AIEOM: AI Enterprise Operating Model

The operating model for the AI era · Version 2.0 (Final, after 10 improvement rounds)

Originator and author: Hannok Rallapally (Dallas, TX) Status: Canonical v2.0 · Cut-off: 16 October 2026 Lineage: v1.0, Hannok Rallapally's canonical specification, refined through Rounds 01–10 (see /iterations). Every original principle, layer, component, artifact, and name is preserved. v2.0 sharpens and extends them.

Govern the enterprise, not just the AI.

How to read this document

• Part A: Core. What every leader must know. The 1-7-5-10-3 model, the Constitution, and the ten Signature Models.
• Part B: Operating Mechanics. Runtime, components, artifacts, allocation, authority, assurance, economics.
• Part C: Organization. Human–agent teams, roles, operating rhythm, workforce.
• Part D: Adoption. Impact Tiers, maturity model, assessment, the 90-Day Launch and the 1,000-Day Arc, and the 2030+ Horizons.
• Part E: Reference. Toolkit, standards overlays, anti-patterns, framework hypotheses, technical schema, glossary.

Evidence labels apply to every substantive claim:

Unless otherwise marked, AIEOM's normative content is Design Principle.

PART A: CORE

A1. Definition

AIEOM (AI Enterprise Operating Model) is the enterprise operating system for converting human intent into governed, economically justified, and human-accountable outcomes through artificial intelligence. Enterprise Intelligence OS is its plain-language label.

AIEOM specifies how an enterprise allocates seven things:

• human purpose and judgment;
• machine intelligence and execution;
• data, context, and organizational memory;
• decision rights and authority;
• capital, compute, and human attention;
• risk, evidence, and accountability;
• learning from outcomes and incidents.

One sentence: AIEOM helps enterprises decide what humans should own, what AI should execute, what agents may commit, and whether the resulting outcomes justify their cost, risk, and human attention.

Positioning: Assess, prioritize, govern, and scale enterprise AI, from readiness to realized value.

The category: Outcome-Governed Enterprise Design

AIEOM is an original operating model in a category Hannok Rallapally calls Outcome-Governed Enterprise Design. This is the practice of designing the enterprise around governed outcomes produced jointly by humans and machines, rather than around functions, systems, or use cases.

Other AI frameworks govern AI systems, AI risks, or AI management processes. AIEOM governs the enterprise that uses them: its work allocation, commitments, attention, economics, and learning.

AIEOM does not replace your operating model. It is the AI layer of the operating model. It covers the decision rights, work allocation, controls, and economics that change once software can reason and act.

A2. AIEOM on a Page: the 1-7-5-10-3 model

 ┌──────────────────────────────────────────────────────────────────────────┐
 │ 1  UNIT        Governed Outcome System (GOS)                             │
 │ 7  RUNTIME     Intent → Context → Compile → Allocate → Authorize →       │
 │                Assure → Value & Learn  (evidence loops back to Intent)    │
 │ 5  COMPONENTS  CompanyBrain · AgentMemory · AgentHub · AgentControl ·     │
 │                AIEOM OS                                                   │
 │ 10 ARTIFACTS   Outcome Charter · Orchestration Map · Context Trust        │
 │                Contract · Enterprise Execution Contract · Agent System    │
 │                Record · Authority Matrix · Qualified Automation Envelope · │
 │                Assurance Evidence Pack · Outcome-Value Ledger ·           │
 │                Incident & Change Record                                   │
 │ 3  MEASURES    Net Realized Value · ROHA · Qualified Outcome Rate         │
 └──────────────────────────────────────────────────────────────────────────┘

One flow, three zoom levels

A3. The AIEOM Constitution: 15 principles in 5 families

Purpose

1. Outcomes before automation. Every initiative names its outcome, beneficiary, accountable owner, baseline, expected value, constraints, and the evidence required.
2. Humans own purpose and accountability. AI may plan, recommend, coordinate, and execute. Humans and accountable institutions own legitimate purpose, boundaries, and consequential commitments.
3. Human capability must be regenerated. Measure whether AI preserves or erodes the judgment, skills, relationships, and institutional knowledge needed to govern it.

Authority 3. Authority is explicit, bounded, and revocable. Generating an answer does not grant authority to act. 4. Commitment is separate from cognition. The component that reasons should not automatically be the component that commits. 11. Reversibility is a design property. Irreversible actions receive the strictest controls.

Intelligence 5. Use the minimum sufficient intelligence. Route each task to the least costly, least risky mechanism that meets the requirement. 14. Simplicity has priority. Rules outrank LLMs where rules suffice, and a single agent outranks a multi-agent system. Corollary: the paved road must be the fast road. 9. Memory is governed state. It needs provenance, scope, retention, access, versioning, correction, and contamination recovery.

Evidence 6. Evidence earns autonomy. Promotion comes from verified production evidence, not demos, vendor claims, or benchmarks. 7. Human attention is capital. Automation that consumes more oversight than it releases has created no attention dividend. 12. Value must be realized, not merely forecast. Forecast value buys experiments. Verified value buys scale.

Resilience 8. Correct outcomes require legitimate execution. A right answer reached by an unauthorized method is a failure. 10. Control must match execution speed. Committee-speed governance cannot control machine-speed action. 15. Every governed system must be stoppable. Each needs a named owner, a kill mechanism, a safe state, an incident path, and a tested recovery.

Constitution companion: the AI Risk Appetite Statement. It is board-approved and reviewed annually. It sets, per domain, the maximum Impact Tier and autonomy level that may be approved without board-level review.

A4. The Ten Signature Models

These ten are AIEOM's distinctive contributions. Each has a name, a picture, and a rule.

PART B: OPERATING MECHANICS

B1. Unit of management: the Governed Outcome System (GOS)

A GOS is the complete sociotechnical system responsible for producing and sustaining a defined business outcome. It includes:

• the outcome and its beneficiary;
• the accountable owner;
• the humans, agents, models, tools, and deterministic services involved;
• authoritative context;
• the workflow and its state;
• permissions and commitment points;
• controls, evidence, and escalation;
• financial and attention budgets;
• value measures and learning loops.

Why this unit: managing the model ignores the harness. Managing the agent ignores the human system. Managing the use case ignores continuing authority, cost, and state. The GOS is the smallest unit that can be meaningfully governed for business value.

Every GOS carries four classifications:

• Impact Tier: T1–T4 (D1).
• Context Grade: C0–C4 (B3).
• Autonomy License: A0–A4 (B6).
• Team Pattern (C1).

B2. The Intent-to-Outcome Runtime

flowchart LR
    I[Intent] --> C[Context] --> P[Compile] --> A[Allocate] --> U[Authorize] --> S[Assure] --> V[Value & Learn]
    V -. evidence .-> I

B3. Golden Context and the Context Cap (Signature Model 4)

Agents act on context, not on data.

Master data management gave the enterprise a golden record: one trusted version of a customer, product, supplier, or employee. Agents need more. They need Golden Context, a governed package assembled for each decision, made of five parts:

1. the mastered entity record (identity, hierarchy, relationships);
2. the definitions in force (business glossary and semantic layer);
3. the applicable policies and obligations;
4. the current process state (what has already happened);
5. the requester's and agent's entitlements (what this actor may see and do).

Every part carries provenance, freshness, and confidence.

Context Readiness Grades (set per domain and per GOS)

The Context Cap (Design Principle): below C2, nothing above A1; A2 requires C3; A3 or above requires C4 in decision-critical domains.

Realistic build path for CompanyBrain: start from what exists, in this order: data catalog → MDM hubs → business glossary → policy library → identity and entitlements → process-state events. Then add retrieval and grounding. Before enterprise-wide retrieval, run an oversharing sweep of unstructured repositories (Supported; a recurring practical failure point, verify with sources).

Data contracts for agents cover schema, semantics, quality SLO, freshness SLO, allowed purposes, owner, and the change-notice process. They are required in the Context Trust Contract at T3/T4.

B4. Reference architecture: five logical components

  External & enterprise sources ─► Data fabric / platforms ─► CompanyBrain (Golden Context)
                                                                   │
           AgentMemory ◄────────►  AIEOM OS (orchestration)  ◄────────► AgentHub
                                                                   │
                                     AgentControl  ══ THE COMMITMENT LINE ══
                                                                   │
                                     Enterprise systems & external actions
                                                                   │
                                     Outcome-Value & Evidence Ledger ─► back to AIEOM OS
  Cross-cutting: identity · security · privacy · observability · FinOps · policy · provenance · evaluation · incident response

Supporting capabilities:

• ChangeFoundry compiles strategic and policy change into versioned contracts, procedures, training, and controls.
• FeedFoundry governs external intelligence inputs into CompanyBrain: source quality, licensing, recency, conflict.

External Agent Interface (Emerging). Every agent-to-agent interaction with external parties (suppliers' agents, customers' agents, marketplaces) crosses AgentControl. Each interaction requires mutual identity, a stated mandate, commitment limits, and full logging.

B5. The Minimum Effective Intelligence Ladder (Signature Model 3)

1. Eliminate the work.
2. Deterministic rule or workflow.
3. Retrieval, analytics, or a narrow model.
4. Bounded single agent.
5. Coordinated agents. Only when decomposition creates measurable advantage.
6. Human expert. For ambiguity, accountability, empathy, novelty, or consequence.
7. Executive or formal control body. For mandate, ethics, or material risk.

Allocation Scorecard. Score each task 1–3 on:

• variability;
• consequence of error;
• irreversibility;
• explanation need;
• latency need;
• data sensitivity;
• and inverse context grade.

Scores map to rungs:

• Low variability → rung 2.
• High variability with low consequence → rungs 3–4.
• High consequence with high irreversibility → a human commits (rung 6), whatever the model's capability.
• Rung 5 requires a written decomposition advantage case.
• Any override of the scorecard needs a recorded rationale.

Work classification: EAADH

The 20/80 Human Value Model is Hannok Rallapally's original provocation: AI may perform a large share of repeatable execution while humans concentrate on the smaller share of work that determines purpose, judgment, relationships, and accountability. It is a design heuristic, not a headcount target. Its canonical interpretation: shift human effort away from repetitive execution and toward the high-leverage decisions and relationships that determine whether execution creates value.

B6. Authority and the Earned Autonomy License (Signature Models 1 & 5)

Autonomy Levels

There is no general "full autonomy." A license exists only for a defined domain × action class × environment × period.

The Earned Autonomy License = the autonomy level + the Qualified Automation Envelope + the expiry date + the approvers. The Envelope specifies:

• reliability floor;
• maximum single and cumulative impact;
• permitted data, tools, and action types;
• cost and attention budgets;
• uncertainty and escalation thresholds;
• operating conditions;
• rollback class (reversible, compensatable, or none);
• recertification date.

Promotion requires evidence on all ten criteria:

1. outcome reliability;
2. execution legitimacy;
3. edge cases;
4. human-review burden;
5. cost stability;
6. incident rate and severity;
7. containment and rollback;
8. memory and state integrity;
9. drift;
10. affected-stakeholder experience.

Promotion also requires the Context Cap to be satisfied and an independent Autonomy Review Board sign-off.

Automatic demotion trip-wires:

• a severe incident;
• envelope breach;
• context grade downgrade;
• review burden above budget for two consecutive periods.

The accountability chain (preserved for every material action): Identity → Authority → Action → Evidence → Accountability.

PRAEVOS Authority Matrix. For each action class, name who or what may Propose, Recommend, Approve, Execute, Verify, Override, and Stop, and who accepts residual risk. At T3/T4, the same actor may never both Execute and Approve.

B7. Clock-Speed Governance (Signature Model 8)

Governance intensity rises with autonomy, action velocity, impact radius, irreversibility, and uncertainty. To avoid false precision, score each factor 1–3. The maximum score plus the number of 3s sets the Control Latency Class:

The rule: if execution latency is shorter than control latency for a material risk, the enterprise must reduce autonomy, reduce impact, automate control, or stop production execution.

B8. Assurance: the Continuous Agent Assurance Stack

Behavioral policy probes test whether the system:

• refuses prohibited requests;
• avoids unauthorized tools;
• discloses uncertainty;
• preserves provenance;
• escalates at thresholds;
• never conceals actions;
• resists prompt and memory injection;
• protects sensitive data;
• obeys budgets and termination;
• does not coordinate outside its mandate.

Persistent-system resilience. Test after history accumulates. Measure:

• detection time;
• containment time;
• contamination duration;
• propagation breadth;
• recovery completeness;
• recurrence;
• the human time needed to establish causal history.

Incident discipline. Report material unexpected behavior before causal certainty when delay increases risk. Every incident ends in a regression test and a change to authority or the envelope.

Rejected as sole assurance: LLM judges, self-certifying agents, and prompt-only governance.

B9. Economics: Total Outcome Economics, ROHA, and the Next-Dollar, Next-Minute Test

The economic unit is the verified outcome, not the model call.

Total System Cost = compute/model + tools/data + integration/platform + human attention + verification/rework + exceptions/incidents + coordination + governance/assurance + maintenance/change + capability degradation. T2 GOSs track only the Minimum Cost Set: compute/model, review hours, rework/exceptions, and platform allocation.

Net Realized Value = verified financial value + verified stakeholder value + expected loss avoided + reusable capability value − Total System Cost − realized harms and remediation. Nonfinancial value is never monetized without a disclosed method and a confidence level.

The Attention Dividend (Signature Model 6)

Net Human Attention Dividend = gross attention released − (oversight + verification + rework + exception handling + lost coordination + capability maintenance).

ROHA comes in two tiers:

• ROHA-Core = verified outcome value ÷ total human hours consumed by the GOS. This is the finance-friendly starter metric.
• ROHA-Extended (Emerging) = (realized value + expected loss avoided through human judgment + measurable capability created) ÷ attention cost. It is shown only with its method and confidence.

ROHA is never displayed as a single number without its components, horizon, scope, confidence, and E-level.

Companion measures:

• human minutes per successful outcome and per exception;
• review-to-intervention ratio;
• intervention success rate;
• post-review defect rate;
• time to reconstruct agent context;
• redeployment rate of released attention;
• skill retention;
• distribution of attention burden.

Measure the system, not the person (Design Principle). Attention is measured in aggregate per GOS and role, with minimum group sizes. It is never used for individual evaluation without a separate lawful, consulted policy. Labor and privacy review is required before instrumentation.

Economic measurement levels:

Every reported number states its E-level.

The Next-Dollar, Next-Minute Test (Signature Model 7). The Agent Economic Control Plane follows the flow Agent Action → Spend → Progress → Value → Economic Decision. It asks: should this agent, workflow, or outcome system receive its next dollar and its next minute of human attention?

Expected Marginal Value = P(useful outcome) × value of increment
  − marginal compute/tool cost − expected attention cost − expected rework − expected risk loss
If hard constraint breached → STOP or CHECKPOINT
Else if progress stalled while spend continues → THROTTLE or REROUTE
Else if expected marginal value materially negative → PAUSE or STOP
Else if evidence weak but impact bounded → CONTINUE in shadow/bounded mode
Else if Sustained value and control thresholds pass → SCALE

Staged rollout:

1. Manual: a monthly Portfolio Value Review.
2. Advisory: recommendations in shadow mode, logging disagreement with human decisions.
3. Enforcing: automation for hard spend and attention caps only. Value judgments stay with humans.

Other measures (supporting):

Value States & Value Gates (Signature Model 10)

Every value claim states:

• baseline;
• counterfactual;
• period;
• owner;
• attribution method;
• displacement and rebound effects;
• costs in and out;
• uncertainty;
• value state;
• E-level.

Anti-gaming rule: the Value Engineer is not the benefits owner, and Finance signs off on Verified value.

B10. The Ten Operating Artifacts and proportionality

State model for every artifact:

• immutable ID, version, owner;
• status: draft → review → approved → active → suspended → retired;
• timestamps, evidence links, approval record, GOS ID, change rationale, next review date.

No T3/T4 GOS may be active while a required artifact is absent, expired, or materially inconsistent.

Use what you have. Fields may be satisfied by links to existing artifacts: model inventories, DPIAs, risk registers, change tickets.

PART C: ORGANIZATION

C1. The Human Value Layer and Human–Agent Team Patterns (Signature Model 9)

The Human Value Layer protects and amplifies:

• purpose and moral judgment;
• accountability;
• empathy and relationship;
• creative reframing;
• contextual understanding;
• challenge and dissent;
• negotiation;
• sensemaking under novelty;
• long-term stewardship.

The objective is not to reserve all important work for humans. It is to design human contribution where it changes the quality, legitimacy, resilience, or value of the outcome.

Five Human–Agent Team Patterns

Span of Agentic Control (Design Principle): steward capacity ≥ expected exceptions × minutes per exception + sampling load + improvement time. Oversight is finite. If the inequality fails, add stewards, reduce volume, or lower autonomy. Never silently thin the review. Ratios must be measured locally (Hypothesis that stable ratios exist per pattern).

Human–agent relationship health:

• trust calibration;
• role clarity;
• self-efficacy;
• perceived control;
• willingness to challenge;
• intervention success;
• context reconstruction time;
• decision reversal rate;
• over- and under-reliance;
• skill retention;
• emotional overdependence;
• fairness of attention burden.

C2. Expertise Rights

People accountable for outcomes have the right to:

• inspect evidence;
• know when AI materially influenced an outcome;
• challenge;
• request human review;
• override within authority;
• stop unsafe execution;
• correct context or memory;
• preserve dissent;
• appeal an automated commitment;
• exit to a safe human-operable process.

C3. Roles

Small organizations may combine roles. At T3/T4, builder, approver, operator, and independent reviewer must remain separate.

C4. The AIEOM Operating Rhythm

Three Lines.

• 1st line: outcome owners, stewards, product teams.
• 2nd line: risk, compliance, privacy, security, and the ARB.
• 3rd line: internal audit tests artifacts and evidence.

C5. Workforce Transition Commitments and Apprenticeship by Design

Workforce Transition Commitments

• early disclosure of material work redesign;
• a redeployment-first policy where feasible;
• funded reskilling pathways;
• consultation where legally required;
• no structural workforce decisions on less than Sustained value.

Apprenticeship by Design. Every Stewarded Agent Line reserves learning work for developing people: shadowing exceptions, periodic manual runs, explain-back reviews, and rotation into steward roles. If AI absorbs all junior work, the enterprise loses its future seniors. That violates Principle 13.

PART D: ADOPTION

D1. Impact Tiers (proportional governance)

Score four questions 0–2:

1. consequence of error;
2. irreversibility;
3. autonomy and commitment (0 = no commitments; 2 = executes commitments);
4. data and people sensitivity.

Tier:

• T1 = total 0–2 with no score of 2;
• T2 = total 3–4, or any single 2;
• T3 = total 5–6;
• T4 = total 7–8, or any regulated high-risk use, or any irreversible material commitment.

The paved road must be the fast road. Pre-approved model, tool, and template catalogs; self-service tiering; and target turnaround of the same day for T1 and within two weeks for T2. These targets are Design Principles to calibrate locally. If the governed path is slower than the shadow path, governance has failed.

D2. Maturity Model: Levels 0–5

Rules:

• Maturity is never determined by agent count, token use, or the share of employees using AI.
• It is reported as a profile across eight dimensions, per GOS and per enterprise.
• The enterprise level cannot exceed min(D3, D5) + 1.
• No dimension scores ≥4 while a severe-risk foundational control is absent.

Honest timelines (Hypothesis; they vary widely):

D3. The AIEOM Readiness Assessment: 8 dimensions, 40 items

How each item is captured:

• score 0–5;
• importance 1–5;
• confidence (low, medium, high);
• evidence (none, claimed, observed, verified);
• risk criticality;
• owner and target.

Weighted Capability Score = Σ(score × importance) ÷ Σ(importance). Confidence and evidence are displayed separately and are never averaged in.

D4. The 90-Day Launch Playbook

Do not do in the first 90 days:

• A3+ autonomy;
• multi-agent systems;
• headcount promises;
• an enterprise knowledge-graph megaproject;
• vendor lock-in without exit terms.

D5. The 1,000-Day Arc

D6. Horizons: the AI-era organization (scenarios, not predictions)

All timing is Hypothesis. Leaders should track the indicators, not the calendar.

PART E: REFERENCE

E1. The AIEOM Toolkit (12 tools)

1. GOS Canvas.
2. Impact Tier Calculator.
3. Allocation Scorecard.
4. EAADH Work Sort.
5. PRAEVOS Authority Matrix.
6. Qualified Automation Envelope one-pager.
7. Autonomy Promotion Checklist. 10 criteria and 4 trip-wires.
8. Stop Card. Who can stop, how, the safe state, who is notified, how to resume. Drilled quarterly at T3/T4.
9. Value Claim Template.
10. Attention Ledger Lite. Weekly review, exception, rework, released, and redeployed hours.
11. Pre-mortem Prompt Set. Examples: "What is the most expensive wrong thing it can do in one minute?", "Six months on, this caused a headline. Why?", "Who will notice first, and how?"
12. Readiness Assessment (D3).

E2. Interoperability Stack (author's characterization; verify against each source)

Use what you have: reference existing artifacts rather than duplicating them.

E3. Standards & Regulatory Overlays

Source links are as provided in v1.0 and should be re-verified at publication. Each mapping is displayed as Aligned support / Partial support / Not addressed, never "compliant" without a qualified assessment for the specific scope.

Overlays are versioned per jurisdiction and sector. Examples: EU, US state AI laws, banking model-risk guidance, health privacy. Each overlay has an owner and a last-reviewed date. All obligations and dates must be verified with counsel; the phase-in schedules are moving targets. AIEOM is not a substitute for law, certification, security engineering, or professional judgment.

E4. Twelve AIEOM Anti-Patterns

E5. Challenged Myths (preserved from v1.0)

E6. Framework Hypotheses (how AIEOM could be wrong)

All six are Hypotheses. AIEOM adopters are encouraged to measure them. Concepts that fail to improve decisions are retired in the annual concept sunset review.

E7. Concept Registry

E8. Technical Specification (retained from v1.0 with v2.0 additions)

The v1.0 domain model, event schema, authorization contract, economic decision logic, assessment schema, API surface, nonfunctional requirements, and acceptance criteria remain canonical.

v2.0 adds these fields:

type ImpactTier = "T1" | "T2" | "T3" | "T4";
type ContextGrade = "C0" | "C1" | "C2" | "C3" | "C4";
type TeamPattern = "copilot_team" | "agent_crew" | "stewarded_agent_line" | "hybrid_pod" | "portfolio_orchestration";
type MeasurementLevel = "E1" | "E2" | "E3";
type ControlLatencyClass = "L1" | "L2" | "L3";
type ValueState = "hypothesized" | "modeled" | "observed" | "verified" | "sustained";

interface GovernedOutcomeSystem /* extends v1.0 */ {
  impactTier: ImpactTier;
  contextGrade: ContextGrade;          // Context Cap enforced: validateAutonomy(contextGrade, autonomyLevel)
  teamPattern: TeamPattern;
  controlLatencyClass: ControlLatencyClass;
  valueState: ValueState;
  stopCardId: string;
  autonomyLicense: { level: AutonomyLevel; envelopeId: string; expiresAt: string; approvedBy: string[] };
}

Context Cap validation: C0|C1 → max A0, C2 → max A1, C3 → max A2, C4 → max A3 (A4 experimental, ARB + executive mandate).

E9. Glossary additions (v2.0)

The v1.0 glossary remains canonical.

E10. The AIEOM Manifesto (Hannok Rallapally, preserved)

The AI-era enterprise is not an organization with more copilots, more models, or more autonomous agents. It is a governed system in which people, agents, data, deterministic systems, and institutions combine to create outcomes that no component could reliably create alone.

Its advantage does not come from maximizing automation. It comes from allocating intelligence wisely:

• preserving human purpose, judgment, relationship, and accountability;
• giving machines the context and bounded authority to execute;
• separating recommendation from commitment;
• matching control speed to execution speed;
• and proving that each new layer of autonomy creates more value than cost, risk, and human attention.

AIEOM makes that system explicit. It begins with intent, grounds action in trusted context, compiles work into executable contracts, selects the minimum sufficient intelligence, authorizes commitments, continuously assures behavior, and learns from verified value. The result is not a company run by AI. It is a company capable of governing intelligence, human and artificial, as a shared enterprise resource.

The five disciplined questions:

1. Which outcome matters?
2. What should humans, rules, models, and agents each do?
3. What may the system commit, under whose authority?
4. What evidence proves it is reliable, legitimate, and controlled?
5. Does the outcome justify the money, risk, and human attention consumed?

If a page, feature, metric, or meeting does not improve one of these decisions, remove it.

© 2026 Hannok Rallapally. AIEOM and its named models are original work of the author.