The undertaking with no home
By Monday morning, nearly everyone believes the launch decision is finished. A company is preparing to introduce an important new service for a large customer. The commercial case is strong. The customer has built its own plans around the date. One vendor, however, cannot quite satisfy a security requirement in the form the company normally expects.
The details are composite, but the predicament is familiar: real companies live by standards, and they also live where standards meet unfinished facts. A vendor may offer a compensating control. Counsel may revise a clause. A risk may be accepted by someone with the authority to accept it. A launch may proceed under a condition—or wait until the condition is met.
No one in this company is trying to take a shortcut. The security lead has described the gap and proposed a mitigation. Counsel has negotiated language that allocates responsibility more clearly. Procurement has collected the vendor’s attestations. Finance has estimated the cost of delay. The product leader is trying to keep faith with a customer. Each person has done a recognizable part of the work.
The wording is ordinary enough to be dangerous. Counsel’s redline says that the mitigation must be in place before customer data is processed. The security ticket shortens this to “verify before go-live.” In the steering deck, both have become a green status cell: Exception approved.
The contract has been revised. Security has reviewed the vendor’s material. The business sponsor has promised a date. A model has read the principal documents and produced the summary everyone wanted: the exception was approved, the remaining risk was acceptable, and the launch could proceed.
The summary is useful. It is shorter than the email chain, clearer than the ticket history and easier to carry into a meeting than twelve open documents. It gives the people around the table a common account from which to act. That is why the mistake matters. The summary does not look irresponsible. It looks like relief.
Then the security lead notices what has disappeared. The latest screenshot from the vendor console still marks the mitigation planned, not verified.
Counsel approved the revised clause only on the condition that the mitigation be in place before customer data entered the system. The executive who accepted the exception remembers accepting a limited risk, not authorizing a launch without that verification. He reads the summary again.
“That is not what I approved.” The model’s account is fluent, useful—and wrong at the point where language is about to become action.
Someone asks the question that the company’s systems ought already to answer:
Where, exactly, is the work?
The model conversation has the persuasive account but not the authority behind it. The contract repository has the documents but not the state of the decision. The security ticket, approval workflow, email chain, vendor questionnaire, meeting notes, and launch plan each hold a part. None can establish alone what the company has accepted, what remains unresolved, who can decide, or whether the launch has become permissible.
The company has abundant information and process but cannot reconstruct the launch decision without interviewing the people who carried its conditions across those systems.
Such a place would have to preserve more than files. It would have to know which purpose governs when speed and security pull in different directions; which version of the contract controls; what the executive actually authorized; which condition remains open; what action is unavailable until that condition is met; and which record the institution will stand behind six months later.
Before generative AI, people often carried this unity by memory, professional habit and repeated conversation. That was expensive and fragile, but the seams were usually crossed by people who could notice when something had been lost. A model can now gather the fragments, give them one fluent voice and return that account to systems that act. The old absence has acquired a new force.
The organ and the body
The model became the visible center of modern artificial intelligence for a simple reason: it speaks. A database does not lean forward and explain itself. A workflow does not draft the memorandum that carries a decision into the next meeting. A permissions service does not compare six documents, notice an ambiguity and propose a way through it. A frontier model can do all of these things with astonishing speed. It can make scattered material feel whole for the length of an answer.
Indwel’s ambition is to put that power to work without confusing fluency with ownership.
In the launch decision, the model is an organ of cognition. It can read, compare, infer, criticize and compose. It may notice a relationship that every human participant missed. It may save days of labor. Yet it did not originate the company’s purpose. It cannot lawfully amend that purpose. It cannot decide, by its own authority, which source the institution may rely upon. It cannot erase an open condition because the condition makes the answer untidy. It cannot grant its conclusion permission to expose customer data. It cannot declare the undertaking settled merely by reaching the end of a response.
Those offices belong to the cognitive act around the model: the people carrying responsibility, the records they may rely upon, the authorities under which they act, the obligations still open and the consequences that follow.
The present generation of generative-AI systems understandably drew attention first to the model. The breakthrough was inference at extraordinary scale, so the first questions concerned the model’s behavior: how to improve its answers, ground them in retrieved material, keep harmful outputs within bounds, give the model tools and place a human before certain actions. The surrounding systems have grown steadily more capable.
Much enterprise AI engineering still takes the artificial participant as its unit of design. We govern what the model may see, what it may say, which tool it may call and whether a person must approve the call. Each new power receives another ring of control.
Indwel starts with the undertaking those powers have entered. What must remain true of it when the model makes its next contribution?
For the launch team, the relevant unit is the decision whose conditions must survive the model’s next answer.
Where the work goes when it has no home
When an undertaking has no constitutional home, we place it in the nearest available object. The choices are sensible. Each keeps something the work needs. The trouble begins only when one part is asked to carry the whole.
Language and material
A conversation preserves language. It lets someone explore a question, discover what matters, and sometimes decide that no further undertaking is needed. That is complete and legitimate cognition. A workspace or collection can give the material continuity across sessions and make it available to others. These are powerful forms for research and collaboration.
When the inquiry becomes a consequential business undertaking, those forms alone do not establish which purpose governs, which version of the contract controls, or whether a retrieved document has been admitted as Evidence for the proposition now in dispute. A conversation can end with a confident answer. A collection can contain every relevant file. The mitigation can still disappear between them.
A library can preserve the material without resolving what the institution is entitled to conclude from it.
Execution and control
Agent runs, traces and workflows preserve a different part of the undertaking. A run can show the model’s plan, tool calls, observations, approvals and result. A trace can tell us what the software did, at what cost and in what order. A workflow can require approvals, route exceptions and enforce repeatable steps.
These mechanisms are indispensable. They can also operate perfectly upon the wrong account of the work. The trace may faithfully record that the model omitted the verification condition. The workflow may then advance because the incoming state says “approved.” The systems have preserved execution and control. They have not preserved the meaning counsel and security attached to the decision.
An exact execution trace can still misstate what the company was entitled to do.
Enterprise representations and cases
Knowledge graphs, digital twins and enterprise ontologies can represent the vendor, contract, control, customer and service as related parts of one operational world. Case-management systems come closer still: they gather documents, participants, tasks and milestones around a knowledge-intensive objective, while allowing qualified people to choose among legitimate next actions as circumstances develop.1
These systems come close because they hold more of the enterprise together. Even so, a representation of the enterprise is not the same thing as the undertaking the enterprise is trying to finish. A case may record that an approval occurred without preserving the Evidence and open burden that made the approval conditional. It may close because the process has ended even though the proposition at its center remains unverified.
An enterprise platform may display an objective field, documents, an approval button and an audit log. The harder test is whether those elements remain one constitutional state. Does the Objective survive later instructions? Is available material kept distinct from Evidence the institution has admitted? Can a completed task remain visibly different from a settled undertaking? Will the open burden survive the pressure—human or artificial—to make the work look finished?
Conversation, collection, run, trace, workflow, graph, twin and case can all serve serious cognition. The governed body of work is the thing they are serving: the undertaking whose identity, purpose, evidence condition, unresolved obligations, authority, causal development and terminal disposition must remain joined.
The work has always been larger than the worker
Long before a language model could join a meeting, several disciplines had learned that serious cognition does not fit inside one mind or one machine.
Consider the bridge of a large ship, the setting Edwin Hutchins studied in Cognition in the Wild. The ship’s position does not sit whole inside one navigator’s head, waiting to be spoken. Bearings are taken at different stations, called across the bridge, entered, transformed, plotted on a chart and checked through procedures carried by people with different responsibilities. Instruments, paper, speech, rank and trained habit all participate. No single person performs the entire computation. The navigation team knows where the ship is because the organized system keeps the information moving without losing what it means.2
What matters is not simply that several people take part. Each representation has a disciplined office. A spoken bearing becomes a written mark; the mark is plotted; the plot is checked; the result enters a decision by someone authorized to use it. If one transformation loses its meaning, the later precision of the chart cannot recover what was lost. The cognitive system succeeds because its handoffs preserve both information and office.
The launch decision is less dramatic, but structurally familiar. Counsel carries the force of a condition in a redline. Security carries the state of a mitigation in a ticket and a console. The executive carries the scope of the authority he exercised. The model carries an interpretation across documents. The steering deck carries a compressed status into the meeting. Cognition is already distributed. The question is whether the distribution preserves the undertaking or merely passes fragments of it along.
Later work on distributed cognition brought Hutchins’s insight directly into human–computer interaction. The design problem is not only what one user knows. It is how representations move, change form and coordinate action across people and artifacts.3 Lucy Suchman supplied the complementary warning: plans are useful, but they do not exhaust the situated course of work. People meet particulars, repair misunderstandings and act within circumstances no prior script fully contains.4 The plan remains; reality arrives.
Cognitive systems engineering therefore treats people and technology as a joint cognitive system. Its concern is not simply whether the machine behaved correctly or the human followed procedure. It asks whether the combined system maintained control under real conditions.5 That question belongs at the center of enterprise AI. A model can operate exactly as designed while the wider system loses the distinction between evidence and assertion, proposal and authority, progress and completion.
Organizational routines and case-management research add another part of the picture. A routine has a prescribed form, but it also has a performed life: particular people interpret it in particular circumstances, preserving capability while adapting to what happens.6 Knowledge-intensive cases likewise cannot always be forced through one predetermined sequence. They advance through authorized judgment about what may legitimately happen next.7
Records scholarship insists that the resulting work leave durable evidence whose authenticity, integrity, usability and context survive organizational and technological change.8 Provenance standards give us a language for the entities, activities and agents involved in producing information.9 Systems engineering completes the inheritance with an end-to-end demand: some properties can only be guaranteed at the layer that possesses the meaning required to guarantee them.10
Together, these traditions tell us that the relevant unit is a working system; that action exceeds its plan; that judgment occurs within circumstances; that records must retain context; and that a whole-system property must be held at the level that understands the whole.
They also warn us against confusing representation with custody. The map may omit the circumstance that matters. The routine may be performed differently from the rule. The case may contain all its documents and still conceal a disagreement about what they establish. The record may be authentic and irrelevant. A provenance chain may be complete while the resulting action remains unauthorized.
Here constitutional describes an order of responsibility, not a metaphorical courtroom. The institution has rules and delegated offices before a model arrives. Those rules must retain force as documents are interpreted, proposals are weighed, and decisions acquire consequences.
Indwel applies this inheritance to software. Organizations have long depended on distributed judgment. What changes with generative AI is the speed and authority with which a single persuasive account can cross boundaries that once required separate human interpretation. The undertaking needs rules those crossings cannot silently discard.
A body of work, governed
A body of work ordinarily means related activity considered over time. Here the phrase has a more exact meaning.
A governed body of Work is an identifiable undertaking whose purpose, current state, applicable authority, and outstanding obligations remain intelligible as cognition proceeds. It may be personal or organizational, exploratory or consequential, brief or enduring. When it carries responsibilities beyond the moment, its continuity must preserve what those responsibilities mean—not merely the words exchanged along the way.
A Work Instance may draw on documents, workflows, models, agents, graphs, and case-management systems. Conversations, runs, traces, applications, and external systems may contribute without becoming the undertaking itself. Nor does every conversation need to produce a Work Instance.
For the corporate launch in our example, the organization is sovereign over its business decision. The Work carries that particular undertaking under the organization’s authority. A personal investigation may instead belong to an individual, without the fiction of a corporate mandate.
That distinction matters. To call organizational Work constitutional is not to turn a business matter into a miniature state or to make the undertaking sovereign. It means that established authority governs the purposes, Evidence, offices, capabilities, and conditions under which the institution may change its state. A person exploring an idea alone need not carry the apparatus of a corporate launch review. The safeguards should match the undertaking and its possible consequences.
Indwel names the enduring institutional law the Cognitive Constitution. A Cognitive Contract resolves the executable constraints applicable to the work at hand: what cognition may admit as Evidence, which participants and capabilities may contribute, where authority is required, and how consequential effects and Settlement are governed. The Objective is a different matter: what the particular undertaking seeks to achieve and how success would be recognized. The two must not silently exchange offices.
An organization can define recurring kinds of Work rather than reinvent each case. A versioned Work Definition might specify what constitutes a Vendor Risk Review, which material it requires, and what completion would mean. A Work Catalogue lets people find recognized undertakings in the organization’s own terms; selecting one is not itself authorization to initiate it. Neither the definition nor the catalog is the Work Instance now under way; neither supplies the Cognitive Contract. A useful practice discovered in personal Work may be proposed for wider use. It becomes institutional practice only through authorized adoption at the applicable scope; a team cannot confer organization-wide authority merely by publishing a definition.
In organizational Work, authority may be inherited through the organization, department, team, project, and more particular scopes. What is adopted above may be narrowed below, not silently enlarged by a model, agent, user request, or application. A local instruction does not become organizational law because it is fluent or convenient.
What keeps the undertaking whole is therefore more than persistence. A transcript can survive for years and still confuse a retrieved sentence with admitted Evidence, a recommendation with authority, a successful tool call with an observed effect, or a finished task list with Settlement. The test of continuity is whether the condition still governs the next decision, not merely whether the conversation can be replayed.
For consequential institutional Work, the current state has to remain legible: proposed, disputed, conditionally authorized, awaiting Evidence, permitted for action, partially settled, refused, or reopened. Those labels are useful only if the institution can also inspect why the state is justified—which Evidence mattered, what inference contributed, who had authority, which burden was discharged, and what effect was actually observed.
Where the Work must persist, a new participant should inherit its governed state rather than reconstruct it from old messages. A replacement model may re-examine the Evidence, but its different summary cannot alter the adopted authority. Portability among clouds, connectors, and application surfaces is a demanding engineering claim: the meaning of the Work has to survive each real crossing, not merely appear in a shared schema.
The test arrives after the meeting. Can the next reviewer identify the governing purpose and the Evidence admitted for each disputed claim? Is the verification condition still open? Does the state distinguish an authorized decision from a requested action and its observed effect? The answers cannot depend upon a fresh model improvising the history.
The colleague joining the launch on Tuesday should inherit the open verification condition, not merely a summary that calls the exception approved. Responsibility becomes more practicable when its present burden can be found.
The same undertaking on Tuesday morning
On Tuesday morning, the vendor exception is still the same undertaking, although its Evidence, participants, and available capabilities may already have changed. The team might have reached it by choosing Vendor Risk Review from a Work Catalogue, receiving an assignment, or beginning in ordinary Conversation and recognizing that a vendor exception needed its own decision. Those entrances need not determine how long the Work will last.
The company has not begun with a blank prompt. Its adopted policies, accountable officers, contractual duties, delegation limits, records obligations, and operational constraints already exist. The resolved Cognitive Contract must reconcile the authorities that apply to this undertaking, including lawful requirements from intersecting organizational scopes; no conversation, recognition, or catalog selection can create a missing approval.
The executive responsible for the launch then adopts a concrete business purpose: introduce the service for the waiting customer by the agreed date, provided that security and contractual obligations are satisfied or lawfully excepted. An earlier conversation could have helped formulate that purpose; the model’s suggestion would not itself have authorized it.
Indwel calls this the Objective. The capital letter identifies the purpose being tracked for this undertaking. During exploration the purpose may remain provisional. Once the organization adopts it for a consequential decision, amendments must respect the authority resolved for that Work. A model may propose a clearer formulation or expose a conflict. It may not quietly redefine the undertaking as “launch as quickly as possible.”
The contract, security questionnaire, architecture diagram, vendor attestations, meeting notes, cost estimate, and live system observations enter as Sources. Sources are material available to cognition. Availability is not standing. Adopted internal policy also supplies governing norms, which must not be mistaken for case-specific proof that the mitigation is operating.
Particular material is admitted as Evidence for particular propositions. The vendor’s attestation may support the claim that a control exists. An independent test may bear more strongly upon whether it works. The contract may establish what the vendor promised. Policy may establish the company’s requirement. Legal advice may govern how the clause is understood inside the company’s authority structure.
This is where the Evidence Firewall matters. Modern systems are extraordinarily good at putting material near a model. Indwel asks a different question: what may this Work rely upon, for which proposition, under what provenance, freshness, and limitation? When a reasoning-critical fact is missing, governed acquisition can seek an authoritative source. The model’s recollection may suggest what to look for; it does not become Evidence by being remembered confidently.
The materials conflict. The vendor says its compensating control addresses the risk. Security agrees the control is plausible but says the configuration has not been verified. Legal approves revised language on the condition that verification occur before production data is introduced. The sponsor reports that delay may jeopardize the customer commitment.
The Work has reached a Frontier: the edge between what is established and what remains open. The immediate burden is to verify the promised mitigation before any launch transition that would expose production data. In a properly governed implementation, that burden would remain open until the required proof arrived, regardless of how persuasively the model argued for proceeding.
Now inference enters. One model reads the admitted Evidence, compares policy and contract, drafts a risk analysis, and proposes a sequence. Another may challenge its interpretation. Specialist inference may examine technical material. Governed retrieval may bring forward additional sources. A model may calculate the commercial cost of waiting, identify an alternative vendor, or discover a contradiction no one had noticed. This is serious cognition, and its output remains contribution.
Suppose a model writes: “The exception has been approved and the launch may proceed.” The sentence compresses three different states. Contractual wording was approved. Residual risk may have been accepted conditionally. Verification has not occurred. The summary turns a conditional path into an unconditional conclusion.
A conventional stack may now behave deterministically. The workflow sees “approved” and advances the gate. Identity confirms the executive’s role. A deployment tool receives valid credentials. An audit log records every step.
Nothing need malfunction locally. The constitutional error occurred when a probabilistic representation was allowed to become authoritative state.
Indwel’s constitutional design requires that crossing to be mediated by the Inference Firewall, Cognitive Governors, and governed transition authority. Generation is not commitment. In the example, the approved condition must remain in the state used to authorize production data; if its verification is still open, the transition must not proceed. This is an architectural obligation, not evidence that every deployed connector or customer environment has already demonstrated the property.
A security engineer later verifies the mitigation. The observation is admitted as Evidence against the open burden. The state changes because a governed transition permits the burden to be discharged. The Contract has not prescribed every intellectual step; it has governed the boundary at which intelligence may acquire consequence.
Notice the practical possibility. The model can compare rival interpretations or propose a revised mitigation without making either authoritative. An engineer can test the precise unresolved claim instead of reopening the entire launch decision. The executive can reserve his attention for the transition that actually requires it. These are consequences the design must demonstrate, not benefits established merely by describing the separation.
If an authorized decision-maker grants the exception, the governed action boundary carries the decision toward consequence. Permission, request, provider acceptance, actual effect, and observation remain different states. A successful external API call is not automatically proof that the intended institutional effect occurred.
Only then does Settlement determine what the Work may legitimately become. Settlement might establish that the exception is accepted for a defined period, the verified mitigation must remain active, the service may launch for the named customer and data class, a review is due on a specified date, and broader deployment remains unauthorized.
A Receipt preserves the authority, Contract, Evidence, inference, transition, effect, unresolved obligations, and reasons for that state. The Chronicle carries the Work forward. If the vendor later changes its architecture, a vulnerability appears, the exception expires, or a different model reanalyzes the matter, the institution does not begin again from a pile of conversations. Temporal Cognition, scheduled Work, and Watchpoints can reopen the same undertaking when the future condition arrives.
Meanwhile Work Briefs, governed Memory, durable cognitive artifacts, and explicit context selection let a new participant inherit the real state without promoting every remembered formulation into Evidence. The intended Executive should ask for human judgment when that judgment will materially advance the Work, carry useful reasoning across sessions where warranted, and identify reusable patterns without laundering one undertaking’s material into another. Whether it does this reliably must be tested on the actual intermediate reasoning, source admission, decisions, and user-visible result—not inferred from the presence of a workflow or receipt.
The undertaking has outlived the meeting, the workflow, the model, and the Tuesday on which any one of them happened.
The seam where language becomes state
The most important moment in the case is not the model’s factual error by itself. Models make errors, and human beings do too. The critical moment is the seam at which an interpretation becomes institutional state.
A rule can be perfectly deterministic and still govern the wrong account of the work.
A control at one segment cannot protect a meaning that has already been changed at another.
A policy engine may reliably enforce the policy it is given. An approval service may reliably verify the role of the person who clicked. A tool gateway may reliably reject forbidden parameters. An audit system may reliably preserve the resulting events. Yet if a model has already changed the represented Objective, promoted context into Evidence, erased a burden, selected the wrong policy branch or declared an unfinished state complete, those deterministic mechanisms may preserve and execute the mistake.
The engineering follows a familiar rule: a system-level guarantee is only as strong as the material paths through which the protected state can change. Correct controls in several components do not cover a seam that lies outside them.
That is why one critical seam matters. The company may govern retrieval well, require a human approval, restrict the available tool and preserve an excellent audit trail. If the model can still turn a conditional approval into an unconditional state before those controls receive it, the constitutional property has already been lost for that execution. Later controls may detect, contain or correct the failure. They cannot make it true that the unauthorized transition never occurred.
Computer security has long expressed a related principle through complete mediation: protected operations must pass through an authoritative enforcement point rather than relying on an earlier check that may no longer describe the present state.11 System safety reaches the same conclusion from another direction. Harm can arise from inadequate constraints among components that are each functioning locally as designed.12
For a cognitive undertaking, the protected properties include purpose, authority, Evidence, unresolved burdens, consequential action, Settlement and terminal truth.
The model need not become predictable in every word. What must be predictable is the boundary at which its words become institutional state.
The seam is the difference between generation and commitment. Generation may be probabilistic, expansive and even unruly. Commitment changes the governed state of the undertaking. A model may offer ten interpretations; the constitution decides whether any one of them is admitted, which burden it changes, whether it affects capability and whether it may enter terminal truth.
Engineers already rely on this separation. A database may calculate candidate changes before a transaction commits. A compiler may explore transformations before producing an executable. A safety system may permit rich internal behavior while tightly constraining the boundary at which that behavior can affect the world. Sovereign Cognition applies the same seriousness to institutional meaning.
The model may explore boldly inside its office. It may propose several interpretations, argue with the current view and uncover something no person noticed. What it may not do is authenticate its own proposal into authority, Evidence or settled fact.
Inference is freer to be useful when it is not asked to impersonate institutional authority.
The systems nearest the boundary
Modern case and workflow platforms already govern sequences, roles, approvals and exceptions. Some now place AI agents inside deterministic orchestration, letting probabilistic reasoning handle ambiguity while a process engine governs execution.13
Enterprise ontology and decision-intelligence platforms connect operational data, business objects, permissions, logic and action. Palantir’s Ontology, for example, makes an enterprise’s operational world legible and executable; its AI platform adds human review and controlled action around model-assisted work.14 Aera, C3 AI and Quantexa bring together other strong combinations of enterprise context, decisions and governed execution.
Agent control planes and durable runtimes preserve another important part of the picture. They can checkpoint state, pause for approval, enforce tool policy, retain traces and resume long-running work. LangGraph, the OpenAI Agents SDK, Microsoft’s agent frameworks, Google’s agent platform and Amazon’s AgentCore all move agent systems toward greater operational control.15
The launch decision may already touch a contract system, a security platform, a ticketing service, an approval workflow and an agent runtime. Each product can perform its own office well. The risk lies in the handoff. Counsel’s condition may leave the contract system as an untyped comment. A security control may travel onward as “planned” when the next system expects “verified.” A model may compress both into “approved.” The workflow can then behave exactly as designed and still carry the wrong state forward.
Successful integration moves more than data. It carries the constitutional meaning of the data across the move.
A workflow can insist upon approval. An ontology can relate the vendor, control, contract, customer and service. A control plane can restrict an agent’s tools. A governance suite can inventory models and risks. The undertaking still needs continuous custody of the authorized purpose, admitted Evidence, open mitigation, permission to launch and final disposition.
That custody need not require a monolith. An enterprise may compose several excellent systems. But the Cognitive Constitution must then remain enforceable through the contracts between them, and every material handoff must preserve it. If a model, integration or human summary can turn a condition into an approval between components, the company no longer has one governed undertaking. It has several locally correct systems exchanging an institutional mistake.
The point of the design is to keep these controls attached to the same undertaking when the work moves among systems. Retention, provenance, approvals, and workflow each contribute something necessary, but the critical property is continuous custody of what the institution has actually decided and what it has yet to establish.
What the missing custody costs
The missing object rarely appears on a balance sheet under its own name. The company sees its effects elsewhere.
The executive asks counsel and security to reconstruct the approval before signing again. Counsel re-reads documents because the summary cannot be trusted. Two teams act upon different versions of the same approval. A customer receives a promise before its condition is satisfied. An auditor can reproduce system events but cannot explain why the institution believed it was entitled to act.
The direct error may be costly. More often, the expense accumulates quietly. A second meeting is held to recover the first. An analyst compares a generated summary against the source material line by line. Senior people perform clerical archaeology because the institution cannot safely rely upon its own account. A tool saves ten minutes of drafting and creates an hour of consequential review.
The organization pays again for cognition it believed it had already completed.
The time spent rebuilding the approval rarely appears in an AI cost calculation. It is scattered through legal time, security review, executive attention, customer delay and the quiet reluctance of capable employees to trust the new system at the moment of consequence. A pilot can look efficient while the organization around it absorbs the unfinished work.
There is also a cost to caution. When the institution cannot see which condition is still open, it tends either to move too quickly or to stop everything. Responsible people ask for broad re-review because they cannot isolate the live burden. Controls multiply around entire classes of work because the system cannot state which particular transition is unsafe. The company becomes slower not because its standards are too high, but because its account of the undertaking is too weak to support a precise decision.
The same weakness burdens adoption. Employees learn that an AI answer is useful only until the moment somebody must rely upon it. They then recreate the old process beside the new one: the model drafts, while the people quietly rebuild the evidence, authority and history. What appears to be automation becomes an additional layer of production whose output must be governed somewhere else.
The model’s invoice may be small. The organizational bill arrives elsewhere: verification, correction, reconciliation, delayed decisions, failed actions, audit reconstruction and retained risk. Cheap output is not necessarily cheap work.
Dependence upon a model or conversation adds another cost. When the provider changes, the practical meaning of the undertaking has to be reconstructed from language. When a new model reaches a different conclusion, the institution has no independent constitutional state against which to judge the difference.
Custody can reduce the cost of reconstructing decisions, but cost reduction remains a claim to test, not a saving established by this essay. The stronger proposition is operational: the company should be able to move forward on what it has actually established, ask for the missing proof instead of restarting a whole review, and avoid treating unfinished reasoning as an authorized outcome.
Indwel begins with the undertaking
Indwel began with a practical conviction: consequential cognition should remain answerable to the authorized organization whose purposes, duties, and authority give the cognition standing. We kept meeting the same problem in development. A model would do something genuinely impressive, yet the undertaking around the answer remained dispersed. Purpose lived in one surface, sources in another, an unresolved burden in somebody’s memory, policy in a document beside the system, and authority to act somewhere else again. The answer was good. The Work was still homeless. Indwel OS takes that dispersion as its governing design problem.
The organization adopts the Cognitive Constitution. The resolved Cognitive Contract governs cognition at the relevant scopes; the Objective belongs to the particular undertaking. When a matter requires continuity, its Work Instance must preserve the Evidence, outstanding burdens, authority, actions, and reasons for the state that follows.
Across conversational interfaces and enterprise applications, the governing authority for Work remains with the accountable system, not with any one screen. An interface may present a decision; it cannot confer authority that the institution has not granted. Whether a matter begins in conversation, through a catalog, by assignment, or in an application, its inherited authority must remain the same. Cross-surface fidelity is a release requirement to be verified against actual behavior.
People should be able to begin in ordinary language. Cognition can clarify purpose, identify ambiguity, and propose next inquiries; the governing system must distinguish what a person has asked for from the authority that the request actually carries.
A retrieved clause is not automatically admitted Evidence. Memory can aid continuity without supplying authority. A brief may help the next participant understand the case, but it cannot replace the actual state of approval and obligation. The distinction matters when a persuasive summary is easier to find than the condition it omitted.
Inference is equally plural. The architecture is designed to admit different inferential faculties—general and specialist models, deterministic computation, and human judgment—without transferring the Work’s governing authority to any one of them. Deployment-specific options, including private inference, require independent operational proof. Model substitution should not silently change the law that governs the undertaking.
The architecture also distinguishes recommendation from capability and capability from effect. Tools, connectors, and enterprise systems can participate only under applicable permissions and inspection. A request sent to an external system is not proof the requested change occurred. Settlement has to account for what was actually observed, what remains unverified, and who may treat the result as institutional fact. Particular integrations and inspection controls cannot be represented as available or physically qualified solely because this architecture requires them.
The design gives each contributor a defined relationship to the Work. That matters most when an apparently successful answer, approval, or tool invocation would otherwise be mistaken for an accomplished institutional result.
In the launch example, the benefit would be less reconstruction and more useful judgment. Security could isolate the verification still missing. Counsel could see that approval remained conditional. The sponsor could act on a precise statement of what he may decide next. A later reviewer could follow the result back to the Evidence and authority that supported it.
The longer-term prize is independence from any particular model’s interpretation of the undertaking. If a provider, agent framework, cloud, or application changes, the new participant ought to inherit the institution’s existing decisions and limits. Whether a specific migration satisfies that standard remains a matter for end-to-end proof.
The model can be an extraordinary contributor. For organizational Work, the institution still owns the law and decisions that give its contribution standing. Where obligations endure, the Work must carry them.
The work remains
On Monday morning, the executive should not have needed to say, “That is not what I approved.” The condition should never have disappeared from the Work.
None of this requires perfect people or infallible models. Evidence will remain incomplete. Judgment will remain difficult. Policies will conflict. Business will remain uncertain. A governed body of Work offers something more useful than a promise to remove those realities: it keeps purpose, law, Evidence, uncertainty, authority, consequence, and continuity joined long enough for responsible cognition to occur.
The participants may change. The model may change. New Evidence may warrant another judgment. The Objective may be lawfully amended. A future Watchpoint may reopen the matter. What should not change by accident is the identity of the undertaking or the constitutional history that makes its changes intelligible.
The next person should inherit the real decision—including the condition that kept it open.
Organizational Work does not create its own sovereignty. Its authority descends from the institution and its adopted law. Personal Work has a different owner; neither kind gives a model the authority to rewrite what has been undertaken.
The requirement is continuity proportionate to consequence. An inquiry may remain Conversation. A short-lived undertaking may end without acquiring a permanent case history. But where a decision will bind people, alter a system, or survive a meeting, the Work must keep its open conditions and governing authority intact. The accompanying essay Objective Before Probability turns to purpose: how a model can help discover what an institution wants while leaving the adoption of consequential Objectives to the people with authority to decide.
Working glossary
Authority—the legitimate capacity to adopt or amend an Objective, admit a consequential transition, authorize an effect, or determine Settlement within the applicable scope.
Body of Work—an identifiable undertaking, brief or persistent, whose meaning and obligations remain coherent for as long as its purpose and consequences require.
Conversation—the open cognitive field in which a person may inquire, reason, draft, and discover potential Work, without requiring a Work Instance.
Work Definition—a versioned personal or institutional account of a recognizable kind of undertaking; distinct from its instances, Objectives, and Cognitive Contracts.
Work Instance—the actual undertaking being pursued, whether ad hoc or defined, personal or institutional, short-lived or durable.
Work Catalogue—a navigable institutional vocabulary of versioned Work Definitions adopted for use at their proper scope.
Burden—an unresolved obligation that must be satisfied, preserved, or expressly disposed of before a specified consequential transition.
Chronicle—the continuing account of a Work Instance’s consequential state and history where durability and recordkeeping are warranted.
Cognitive Constitution—the institution’s adopted governing law for cognition and delegated authority, including applicable Evidence, office, capability, effect, Settlement, and continuity rules.
Cognitive Contract—the resolved executable governance for cognition, Evidence, authority, effects, and Settlement under the applicable adopted scopes; distinct from the Definition and Objective of the Work.
Custody—preservation of the meaning and authority that must survive a consequential handoff between people, models, systems, and states.
Evidence—material admitted for a defined proposition under stated provenance, relevance, authority, and limitation.
Frontier—the present boundary between what an undertaking has established and what remains unresolved or legitimately available to do next.
Objective—the outcome an undertaking seeks, proposed or provisional during exploration and authoritative only when the requisite owner or institutional office adopts it.
Commitment—an authorized adoption or material state change; recognition of a potential undertaking is not itself commitment, and permission to act is not proof of effect.
Receipt—the reasoned account of a governed transition, including its authority, admitted Evidence, open burdens, disposition, and resulting state.
Settlement—an authoritative determination of consequential or terminal state, what was established or effected, and which limitations or residual obligations remain; not the final generated answer.
Source—material available for cognition before any claim that it has been admitted as Evidence for a particular proposition.
Notes
Object Management Group, Case Management Model and Notation (CMMN), Version 1.1 (https://www.omg.org/spec/CMMN/1.1/About-CMMN); Wil M. P. van der Aalst, Mathias Weske and Dolf Grünbauer, “Case Handling: A New Paradigm for Business Process Support,” Data & Knowledge Engineering 53, no. 2 (2005): 129–162.↩︎
Edwin Hutchins, Cognition in the Wild (MIT Press, 1995).↩︎
James Hollan, Edwin Hutchins and David Kirsh, “Distributed Cognition: Toward a New Foundation for Human–Computer Interaction Research,” ACM Transactions on Computer-Human Interaction 7, no. 2 (2000): 174–196.↩︎
Lucy A. Suchman, Plans and Situated Actions: The Problem of Human–Machine Communication (Cambridge University Press, 1987), and the later Human–Machine Reconfigurations.↩︎
Erik Hollnagel and David D. Woods, Joint Cognitive Systems: Foundations of Cognitive Systems Engineering (CRC Press, 2005).↩︎
Brian T. Pentland and Martha S. Feldman, “Organizational Routines as a Unit of Analysis,” Industrial and Corporate Change 14, no. 5 (2005): 793–815.↩︎
Van der Aalst, Weske and Grünbauer, “Case Handling.”↩︎
International Organization for Standardization, ISO 15489-1:2016—Information and Documentation: Records Management—Part 1: Concepts and Principles.↩︎
W3C Provenance Working Group, PROV Overview and PROV-O: The PROV Ontology (2013).↩︎
Jerome H. Saltzer, David P. Reed and David D. Clark, “End-to-End Arguments in System Design,” ACM Transactions on Computer Systems 2, no. 4 (1984): 277–288.↩︎
James P. Anderson, Computer Security Technology Planning Study, Volume II (1972), and the reference-monitor tradition that followed.↩︎
Nancy G. Leveson and John P. Thomas, STPA Handbook (2018); Roel Dobbe, “System Safety and Artificial Intelligence” (2022).↩︎
See the CMMN standard and current agentic-orchestration documentation from Camunda and UiPath.↩︎
Palantir Technologies, current documentation for AIP, the Ontology, ethics and governance, and controlled actions.↩︎
Current first-party documentation for LangGraph persistence and human-in-the-loop execution; OpenAI Agents SDK; Microsoft Agent Framework; Google Gemini Enterprise Agent Platform; and Amazon Bedrock AgentCore Policy.↩︎