From Systems of Record to Governed Systems of Action

Manuel Conde

27 August 2026 · Capability Ownership

A single circle divided across its horizontal diameter: the upper half teal, labelled systems of action, and the lower half black, labelled systems of record. A rule runs along the division and out to the left, where a lime square and the word governed mark it, so the two halves read as one object joined at that seam. Below, the thesis: the governed workflow is the unit that joins them.

Exploring this for your team? Talk to CrmWare →

Why the governed workflow should organise the transformation

For many enterprises, access to AI is no longer the primary constraint. Depth of use is. Official UK statistics show that only 10% of adopting businesses report using AI extensively, 15% say more than half of their employees use it in daily work, and 11% say more than half of their workforce has received AI-related training.[1] Adoption is spreading faster than the operational change that would make it pay.

So what distinguishes the organisations that do see value? Of 25 organisational attributes tested in McKinsey's survey work, the redesign of workflows had the biggest relationship with an organisation's ability to see EBIT impact from generative AI.[2]

Two stacked vertical sequences of five numbered steps. The upper outlined sequence, organised around the platform, runs platform programme, implementation, customisation, integration, support. The lower teal sequence, organised around the governed workflow, runs operational bottleneck, workflow redesign, AI-assisted execution, measured outcome in lime, and continuous governance. A closing note states that the second sequence reframes the first without replacing it, and that implementation, customisation and integration remain necessary enabling work. — Figure 1. CrmWare's proposed organising model. The second sequence reframes the first rather than eliminating it: implementation, customisation and integration remain necessary enabling work.

CrmWare draws a recommendation from this, not a description of the market. No public evidence shows that enterprise buying has already shifted from platform programmes to workflow programmes. What the evidence supports is that it should: commission the transformation around a bounded operational workflow, and treat implementation, customisation and integration as the enabling work they are.

There is real demand behind this. In Q2 FY2027, Salesforce reported Agentforce ARR above $1.5 billion, up more than 240% year over year.[3] Its definition expanded that quarter to include additional AI offerings, Slackbot and Headless 360, so this is not directly comparable with Q1.[3] It signals paid demand for agentic capability, not outcomes from any particular workflow.

CrmWare's operating definition of a governed system of action

A system of action is not an agent, nor an automation layer bolted onto a system of record. In CrmWare's definition it is a bounded operational workflow designed around seven explicit elements, decided before anything reaches production.

Name the bottleneck: the specific operational constraint, not the department. Record the baseline: what that work costs in time, volume or error today. Set the target outcome: the measurable change that would justify the investment. Define the permitted actions: exactly what the system may do unsupervised. Place the human decision points: where judgment is required rather than optional. Design the exception path: what happens when the case falls outside the rules. Name the accountable owner: the person answerable for the outcome, not the technology.

Seven numbered elements stacked in three labelled groups. Decided at the entry: bottleneck and baseline, outlined in black. Bounds the AI step: permitted actions and human decision points in teal, then the exception path outlined in red as the risk branch. Measured exit: target outcome in lime, and beneath it a full-width black bar carrying the accountable owner, answerable for the outcome rather than the technology. A footer states that no source establishes the list and that it is CrmWare's operating synthesis, offered as the design brief for one bounded workflow. — Figure 2. CrmWare's operating definition of a governed system of action. No source establishes this seven-element list; it is offered as the design brief for one bounded workflow.

No source establishes that list; it is CrmWare's operating synthesis. What the evidence does show is that, of the organisational attributes tested, workflow redesign had the strongest relationship with an organisation's ability to see EBIT impact,[2] and that a bounded workflow can run on someone else's infrastructure while the controls stay internal, as BBVA did on AWS in a case study published by that supplier.[4]

Bounded is the operative word. A workflow with an undefined edge cannot be measured, because there is no stable baseline, and cannot be governed, because nobody can say which cases were supposed to fall inside it.

Governance begins when the workflow enters production

A well-designed workflow stays governable only if someone keeps looking at it. Governance is not the review that precedes go-live; it is the cadence that runs afterwards.

BBVA's MLOps transformation with AWS embedded approval rules, separation of duties, risk-tier-based promotion and auditability directly into the platform workflow. Across four pilot initiatives the bank reported 20–75% reductions in development time and 40–55% reductions in cost.[4] That is a supplier-published account of one organisation's pilots, and the ranges are theirs, not a benchmark to expect. What travels is the design choice: the controls sat inside the workflow, not beside it.

The NIST AI Risk Management Framework describes the same shape as a continuous function. Its core of govern, map, measure and manage is explicitly iterative, and it expects ongoing monitoring and periodic review with defined roles, responsibilities and frequency.[5]

In practice that is a standing review with a fixed agenda: how the workflow performed against its target, which cases took the exception path, where people overrode the system and why, what incidents occurred, whether the permissions still match the work, and what the business impact has been. Each of those is evidence. Each can trigger a change to the workflow itself.

A vertical sequence of four teal boxes — govern, map, measure, manage — each feeding the next, with a black return arm curving from manage back up to govern so the core reads as a closed loop. Below the sequence, a label reading evidence at every turn and a black arrow lead to an outlined box, workflow change, marked as CrmWare's addition. Beneath, the list of what each turn reviews: performance against target, exceptions taken, overrides and why, incidents, whether permissions still match the work, and business impact — each of them evidence that can trigger a change to the workflow itself. A footer attributes the govern, map, measure and manage core to the NIST AI Risk Management Framework and the workflow-change arm to CrmWare. — Figure 3. The govern, map, measure and manage core is the NIST AI Risk Management Framework, which is explicitly iterative. The workflow-change arm closing the loop is CrmWare's addition.

The operating test before you fund the next workflow

Turn the definition into a decision. Before approving the next AI-enabled workflow, ask the sponsor to answer the seven elements without reaching for a slide about the platform. Then ask two further questions the design alone cannot settle: how will performance, exceptions and overrides be reviewed, and who can change the workflow when the evidence says it should change?[5]

The test is deliberately unkind to enthusiasm. A programme in trouble can usually name its platform, its partner and its agent. Ask it instead for the baseline, the evidence that the outcome moved, and the person accountable when it did not.

This is CrmWare's practical synthesis rather than a validated maturity instrument. It rests on the two things the evidence does support: that workflow redesign had the strongest measured relationship with seeing EBIT impact,[2] and that one operator embedded its controls inside the workflow rather than around it.[4]

If the answers are thin, look past the technology. What is missing is the operating system around it. We have written elsewhere about what happens when AI begins to act inside the business, the judgment that cannot be delegated, and how to score a supplier arrangement before signing.

References

[1] Office for National Statistics. Artificial intelligence in UK businesses: 2023 to 2026. 2026. https://www.ons.gov.uk/businessindustryandtrade/business/businessservices/articles/artificialintelligenceinukbusinesses/2023to2026

[2] McKinsey & Company, QuantumBlack. The state of AI: How organizations are rewiring to capture value. 2025. https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-how-organizations-are-rewiring-to-capture-value

[3] Salesforce. Salesforce Delivers Record Second Quarter Fiscal 2027 Results. 2026. https://investor.salesforce.com/news/news-details/2026/Salesforce-Delivers-Record-Second-Quarter-Fiscal-2027-Results/default.aspx

[4] BBVA and Amazon Web Services. Inside BBVA’s MLOps transformation: from data platform to scalable ML on AWS. 2026. https://aws.amazon.com/blogs/industries/inside-bbvas-mlops-transformation-from-data-platform-to-scalable-ml-on-aws/

[5] National Institute of Standards and Technology. NIST AI Risk Management Framework Core. 2023. https://airc.nist.gov/airmf-resources/airmf/5-sec-core

Talk to CrmWare