Stack scales with scope, not with completeness. The federation pattern is not theoretical: Novo Nordisk has built one of the most mature enterprise knowledge graph estates in Europe through exactly this approach, starting with a single bounded domain (clinical trial protocols, where regulatory pressure made formal semantics non-negotiable) and federating outward to adjacent domains as each was matured to the same governance standard. The Stack architecture is the same; only the order of domain prioritisation changes by organisation.

Jim Hendler, one of the three authors of the 2001 Scientific American paper that founded the semantic web, gave this approach its name: a little semantics goes a long way. Twenty-five years on, his point holds. A bounded ontology applied with full architectural rigour delivers more governance than a sprawling enterprise model that is never finished and never enforced.

The minimum viable ontology has one enterprise-wide prerequisite and extends to one bounded-scope discipline.

Enterprise-wide: governance maturity. Named process owners, approval gates, RACI discipline, corrective and preventive action loops. Most mature organisations have this and run it daily in ISO 9001, SOX, GxP, or equivalent. The Stack inherits the grammar directly. Where this discipline is weak overall, the agentic question is a sequencing problem: build governance discipline first.

Bounded scope: data management maturity within the chosen domain. The DAMA-DMBoK disciplines of data governance, data quality, metadata management, master and reference data, and data architecture. This is the patchier prerequisite. Many organisations that run mature governance everywhere else have weak data management: the customer master is owned by no one, two systems disagree on what counts as a supplier, data quality is a hope rather than a discipline. The minimum viable ontology extends downward to fix this within scope. Layers 1 and 2 come up to agentic-readiness alongside Layers 3 through 7. The agent deployment funds the data management uplift; the uplift makes the agent governable; the Stack ties them together under one mandate. When the second domain federates, both federate together. Data management and Stack mature in lockstep, scaled with scope, not with completeness.

The North Star is comprehensive coverage of every domain in the organisation. The starting point is one well-governed domain that demonstrates the operating model.

Four dimensions of ownership

The semantic sovereignty argument is not new. I made the first version of it at the W3C Semantic Web Workshop hosted by Chevron in Houston in December 2008, where Jim Crompton’s keynote and closing panel framed what is still the central question: who owns the meaning when the engineer is no longer in the room. Eighteen years on, the answer is the CDO. The question has not changed.

Holding the gates is one part of a four-dimensional ownership model: three links that run as a chain, on one substrate. Semantic sovereignty is the precondition for enforcement sovereignty: you cannot enforce what you have not defined. Enforcement sovereignty is the precondition for execution sovereignty: you cannot verify what you have not constrained. Beneath all three sits jurisdictional sovereignty, the ground the chain runs on: if a third party can switch the platform off, the links above it do not matter. Lose a link and the chain collapses to whoever owns the missing layer; lose the ground and all three go dark at once. In both cases that is almost always the vendor. The complete ownership model has four dimensions, and most organisations have none of them.

Semantic sovereignty sits at Layers 3 through 7. The CDO owns the ontology, the knowledge graph, the contracts, the guardrail shapes, and the provenance layer on open W3C standards that the organisation controls, federates, and can migrate independently of any vendor. The ownership decision is not about which standard is most elegant. It is about which standard is the organisation’s to own when the vendor relationship changes.

Enforcement sovereignty sits at Layer 6. The CDO can own the ontology on open standards and still be operating with borrowed authority. A regulatory requirement changes the constraints the agent must respect. Constraint propagation depends on the vendor’s release cycle rather than the CDO’s governance mandate. Semantic sovereignty sits with the CDO; enforcement sovereignty sits with the vendor. The CDO’s authority is borrowed from a release schedule. Article 3a developed this failure mode through JeanPaul Goldschmidt’s argument; the layer-specific name is Layer 6.

The clearest example is SAP Joule. Customers can extend the SAP Knowledge Graph and build custom agents through Joule Studio. The underlying ontology remains SAP’s. Constraint propagation across SAP-shipped agents follows the SAP release cycle. The CDO’s authority to update the constraint layer in response to a new regulatory requirement runs through the vendor’s roadmap for any agent SAP ships and through SAP’s governance products for the rest. That is not governance. That is subscription with extension points.

A clarification of vendor categories matters here because the structural failure looks similar across two distinct actor types with different regulatory hooks. Application vendors (SAP, Salesforce, ServiceNow, Workday) embed agents inside enterprise applications the organisation already runs. The governance failure is borrowed authority through the vendor’s release cycle: an enterprise software contract, often with negotiation leverage. Foundation-model providers (OpenAI, Anthropic, Google) supply the underlying reasoning capability that other agents are built on. The governance failure is one layer deeper: constraints sit inside model weights, auditable only by the entity that trained them, with no external control point during inference. Both failures share the same structural property (the CDO’s authority is borrowed from a commercial relationship rather than from organisational design) but they require different procurement responses, and at scale, different regulatory responses. The enterprise can negotiate enforcement sovereignty into an application-vendor contract. It cannot negotiate semantic sovereignty into a foundation-model contract; that one shifts upstream to regulators and mandated third-party audit.

Execution sovereignty applies at the agent capability layer (Layer 9) and the infrastructure that runs it. The CDO sets the verifiability requirements that the runtime must meet. Semantic constraints defined at Layers 3 through 7 are only as trustworthy as the execution environment that runs them. The runtime needs to produce verifiable evidence that the agent ran as specified, not just the infrastructure provider’s word for it. Confidential computing is available across modern CPU and GPU lines and is exposed through major cloud providers as attested execution services. The capability exists. The CDO’s governance requirements must extend to its use. Governance defined at the semantic layer, enforced without vendor release cycle dependency, verified at execution. All three required.

Jurisdictional sovereignty is not a layer the Stack covers. It is the ground the whole stack runs on, and it asks whether a third party holds the off-switch. An export-control or sanctions order can disable a model for every customer overnight, and backups do not restore an agent that can no longer reason; a correlated outage of that kind is the uninsurable event underwriters are already pricing out. Semantic, enforcement, and execution sovereignty all rest on this ground. The mandate must be held internally, on open standards that keep the ontology, constraints, and provenance portable to another jurisdiction.

What follows from the four sovereignty failures is a procurement-side test the board can apply directly. Article 3a developed four contractual criteria for platform evaluation; this article adds a fifth from the execution-sovereignty argument above and a sixth from jurisdictional sovereignty. Together: governance rules client-configurable without vendor software release. Runtime enforcement that fires before execution, not after. A semantic layer on open standards portable across platforms. Provenance at the moment of action linking every decision to the framework in force. Verifiable execution evidence independent of the infrastructure provider. And, if a government compels the provider to cut access through sanctions or export control, an exit path that keeps the governed stack running from exports the organisation already holds, on infrastructure or in a jurisdiction it controls, without the provider's cooperation. Any one absent and the corresponding sovereignty rests with the vendor. The mandate cannot be bought. It must be held.

Four sovereignties, three links and the ground. Semantic sovereignty owns the meaning at L3 to L7. Enforcement sovereignty owns the constraint update cycle at L6. Execution sovereignty owns the verifiability of the runtime at L9 and the infrastructure beneath. Jurisdictional sovereignty is the ground the chain runs on: whether a third party holds the off-switch, mitigated only by open standards that keep meaning, constraints, and provenance portable to another jurisdiction. All four required. Any one captured by the vendor returns the mandate to the vendor regardless of the organisational chart.

The mandate cannot be bought. It must be held.

Postscript, June 2026. Events overtook this article within days. A US export-control directive forced the overnight suspension of two frontier models, for every customer, in every jurisdiction. As first published, this section named three sovereignties, sitting on a substrate the chain itself never named. The section above now carries the fourth: jurisdictional sovereignty, whether the platform running your agents is insulated from foreign directives, or whether a third party holds the off-switch. Lose any link and the chain collapses to whoever owns it. Lose the ground and all three go dark at once. The full argument is in this LinkedIn post. It strengthens rather than revises this article's conclusion: portability on open standards is what makes the ground recoverable.

What this piece establishes, and what follows

This article has established the framework. The eleven-layer Agentic AI Capability Stack, the four zones, the two structural gates, the minimum viable ontology, and the four sovereignties that determine whether the mandate is real or rented. The mandate cannot be bought. It must be held.

The next piece moves from architecture to accountability. What happens when the framework’s silent premise fails (vertical integration, foundation models, the regulatory boundaries the Stack does not cover). How the discipline already exists in mature regulatory regimes (Halterhaftung, ISO 9001, four lines of defence). Why the insurance market is already pricing the gap. How the delegation model scales across three modes from governed infrastructure to fully autonomous operation. Why the C-suite reporting line is structural and not symbolic. And the six questions a board can ask today to locate where the framework is missing in its own organisation.

Article 3c, “When the Container Fails: Vertical Integration, Liability, and the CDO Mandate in Practice”, published 10 June 2026.

Subscribe now

About the author

Frédéric Verhelst, PhD (Applied Physics, Delft) helps leadership teams build the foundations for trustworthy agentic AI. Twenty-five years at the intersection of data, AI, and industrial operations: Head of Data Office at TotalEnergies EP Danmark; digital strategy, value case, and improved production potential for the Tyra Redevelopment at Mærsk Oil, reporting to the VP Tyra Redevelopment and presenting to joint-venture partners Shell and Chevron; Inpex Ichthys IOC implementation; integrated operations centres across operators. Currently at Viking Life-Saving Equipment. He serves as an executive advisor to boards navigating agentic AI liability, and partners with C-suites on the design of Chief Data Officer mandates that ensure trustworthy, insurable AI operations. He is currently accepting advisory engagements and non-executive director (NED) appointments focused on corporate AI governance.

Follow him on LinkedIn for the latest posts in The Ontology Imperative: Building Trustworthy Agentic AI.

A note on sources

Several arguments in this article were sharpened through pre-publication review by JeanPaul Goldschmidt, Bo Lora and Simon Collery. The framework also benefited from sustained public engagement on the LinkedIn posts that preceded these articles, where practitioner pushback shaped multiple structural decisions. The structural and market contributions are embedded in the argument, not footnoted to it.

3a – The CDO Mandate: Custodian of Enterprise Knowledge

Frédéric Verhelst — Thu, 09 Apr 2026 06:23:40 GMT

Reading time: ~20 minutes

The paradox that ends careers

Capgemini surveyed the C-suite this year and named the CDO the executive most prepared for AI transformation. No other role comes close on the readiness metrics they measured. Gartner’s own research runs in the opposite direction: 75% of CDOs not perceived as essential to AI success will lose their C-level position by 2027. Same role. Opposite trajectories. Both findings are correct.

That is the paradox this article is about.

It is not a contradiction. It is a structural problem. The CDO’s authority is borrowed from the programs that justify the mandate. The program ends. The preparation does not. The authority goes with it.

Agentic AI does not resolve the CDO paradox. It makes the consequences immediate and irreversible. The consequences of a CDO mandate that stops at pipelines and dashboards are no longer a governance gap that surfaces slowly through data quality incidents and stalled BI projects. They are wrong decisions at machine speed, at scale, with no human in the loop to catch the error before it compounds.

This article opens the HOW argument. Earlier in this series, the case was made that knowledge graphs and formal ontologies are not a technology preference but a governance requirement. Most organizations are deploying agents without anyone owning what those agents are permitted to know, decide, or do. Some deploy without any governance foundation at all. This article addresses what must be built and who must own it. It opens with the mandate because without the right mandate, the architecture does not get built.

Why the mandate keeps dissolving

The CDO role was born twice, and each birth came with a structural defect.

The first CDO emerged from compliance. SOX. Basel II. HIPAA. The reporting line ran often to the CIO, or the CFO. The mandate was defensive: accuracy, access control, retention schedules, audit trails. The function was real. The organizational standing was borrowed from whichever executive’s priorities the mandate served. When the compliance program reached steady state or the executive’s priorities shifted, the mandate contracted.

The second CDO emerged from digital transformation. Boards approved programs with ambitious timelines. Someone had to own the data track. Reporting lines shifted toward the Chief Digital Officer or the COO. The mandate became data governance and access: domains, ownership, quality, pipelines, data lakes. The CDO owned the strategy but not the systems or the teams where the data actually lived. The accountability gap was structural from the start. Governance policies were written. Enforcement depended on political goodwill rather than organizational design.

Transformation programs do not end cleanly. They lose momentum, get rebranded, get absorbed into the next initiative. The CDO’s mandate dissolves with them.

I inhabited both versions of this mandate. As Head of Data Office at TotalEnergies EP Danmark, I reported first to the CFO and later to the CTO. The shift mattered. Under the CFO, the data function was a cost center: compliance, accuracy, audit trails. Necessary work, but measured by what it prevented rather than what it created. Under the CTO, it became a capability closer to operational value creation. The reporting line moved the function from cost to contribution, and the organizational recognition followed. Both mandates came with budget, team, and genuine support. But both were conditional on the priorities of the executive above me remaining aligned with the work. Within a single role, across a single tenure, I watched the mandate shift. The move toward operations helped. It did not make the mandate permanent.

That experience is not unusual. Research tracking CDO tenure puts the average around thirty months, a symptom of the same structural problem. Accountability without authority. A mandate defined by the program that created it, not by the function itself.

The CFO transformation is the right frame for understanding where the CDO must go. A generation ago, the chief accountant was not invited to strategy sessions. The role was bookkeeping. The mandate expanded over time through a series of crises that made financial governance inseparable from organizational survival: capital allocation, M&A structuring, risk modeling, investor relations, and eventually the regulatory frameworks that made internal controls legally consequential. The title stayed. The authority transformed. That transformation was not chosen. It was forced by a sequence of crises that made financial governance non-negotiable. The CDO mandate will transform by the same mechanism. Not because boards decide to expand it. Because agentic AI will produce failures that trace back to the absence of semantic governance, and those failures will have consequences, regulatory, financial, reputational, that make the function indispensable. The CFO mandate was formed by survival. The CDO mandate will be too.

The 12th discipline

The Data Management Association’s Body of Knowledge covers eleven disciplines.

All eleven address data in every dimension that matters for traditional analytics and reporting. None of them address meaning.

Meaning is not the same as metadata. Metadata describes data: where it came from, when it was created, who owns it, how it is classified. Meaning determines what a term actually refers to when a system is required to act on it without human interpretation. Better metadata does not close that gap. A more precise classification of “approved supplier” still leaves the agent acting on the field value. Formal ontologies are required because they specify what the term means, not just how it is labelled.

“Approved supplier” is a metadata category in most enterprise systems. It is a field value, a classification, a tag. In a supply chain governed by human judgment, that tag is enough. The procurement manager reads it and applies organizational context, exception history, and domain knowledge that does not live in the field value. She knows that the approved status on the record was granted before the last quality incident. She knows that “approved” for standard components and “approved” for critical safety parts are not the same classification, even though the field value is identical. She makes the call.

The agent reads the field value. It has no access to the exception history, the domain knowledge, or the organizational context that the manager carries. It acts on the field value as specified. If “approved” is not formally defined in machine-readable form, specifying exactly what it means in each context, the agent is acting on a word.

I encountered this problem operationally, not theoretically. In the Integrated Operations program I ran across twenty-two organizations on the Norwegian Continental Shelf between 2009 and 2012, semantic misalignment was among the primary reasons cross-organizational coordination failed. Not data quality failures in the traditional sense. Not system unavailability. Different organizations using the same operational term to mean different things, with no shared formal definition to resolve the ambiguity at the point of decision. Humans absorbed the misalignment at every organizational boundary. The moment you propose automating across those boundaries, the absorption mechanism disappears and the misalignment becomes a failure mode.

The automotive supply chain makes this concrete. BMW Group and Mercedes-Benz are direct competitors, both supplied by Bosch. They share a semantic foundation through the Catena-X initiative, which defines what “approved supplier” means across organizational boundaries using open interoperability standards. Competing manufacturers and suppliers share the same axioms. The alignment required before agents can operate across that boundary is not a data engineering problem. It is a governance problem. Someone has to own the definition. Someone has to maintain it. Someone has to hold the authority to say when it applies, when it does not, and what changes when the regulatory environment shifts.

The twelfth discipline is this: formal ontologies that specify what terms mean in machine-executable form, knowledge graphs that represent organizational entities and their relationships, agent contracts that define what agents are permitted to know and do before execution begins, constraint layers that enforce those contracts at runtime, and provenance that records every decision in an auditable chain that a regulator or an insurer can examine after the fact.

Call it semantic governance: the discipline that specifies what terms mean, enforces what agents may do, and records what they did.

That is not a deliverable. That is institutional IP that requires a permanent organizational capability to keep current. And the CDO who builds and maintains it owns the only governance layer that holds at agent speed.

I made this argument at the W3C Semantic Web Workshop at Chevron in Houston in December 2008, where Jim Crompton, Chevron Fellow and Global Upstream i-field program advisor, presented on the cost of data that never reaches decisions. The consequences were more contained. The stakes were real-time drilling and production data within defined operational boundaries, not autonomous agents acting across an entire organization at machine speed. But the architectural argument was identical: formal definitions are the precondition for systems to cooperate across organizational boundaries without a human translator at every junction.

Seventeen years later, agents are replacing the human translators at every boundary. The formal definition is the only mechanism that can absorb the misalignment they previously handled.

Agents need contracts, not onboarding documents

Säde Haveri, a metadata and governance practitioner who has built federated governance systems in production, put the framing problem precisely in a discussion that followed one of the posts in this series: when you hire a human, you onboard them. For an AI agent, you give it access to the wiki and say figure it out. Her observation lands because it names the gap accurately. But the solution she points toward is sharper than onboarding suggests.

When you hire a human, you describe expectations. An onboarding document is description. A contract is enforcement. The distinction matters because agents do not comply with descriptions. They operate within whatever has been formally specified in their contract. An onboarding document injected into a context window is a suggestion. A SHACL constraint is a boundary. One of these fails on ambiguous input. The other does not.

The CDO’s primary product in the agentic era is not a data strategy document. It is a set of machine-readable agent contracts. Each contract specifies: the scope of data the agent is permitted to reason over, the actions it is authorized to take, the constraints that apply under each condition, the escalation path when a decision falls outside the specified boundary, and the provenance requirements that apply to every action taken under the contract. The contract is written in the ontology. A constraint layer enforces it at runtime before the agent acts. The provenance layer records that it did.

Juan Sequeda, Principal Data Strategist at ServiceNow and co-host of the Catalog and Cocktails podcast, responding to the same thread, described this as taking “policy as code” to the next level. The framing is right. Policy as code encodes the rule. The ontological contract encodes the meaning the rule operates over. You need both. Without the meaning layer, policy as code enforces syntax. With it, the rules hold even when the input is unclear. That is the difference between a guardrail that holds and one that bends.

This reframes what the CDO’s organizational standing needs to look like. A CDO who produces strategy documents and governance policies is producing paper. A CDO who owns the agent contract layer is producing enforcement infrastructure. The organizational authority required for the second function is categorically higher than the authority required for the first. You can write a governance policy from any position in the hierarchy. You cannot hold an agent deployment gate from a position that reports to the CIO whose infrastructure decisions you are required to approve.

The architecture decision

Palantir Technologies published an end-to-end agentic architecture this year that settles a debate the industry has been conducting at the wrong level. The debate is about which model performs best. The architecture shows that the model is item 1 of 12 in the stack. It sits in the bottom right corner. Commercial and open-source models are treated as interchangeable, untrusted inputs.

The ontology sits at the center. It integrates data, logic, actions, and security into a unified representation accessible to both humans and agents. Security and governance run horizontally across all twelve layers.

The moat is not the LLM. It is the operational graph. The LLM reasons over it. Competitors can license the same LLM. They cannot replicate what the graph contains because it took years of organizational decisions and domain knowledge to build. Gartner reports that half of all AI client inquiries now involve graph technology. The market has arrived at the same conclusion.

I built this architecture for agentic AI in automated operations and automated drilling on the Norwegian Continental Shelf in 2006. Then the reasoning was agent-based and ontology-grounded, with no LLM in the stack. We were implementing ISO 15926 in production before the standard had reached its final form. Today it is hybrid: LLMs for reasoning, formal ontologies for meaning and constraints. The architecture is the same. The engine has changed.

Palantir has now published the diagram that proves this architecture at scale, in one of the most valuable software companies in the world. The example matters not because of the vendor, but because it makes explicit an architecture that many organizations are already approximating implicitly. What it does not answer is the question that determines whether the architecture serves the organization or the vendor.

The diagram shows the architecture. It does not show who controls it.

Who owns the operational graph?

Palantir’s answer is Palantir. The semantic layer in their platform is proprietary. Object types, action rules, and relationships live inside their stack. Organizations cannot extract, version, or federate those assets independently of the platform contract.

Yann LeCun, on the Lex Fridman podcast, identified the concentration of power through proprietary AI systems as a much bigger danger than the AI risks most commonly discussed. When the meaning layer is proprietary, the institutional knowledge encoded in it follows the license agreement. Supplier approvals, maintenance triggers, contract terms, and operational decision logic become someone else’s infrastructure the organization rents. Every board that has lived through an ERP migration understands the risk. The business logic encoded in the vendor’s data model did not belong to the organization. The semantic layer is the same problem, at agent speed.

The original argument from Article 1b of this series holds in its sharpest form here. You do not choose between owning or renting the AI model. You choose between owning or renting the semantic layer. The LLM is already rented. The semantic layer is the question.

The alternative is open W3C standards: OWL for the semantic layer, SPARQL for the knowledge graph, SHACL for the guardrail layer, PROV-O for provenance. The same architecture. A different ownership model. The organization defines what its agents are permitted to know and do in machine-readable form it controls, federates, and migrates independently of any single vendor.

This is not a technology preference. It is a governance decision with long-term consequences. The board that approves a proprietary semantic layer today is making an irrevocable commitment to a vendor relationship that becomes more locked in with every agent deployment. The knowledge graph that encodes years of organizational decisions is not replaceable if the vendor relationship changes.

JeanPaul Goldschmidt, a senior IT governance advisor with three decades across automotive and critical infrastructure, in the discussion that followed the Palantir architecture post, identified a dimension the own-vs-rent framing understates. Semantic sovereignty and enforcement sovereignty are not the same thing. The CDO can own the ontology on open standards and still delegate enforcement to the vendor if constraint propagation follows the vendor’s release cycle rather than the CDO’s governance mandate. A new regulatory requirement takes effect. The CDO needs to update the constraint layer. Propagation follows the vendor’s release schedule. The semantic sovereignty is with the CDO. The enforcement sovereignty is with the vendor. The CDO’s authority is still borrowed. Before, it came from the executive above. Now it comes from the vendor’s release cycle.

What follows from this is a mandate extension most boards have not yet formulated: the right to require from vendors that governance rules are client-configurable without a software release, as a contractual precondition for platform selection. Most platforms do not offer this today. That is precisely why it must be written into the contract before signing.

Four criteria should function as deal-stoppers in platform evaluation: governance rules that are client-configurable without a vendor software release, runtime enforcement that sits before execution rather than logging after the fact, a semantic layer built on open standards portable across platforms, and provenance at the moment of action linking every agent decision to the governance framework in force at that time. If any of these is absent, enforcement sovereignty remains with the vendor. The mandate is advisory by contract, regardless of the organizational chart.

Cross-organizational governance

The same ownership question that applies within the organization applies across it, at higher stakes.

The supply chain case is where the governance argument becomes undeniable for boards, because the financial consequences of semantic misalignment are quantifiable and the responsible party is traceable. IDC named it the Digital Tower of Babel: pipes open, APIs connected, messages misunderstood. Organizations with integrated systems and no shortage of connectivity still produced decisions that conflicted because the terminology had no shared formal definition on either side of the organizational boundary.

The oil and gas industry encountered this problem a decade earlier. In the IOHN program across twenty-two organizations on the Norwegian Continental Shelf, we used ISO 15926 as the lingua franca: a common domain vocabulary that allowed organizations to describe the same assets, the same operational terms, and the same data in the same way. The misalignment did not disappear because we connected the systems. It disappeared because we defined the terms. Agents operating across those same boundaries will fail for the same reason.

The governance question that emerged when I was CEO of the Knowledge Graph Alliance was not about competitive advantage. It was about pre-competitive infrastructure. Airbus, Michelin, Bosch, and TotalEnergies could each build a semantic layer alone. What they could not do alone was make those layers interoperable across organizational boundaries. The working groups that formed around shared tooling, LLMs and knowledge graphs, explainability principles, and machine learning convergence were not governance disputes. They were an industry learning from each other on foundations that do not differentiate any single competitor, so that the differentiation built on top of those foundations actually holds.

SousLeSens, instigated by Jean-Charles Leclerc and Claude Fauconnet, both with TotalEnergies backgrounds, is the tooling side of the same principle: open-source software for building and managing knowledge graphs, available to any organization regardless of size or resources. CFIHOS and Catena-X are the standards side: shared definitions on open standards, with governance distributed across the participating organizations. Together they illustrate what pre-competitive infrastructure looks like in practice.

The board facing an agentic AI deployment that crosses organizational boundaries is facing the same decision. The agents will be connected. They are already connected. The question is whether they share the definitions required to act coherently on shared data. That is a governance question before it is a technology question. And the CDO who owns the answer to that question is the CDO who owns the function that determines whether cross-organizational AI produces value or liability.

The value loop

Around twenty-five years ago, Shell’s Pieter Kapteijn articulated a framework that has since become the governing principle for how I think about data value. He called it the Value Loop, sometimes rendered as the octogram. Working closely with him in the Smart Fields program exposed me to frameworks, including this one, that have been part of my intellectual foundation ever since, right through to agentic AI. The octogram makes explicit what those eight stages actually contain.

Shell Value Loop octogram — The Value Loop © Shell. Thanks to Pieter Kapteijn. Original provided to the author by Pieter Kapteijn.

Decision makers and action takers sit at the centre. That is the human judgment layer agents now replace. Working with this framework over two decades, I came to describe the underlying principle as a best before problem: data has a best before date. Its value is highest when it is fresh and when the decision it informs can still execute before the window closes. Delay any stage past that window and the data becomes history rather than intelligence.

Kapteijn, reflecting on twenty-five years since the framework’s development, observed that if you get the fundamentals of closing the Value Loop right, the rest follows. Companies still struggle to get it right. AI will not solve it for them. The hardest fundamentals are not technical. They are change management and company culture. Agents do not fix a broken loop. They accelerate it.

At the KGA Founding Event in Brussels in November 2023, Peter Dröll of the European Commission made the scale of the problem plain. Around 80% of industrial data never reaches execution. It never closes the loop. His figure was not about data quality in the narrow technical sense. It was about data that is captured, stored, managed, audited, and still never arrives at a decision that creates value. That data is not neutral. Storage costs. Management costs. Compliance exposure. Security risk. The option value argument is real but limited. Some data is legitimately held against future use: a deliberate governance decision to retain specific data against a defined scenario, assessed and chosen. That is option value. What most organizations are doing is different. They are holding data for fifteen years against no defined future use, without ever making an explicit decision to hold it. That is not strategy. That is optimism with a storage and liability bill attached. Passive accumulation is deferred liability with a narrative attached.

Agents are the first technology that will systematically attempt to close the 80%. That is precisely where the governance gap stops being latent and becomes structural failure. When agents begin reasoning over data that was never formally defined, never grounded in a shared semantic layer, and never governed by rules specifying what actions it authorizes, the 80% that never closed the loop does not become valuable. It becomes a source of wrong decisions at scale.

In 2006 and 2007, in work conducted for the Norwegian Oil Industry Association and developed with colleagues at Epsis, we quantified what that figure implies at the organizational level. The potential value we identified was NOK 300 billion on the Norwegian Continental Shelf alone. The value lost between 2005 and 2007 because implementation lagged the opportunity was NOK 14 billion. The data was not wrong. The pace of organizational transformation lagged the opportunity.

The 82/18 finding from that work has held across twenty years of subsequent analysis. Eighty-two percent of the value potential in digital transformation comes from capabilities that did not exist before. Eighteen percent comes from efficiency gains on existing capabilities. Most transformation programs today budget for the 18%. The precise ratio is specific to that study and that industry. The direction is not. In any significant transformation, the value of new capability substantially exceeds the value of efficiency gains on existing processes.

Semantic infrastructure is what makes the rest possible. In the agentic era, it is also what makes the 18% safe. Agents do not absorb ambiguity the way humans do. Even efficiency gains on existing processes require the same governance foundation.

HPE CFO Marie Myers demonstrated this at the operational level this year, cutting her financial reporting cycle by 40%. She named the real constraint directly: not the model, but the quality and accuracy of the data. The investment came first in consolidating data into a single fabric and engineering deterministic outputs. The speed reduction followed. And her biggest lesson after a year of implementation? Change management, not technology.

The loops run on different clocks. Control systems in split seconds. Field operations in minutes. Asset management in months. Field development in years. Real-time is a technical specification that collapses all loops to a single latency standard. Right-time is a governance requirement. The time constant of each loop is owned by the decision domain it governs: control systems engineers at the real-time end, process owners and operations managers in the middle, business owners and the C-suite at the strategic end.

The CDO owns none of these time constants. What the CDO owns is the data quality requirement that translates each one into a timeliness threshold the agent contract enforces. An agent operating on data that has passed its window is not operating on current intelligence. It is operating on history. The threshold is enforced before the agent acts. Not by the agent.

Goldschmidt identified the sharpest version of this: who models which decision will consume which signal, under which condition, with whose authority, before the first agent runs? In most organizations, nobody owns that question. That is precisely the mandate gap the CDO v3 role is designed to close.

Agents do not change the structure of the loop. They change its speed. At machine speed, every governance assumption that depended on human judgment at each stage fails simultaneously. The analyst who knew which revenue definition to apply. The field engineer who recognized that “maintenance event” in one system meant something different from the same term in another. The supply chain manager who knew which supplier approvals required additional verification before the agent acted. Those human translators are no longer in the loop by design. The semantic infrastructure either supplies the judgment they provided, or the loop produces wrong outputs at scale.

This is why governance and value creation are the same function. The CDO who builds the semantic infrastructure that enables agents to close the loop at machine speed is not performing a governance overhead function. She is the precondition for the 82%.

The mandate that holds

The DAMA disciplines are necessary. They are not sufficient. They address data. The agentic era requires someone to address meaning.

The CDO v3 mandate requires three things that neither previous version was designed for.

First, ownership of the meaning layer. This means formal ontologies on open standards that the organization controls, a knowledge graph that encodes institutional IP the organization owns, rather than embedded in a vendor platform it rents, agent contracts specifying scope and authority before deployment, guardrails that enforce those contracts before the agent acts, and provenance that produces the auditable chain a regulator or insurer can examine when they ask what the agent knew, when it knew it, and who authorized it to act.

Second, organizational standing that matches the scope of the function. The CDO mandate crosses every organizational boundary: the CIO’s infrastructure, the COO’s operating model, the BU leaders’ workflows. The only executive with authority over all of those simultaneously is the CEO. A CDO reporting to any single function cannot hold the cross-functional authority the mandate requires. The reporting line is not a prestige question. It is a governance architecture requirement. Without it, the CDO holds an advisory mandate at best, regardless of what the role description says.

Third, explicit deployment gate authority. No agent deploys without the semantic infrastructure being in place: ontology defined, knowledge graph populated, agent contract specified, guardrails connected, provenance wired. This is the structural equivalent of a CFO’s sign-off authority on material financial commitments. It must be explicitly granted in the CDO’s charter, not inferred from the role definition. The CDO who lacks this authority can produce the governance framework. She cannot enforce it. The governance framework that cannot be enforced is a document, not a control.

The CDO who holds deployment gate authority is also the natural accountable person when an agent produces a consequential error. Regulators, insurers, and courts will ask the same question: who defined what this agent was authorized to do, and can you demonstrate it was enforced before it acted. SOX did not create internal controls for CFOs. It made the absence of controls legally consequential. The same forcing mechanism is now arriving for semantic governance, through regulation, through insurance requirements, and through the courts.

In safety-critical industries such as oil and gas, HSEQ made the same journey: from compliance function to board-level mandate with independent reporting and operational veto authority at the C-suite table. The forcing mechanism was regulatory accountability for systematic failures. The organizational design lesson was that safety governance cannot be split across functions. The moment it is absorbed into operations or engineering, the accountability gap reappears. The CDO mandate has the same property.

Boeing is the clearest recent case. It was built on engineering authority at the C-suite level. Then it removed that expertise in favor of financial optimization. Then the 737 Max happened. Engineering expertise is now back at the highest table.

The CFO mandate confirms the same logic from a different direction. CFOs did not build this infrastructure because auditors asked for it. They built it because the organization cannot function without it. CDOs will build the semantic equivalent for the same reason. Not because regulators have finished drafting the requirements. Because autonomous agents cannot be governed without it.

One of the clearest signals boards send about their understanding of the agentic era is the mandate they design. The DAMA disciplines remain. The meaning layer adds to them. Does the CDO report to the CEO? Does she hold explicit deployment gate authority? Those two questions define whether the mandate is designed for the agentic era or inherited from the one before it.

Six questions for the board

The following are diagnostic questions for boards evaluating whether the current CDO mandate is designed for what agentic AI actually requires.

One. Is the CDO’s deployment gate authority written into the governance charter as a formal precondition, with consequences if bypassed? Or does it exist only as informal influence that business units can route around?

Two. Is your CDO allowed to reopen platform contracts when governance sovereignty is compromised?

Three. If a new regulatory requirement changes the constraints under which an agent must operate, can your CDO update those constraints without waiting for a vendor release cycle?

Four. Can your organization demonstrate, for any agent currently in production, which version of the semantic layer was in force when a specific decision was made, what constraint was applied, and who had authority to change it at that time? That chain of custody is what a regulator examines and what an insurer requires before it pays a claim.

Five. Does your CDO report to the CEO? If not, who in the current reporting structure has authority simultaneously over the CIO’s infrastructure, the COO’s operating model, and the BU leaders’ workflows? Because the CDO’s mandate crosses all three, and the authority must come from somewhere.

Six. Once an agent is live and acting, does a named executive hold the authority to halt it within seconds, on their own signature, without convening a committee? A gate that governs deployment is not the same authority as a hand on the switch during operation. If the mandate does not grant unilateral halt authority, with reinstatement requiring a second signature, the organization has oversight that arrives only after the loss.

If the honest answer to any of these reveals a gap, the gap is not in the CDO’s capability. It is in the mandate design.

The organizations that will govern agentic AI successfully are not the ones that deploy the most agents. They are the ones that established the governance infrastructure before the first agent acted. That window is closing. The organizations with agents already in production and no answer to any of these questions are operating autonomous systems without the governance infrastructure the agentic era requires. The consequences of that are not visible in the deployment announcement. They surface when the loop produces a wrong output at a moment when the cost of being wrong is not recoverable.

Subscribe now

Next in this series

Article 3b, The Stack the CDO Must Govern, maps the Agentic AI Capability Stack: what the CDO must own at each layer, and where every major platform currently falls short. Now published, together with Article 3c, When the Container Fails.

About the author

Frédéric Verhelst, PhD (Applied Physics, Delft) helps leadership teams build the foundations for trustworthy agentic AI. Twenty-five years at the intersection of data, AI, and industrial operations: Head of Data Office at TotalEnergies EP Danmark; digital strategy, value case, and improved production potential for the Tyra Redevelopment at Mærsk Oil, with Shell and Chevron as joint-venture partners at FID, continued through the TotalEnergies acquisition; Inpex Ichthys IOC implementation; integrated operations centres across operators. Currently at Viking Life-Saving Equipment, where agentic AI governance for mission-critical safety operations is taking shape. He serves as an executive advisor to boards navigating agentic AI liability, and partners with C-suites on the design of Chief Data Officer mandates that ensure trustworthy, insurable AI operations. He is currently accepting advisory engagements and non-executive director (NED) appointments focused on corporate AI governance.

Follow him on LinkedIn for the latest posts in The Ontology Imperative: Building Trustworthy Agentic AI, and on Substack for the CDO Playbook.

A note on sources

Several arguments in this article were sharpened through discussions with practitioners and commentators on the series. Their contributions are embedded in the argument, not footnoted to it.

The Ontology Imperative - Building Trustworthy Agentic AI: The Mandate

3c – When the Container Fails: Vertical Integration, Liability, and the CDO Mandate in Practice

Where this article picks up

When the silent premise fails

The discipline already exists

The market has already priced the silent premise

Governance can operate around the attribution gap

The delegation model

Why the C-suite reporting line is structural

The RACI objection, and why it dissolves

The CDO that is emerging

Six questions for the board

Closing the series, opening the practice

About the author

A note on sources

Further reading

Companion artefacts

The sovereignty argument and the Tesla case

The discipline already exists

The April 2026 insurability signal

The April 2026 technology and frontier-lab signals

The CDO mandate and operating-model evolution

Agentic architecture and the attribution question

W3C open standards this stack prescribes

3b – The Capabilities the CDO Must Govern

Four steps that named the layer and left the owner unnamed

Where the stack comes from

Four zones. Three boundaries.

The eleven layers

The two structural gates

The minimum viable ontology

Four dimensions of ownership

What this piece establishes, and what follows

About the author

A note on sources

Further reading

The Stack the CDO Must Govern

Companion artefacts

The IO Capability Stack lineage

Contemporary references for the opening claim

The semantic web lineage

The Stanford research on LLM overconfidence

The W3C 2008 architectural precursor

The CDO mandate

W3C open standards this stack prescribes

Open connectivity standards at Layer 8

3a – The CDO Mandate: Custodian of Enterprise Knowledge

The paradox that ends careers

Why the mandate keeps dissolving

The 12th discipline

Agents need contracts, not onboarding documents

The architecture decision

Who owns the operational graph?

Cross-organizational governance

The value loop

The mandate that holds

Six questions for the board

Next in this series

About the author

A note on sources

Further reading