Institutional AI

The assistant was never the point

Microsoft has put an AI assistant in front of the largest installed base in enterprise software, and after two years the most revealing number is not the adoption figure but the way the company has started to talk about it. Microsoft 365 Copilot reached 20 million paid seats by its April 2026 earnings call, up from 15 million a quarter earlier, real growth, though still a low-single-digit slice of Microsoft's commercial Microsoft 365 base of more than 450 million seats. The line worth noticing came in the same breath: Satya Nadella stopped describing Copilot mainly as an assistant and described it instead as a growing context layer, a flywheel that improves every agent built on top of it, and what he called an unmatched context engine for organizational intelligence. When the company with the most widely distributed enterprise AI assistant reframes its pitch from the assistant to the layer underneath it, that is the tell.

The pitch is shifting because a personal assistant, however capable, is the wrong unit. It helps an individual draft an email, summarize a document, or answer a question from whatever happens to be in front of them. It does not know how your firm actually works: who owns what, how a deal moves from a call to a signature, what your renewal language sounds like, which of your colleagues needs to hear about the decision you just made. Gartner's own analysts make the same point more plainly, arguing that the real returns come from enterprise productivity rather than what they call "individual task augmentation". Sold by Microsoft, Google, OpenAI, and Anthropic at metered prices and increasingly hard to tell apart, the assistant on each desk is commoditizing. The scarce thing sits one layer up.

Call that layer institutional AI. The term is starting to surface around the industry, and it deserves a precise definition rather than a vibe. Institutional AI is the harness wired into the organization itself: connected to its tools, fluent in its processes, aware of how work flows and who matters for which kind of work, able to speak in the firm's voice and in each person's voice, and positioned to do the mundane connective work that holds an organization together. It writes the email the way you write it. It knows that when a meeting ends you need to update the CRM, brief two colleagues, post a summary to the right channel, and turn the transcript into action items, and it can do all of that across the stack without being asked twice.

The durable value is not the assistant on each desk; it is the harness wired into the institution, and the strategic question is no longer whether to adopt it but who ends up owning the institutional context once it exists. That question is the spine of this piece. Institutional AI has two faces that turn out to be one mechanism. The first is the obvious one, doing each person's work in their voice. The second is less obvious and probably more valuable: because the harness sits across everyone's work, it can see the organization in a way no human, and no traditional enterprise system, ever has at the same depth. Both faces, the moat that forms underneath them, the surveillance hazard they create, and the contest over who controls the layer are what follow.

How we got here: from systems of record to systems of action

A useful place to start is the framework that has shaped enterprise software thinking for a decade. In 2017, Greylock's Jerry Chen published The New Moats, arguing that the next defensible businesses would be systems of intelligence that sat on top of proprietary data, updated in 2023 once generative AI arrived. His map had three layers. Systems of record held the data: people, assets, customers, the domain of Salesforce and Workday and the ERP. Systems of engagement owned the interface, the place where a person met the software. Systems of intelligence were the new prize, applications that turned accumulated data into something a competitor could not easily reproduce.

The map held up, and the market is now extending it. The phrase showing up everywhere in 2025 and 2026 is the system of action. Brett Queener of Bonfire Ventures put the distinction bluntly when he wrote that systems of record may hold interesting metadata, but systems of action are the ones that actually get things done. Workday, which acquired Sana, frames the goal in its own marketing as turning a system of record into a system of action. Salesforce built Agentforce so that agents operate directly on its data model, with every action logged and passed through a trust layer. Gong, to take one vendor's pitch, tells revenue teams that its AI grows more valuable the longer it runs because it keeps learning from what works. The common thread is that value is moving again, this time from the data you store to the work you execute and the loops you learn from.

The pace is what makes this more than a vocabulary shift. Gartner projects that 40% of enterprise applications will carry task-specific AI agents by the end of 2026, up from less than 5% in 2025, and that 33% of enterprise software applications will include agentic AI by 2028, against less than 1% in 2024, with at least 15% of day-to-day work decisions made autonomously by then. Whether those exact figures land is beside the point. The direction is a step change in how much of ordinary work an organization will route through software that can act, not just store and display.

There is a clean way to see the whole arc. For two decades, the enterprise spent enormous effort making its data addressable. SaaS moved records out of filing cabinets and into the cloud. The modern data stack made those records queryable. Reverse ETL pushed them back into the tools where work happens. The result is that most firms can now answer almost any question about their data if they are willing to write the query. What they still cannot do is make their work and their operating context addressable: the way a project actually moves, the tacit standard for what good looks like here, the unwritten rule that this customer always escalates through that channel. That knowledge has always lived in people's heads and walked out the door when they left, the long-studied problem of organizational memory: the stored sense of how a firm works that gets brought to bear on its present decisions (Walsh and Ungson). Earlier systems reached at pieces of this, from business process management to knowledge graphs, but institutional AI is the first aimed squarely at holding the whole of it, reasoning over it, and acting on it at organizational scale.

What institutional AI actually is

The cleanest definition is by contrast. Personal AI is single-player. It is effectively stateless about the organization, it treats each request in isolation, and it helps one person with whatever is on the screen. That is genuinely useful, and it is also why it commoditizes: every vendor can offer roughly the same thing, because none of them depend on knowing your firm.

Institutional AI models two things at once, and the second is what makes it hard to copy. It models the institution, meaning its processes, its org graph of who does what, the way work flows from one role to the next, and its voice: the brand, the house style, the standard a partner would expect a junior to meet. And it models the individual, meaning each person's idiosyncrasies, their habits, the places they consistently drop the ball, the way they actually phrase things. The combination is the unlock. Most enterprise software has spent thirty years forcing humans to conform to the tool's workflow, learning its fields and its buttons and its rituals. Institutional AI inverts that. It meets each person where they are, in their language, and absorbs the friction of translation itself.

Make it concrete with the most ordinary moment in knowledge work, the end of a meeting. A salesperson finishes a call. In the personal-AI world, they might ask an assistant to summarize a transcript they paste in. In the institutional-AI world, the harness already knows the meeting happened, pulls the transcript from the recorder, updates the right opportunity in the CRM with the fields your team actually fills in, drafts the follow-up email in that salesperson's voice rather than a generic one, flags the two colleagues who own the next steps and drafts their briefings, posts a summary to the channel where this account is discussed, and turns the commitments made on the call into tracked action items. None of those steps is impressive in isolation. The value is that the harness knows they belong together, knows the order, knows the destinations, and does them through the lens of how this particular firm operates. The same pattern generalizes across a consulting engagement, a diligence process at a private equity firm, or a sprint at a software company. The tools differ, the connective tissue is the same.

This is why the commercial market is already forming around the context layer rather than the chatbot, and the direction matters more than any single vendor's fortunes. The problem underneath it is old and independently documented: more than a decade ago, McKinsey estimated that knowledge workers spent close to a fifth of the workweek just looking for internal information or tracking down the colleague who had it (McKinsey Global Institute). Glean is one commercial answer: it began as enterprise search and now frames itself as a context layer for organizational intelligence, and it has drawn enough investor conviction to raise a Series F at a $7.2 billion valuation on a straightforward diagnosis: an enterprise's knowledge of its data, its people, and its processes is scattered across hundreds of applications, with no reliable way to reach across all of them at once. Whether Glean or any particular vendor ends up owning that ground is beside the point here. The signal worth reading is that capital and customers are moving toward the layer rather than the assistant, and reaching across everything is the whole game.

The institutional flywheel

The reason institutional AI is worth taking seriously as strategy, rather than as another productivity feature, is that it compounds, and it compounds in a way that does not move to a competitor.

The loop is simple to state. The harness observes work across the tools it is connected to. From that observation it builds institutional context: a living model of how this firm operates, what its decisions look like, what its voice is, who is on the critical path for which kind of work. With more context it acts more accurately and more in-voice, which makes it more useful. Because it is more useful, people route more of their work through it, and they trust it with more consequential tasks. More routed work means more observation, and the loop tightens. Gong's marketing claim that its AI grows more valuable the longer it runs describes the same dynamic from inside a single function. Institutional AI is that dynamic across the whole organization.

The part that turns a feature into a moat is where the loop lives. The context is built entirely from one firm's own work, so it is specific to that firm and useless to anyone else. A competitor running the identical product, on the identical underlying model, with the identical connectors, builds a model of their organization, not yours. The moat, in this reading, is the accumulated institutional context, and because it is assembled from one firm's own work, it does not transfer. The intuition is old: management researchers have long held that the knowledge embedded in an organization's own people, tasks, and tools is the hardest thing for a rival to copy, and so a real source of advantage (Argote and Ingram). What a harness adds is that it captures and acts on that knowledge continuously, instead of leaving it latent in people's heads. This is a different kind of defensibility than the ones enterprises are used to reasoning about. It is not a patent, which discloses. It is not a copyright, which can be designed around. It is not the model, which everyone rents from the same handful of labs. It is the compounding, private byproduct of running the business, and it deepens rather than erodes as the underlying models get cheaper and better, because cheaper and better models make the harness more useful, which feeds the loop.

It is worth being honest about what the moat is not. It is not the connectors. Pulling data from HubSpot, Gmail, Drive, Notion, Slack, or a meeting recorder is becoming a commodity capability, increasingly standardized through shared protocols. It is not the foundation model, which is the most rented input in the entire stack. And it is not, by itself, the interface, which competitors copy within a release cycle, as the agentic IDE market has demonstrated repeatedly. The defensible asset is the thing in the middle that none of those components contain on their own: the learned, governed, continuously updated model of how this particular institution works. That is, plausibly, much of what an acquirer would be paying for, and what a departing vendor would take with it, a point worth holding onto for later.

The vantage point: observability for the organization itself

Here is the insight that most discussions of enterprise AI miss, and the one that makes institutional AI more than a faster way to do the same work. Because the harness sits across everyone's work in order to help each person, it occupies a vantage point no human, and no traditional enterprise system, has ever held at the same semantic depth. It can surface contention and correlation at a layer of the organization that was previously invisible, and it can do so without a manager reading anyone's individual messages. The harness earns its view across the whole organization precisely because it is doing each person's individual work, which means visibility is not a separate feature but a dividend of participation.

Engineers already have a word for this. We instrumented our software systems years ago with distributed tracing and telemetry, because once a request crosses a dozen services, no single service owner can see where latency accumulates or why failures correlate. Observability gave us the system-level view that no component had on its own. Institutional AI is observability for the organization itself: tracing the flow of work the way we trace the flow of requests, surfacing the cross-cutting patterns that each individual contributor, seeing only their slice, cannot.

The patterns it can surface are exactly the ones that matter and that nobody currently catches in time. Contention shows up as a CRM record marked healthy and green while the support tickets and the account's discussion channel describe a relationship that is quietly going sideways: the dashboard and the ground truth disagree, and until now nobody held both at once. It shows up as two teams independently scoping the same capability, or a commitment a salesperson made on a call that contradicts the published roadmap, or a decision reversed across two meetings that no one noticed reversing. Correlation shows up as the discovery step that, when skipped, predicts a higher churn rate, or the deploys that bypassed review clustering with the next week's incidents, or the features most requested on sales calls never appearing in the roadmap, a demand and supply gap visible only to something that reads both sides.

The honest framing matters here, because aggregate organizational signal is not new and a serious reader knows it. Organizational network analysis, productized in Microsoft's Viva Insights, has surfaced collaboration patterns for years, but from metadata: who contacted whom, how long the meeting ran, how many messages moved. Process mining, led by Celonis, already reconstructs how work actually moves across systems and flags bottlenecks, rework loops, and deviations, and it is mainstream rather than fringe: Forrester runs a dedicated Process Intelligence Wave, in which Celonis was named a leader in the third quarter of 2025. The category even contains the seed of the institutional-AI idea, because process mining reads what a system's logs show actually happened rather than what a process document claims should happen. Forrester now frames process intelligence as a way to give agents live context and process grounding rather than a static report, echoing the way Celonis has begun describing itself as a context layer for AI rather than only a source of visibility.

The part that is easy to undersell is that this vantage point is general-purpose. Because the harness reads the actual work rather than any one function's data, the signals it can surface span the whole business at once: commercial patterns in how deals progress, operational signal in where work stalls or doubles back, product signal in what customers keep asking for, capacity signal in who is quietly the critical path, financial signal in where committed and recognized work drift apart, and risk signal in what looks anomalous. It is not a tool aimed at any one of these. It is a way of reading the institution that can be turned toward whichever correlation matters this quarter, which is what makes it strategic rather than a single-purpose dashboard.

That breadth is worth separating from two narrower lenses it is easy to conflate with, since both are real and neither is the same thing. One watches the agents themselves: the AgentOps tooling and the observability built into platforms like Salesforce's Agentforce, which treat every agent run as a kind of distributed trace so a team can replay what an agent did, a lens trained on the machinery. The other watches how employees and agents use AI, where platforms such as Harmonic Security categorize the tools in use and classify the intent of each interaction rather than matching patterns, a lens trained on risk that reflects Harmonic's own point that security has always been the function closest to how the business actually operates. Both capture a slice of the same activity, and both matter, but the strategic prize is the broad reading of the work, with safety and risk as signals it can surface rather than the reason it exists.

What is genuinely new sits in two specific places. Those older systems, organizational network analysis and process mining, read metadata and structured event logs; institutional AI reads the content and meaning of unstructured work, the actual decisions and promises and contradictions inside the emails, meetings, channels, and documents, and can reason over what they mean rather than only counting them. And the earlier systems were analyst products, separate dashboards someone had to remember to consult; institutional AI surfaces the signal from inside the flow of work, as a byproduct of doing it. The move is from metadata to meaning, and from the dashboard to the flow. That is what makes "a layer never before visible" a defensible claim rather than a marketing line, and it is also, as the next section argues, exactly where the danger lives.

The same vantage point is also a panopticon

The promise that the harness surfaces organizational signal without intruding on individual conversations is the most valuable claim in the entire concept, and it is the single hardest one to keep. The reason is structural. The capability that lets the system flag healthy contention is the same capability that, with a configuration change and a manager's intent, turns it into surveillance. Aggregate insight without individual exposure is a design and governance achievement, not a free property of the technology.

The cautionary tale is already on the record. Microsoft's first serious attempt at organizational visibility, Workplace Analytics and its Productivity Score, drew enough backlash over surveillance that Microsoft removed individual user names from the product in 2020 and later repositioned the capability as Viva Insights, built around private personal recommendations. The engineering response was real: differential privacy, minimum group sizes, and de-identification meant to keep individuals from being singled out. And yet the standing critique, made by practitioners and analysts alike, is that these protections are policy rather than technical enforcement, and that the line between well-being insight and performance surveillance depends entirely on how leadership chooses to use the dashboards. One Gartner analyst described the same product, fairly, as both a surveillance tool and a productivity enhancement tool. The duality is the point. Institutional AI inherits it and amplifies it, because it sees meaning rather than metadata.

There is a subtler hazard beyond surveillance, and it cuts at the flywheel itself. A system that learns how work moves through the organization learns how work moves today, including the dysfunction. Left unexamined, the loop can entrench the current way of doing things, encoding a broken approval chain or a political reporting line as if it were the natural order, and making it harder to change precisely because the system now depends on it. And someone has to decide what counts as contention worth surfacing. A harness that flags dissent against the prevailing plan as a problem to be resolved, rather than a signal to be weighed, can quietly chill the disagreement that healthy organizations depend on. The lens has politics, and whoever configures the lens exercises real power over what the organization is allowed to notice about itself.

For an executive, the cleanest way to feel the stakes is to ask where the vantage point lives. The owner of the institutional harness holds the most complete X-ray of the firm's operations ever assembled: not a sampled survey, not a quarterly dashboard, but a continuous, semantic view of how the whole place actually runs. If that owner is the firm itself, that is an extraordinary capability under its own control. If that owner is a vendor, the firm has handed a third party the most intimate map of its operations that has ever existed, which raises the contest over who owns the layer from a procurement question to a governance one.

Who ends up owning the institutional layer

Five kinds of company are climbing the same hill from different faces, and an executive trying to place a bet is really choosing which ascent to trust. None of them yet stands at the top.

The pure-play horizontal bet, exemplified by Glean, treats the institutional layer as a new category that sits above every application and stays neutral on which underlying model it uses. Its advantage is the vantage point itself: a product designed from the start to reach across the whole stack and build the context model. Its exposure is that it must out-integrate and out-execute the incumbents who already own the surfaces where employees spend their days, and it has no distribution moat of its own to fall back on.

The productivity-incumbent bet, run by Microsoft with Copilot and Google with Gemini Enterprise, is to own the layer by owning the surface people already live in. Microsoft has wired Copilot into the Graph so it can reason over a customer's own data inside the security perimeter, and pushed Copilot Studio and its agent-governance tooling hard into the enterprise. The advantage is distribution that nobody can match, more than 450 million seats. The exposure is that paid adoption, now in the tens of millions and growing, is still a low-single-digit share of that base, and that Microsoft has had to reposition Copilot from an assistant into a context layer to reach the institutional value, a move that concedes the thesis even as the company races to own it. Owning the surface is necessary. The evidence so far says it is not sufficient.

The foundation-lab bet, made by OpenAI with ChatGPT Enterprise and its connectors and by Anthropic through the Model Context Protocol, is that the model is the product and that context should be pulled to the model rather than the other way around. ChatGPT Enterprise has built a connector system that lets it search corporate email, documents, and applications under role-based administrative controls, and MCP is becoming common plumbing for giving agents access to tools. The advantage is the best raw reasoning and a protocol that could make the connector layer genuinely open. The exposure is that raw reasoning over freshly connected data is not the same as a governed, accumulated model of how the institution works, and the protocol that makes access easy also makes it risky, a point the security data underscores below.

The system-of-record bet, advanced by Salesforce with Agentforce, Workday with Sana, and ServiceNow, is that the institutional layer belongs where the governed data, the permissions, and the audit trail already live. Agents that run inside Salesforce inherit its sharing rules and log every action; agents inside Workday inherit its controls over people and finance data. The advantage is governance and trust by construction, which is exactly what regulated buyers want. The exposure is scope: each of these sees its own domain deeply and the rest of the organization barely, and the promise of institutional AI is precisely the cross-domain view that no single system of record contains.

The build-your-own bet is that no single vendor will own the layer and that sophisticated enterprises will assemble it themselves on top of an open protocol, renting models and standardizing connectors while keeping the context model under their own roof. The advantage is control and the avoidance of lock-in at the most sensitive layer. The exposure is that the integration and knowledge-architecture work is brutal, and most organizations underestimate it badly.

The meta-point is that these are five routes up one mountain, and the likeliest outcome is not a single winner but a plural market shaped by ecosystem gravity, the same pattern the rest of enterprise software has followed. A firm deep in Microsoft will drift toward Copilot, a firm deep in Salesforce toward Agentforce, a firm that distrusts all of them toward assembly. The decision that actually matters to a buyer is not which logo to pick but a more uncomfortable one: whether the institutional context, the genuinely defensible asset, should accumulate inside a vendor's proprietary layer or somewhere the firm controls. Choosing a vendor for the harness is reasonable. Letting the vendor own the X-ray is a different decision, and most organizations are making it without noticing they are making it.

What is hard, and what is still in flux

The optimistic case has to survive contact with how badly this is going in practice. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls, and its analysts describe most current efforts as early-stage experiments driven by hype and frequently misapplied. That is the base rate the institutional-AI thesis is running against, and it is sobering.

The deepest obstacle is not model capability; it is knowledge architecture. A recent analysis of agentic software development made the point that enterprises accumulate decades of institutional knowledge, including architectural decisions, deployment procedures, and incident playbooks, but that this knowledge stays trapped in formats designed for human interpretation rather than machine action, so the binding constraint is how that knowledge is structured, not how smart the model is. The same logic generalizes well beyond code. A harness can only reason about how work flows if the firm has done the unglamorous work of definitions, ownership, and permissions, of saying what a qualified lead is, who owns a given process, and which roles may see what. The organizations that skip this and expect the model to infer everything are the ones whose pilots stall, and it is the reason so many demos that look magical on a clean slice fall apart on the genuine complexity of a real company.

Governance is the second gate, and it is the one that decides whether any of this reaches production in a regulated environment. An institutional harness that acts across systems raises questions that an assistant answering a single prompt never did: which agent took which action, under what policy, on whose authority, and can it be reversed. The role of the senior operator shifts from doing the work to supervising the agents that do it, setting the boundaries of autonomy and auditing the decisions. The tooling for that supervision, the ability to replay an agent's reasoning, reverse an action cleanly, or prove which policy governed a given step, remains immature across most products, which is part of why so many efforts stall at the pilot stage rather than crossing into production. The attack surface grows in step with the connectivity. Gartner, which singles out the Model Context Protocol by name, projects that a quarter of enterprise generative-AI applications will suffer at least five minor security incidents a year by 2028, up from 9% in 2025, as organizations build agentic AI on protocols like MCP that were designed for ease of use before security. The same openness that lets the harness reach everything is what lets an attacker, or a careless configuration, reach everything too.

There is a final obstacle that is really the adoption gap in another form. Institutional AI has to beat the personal AI that employees already smuggle in. If the sanctioned harness is slower, clumsier, or less capable than the consumer tool a developer or analyst already pays for out of pocket, people route around it, and the flywheel never starts, because the observation that feeds the loop depends on the work actually flowing through the system. The lesson of Copilot's long, slow climb from distribution to genuine use is not that distribution is worthless. It is that a tool people are given but do not choose generates the appearance of adoption and very little of the compounding context that makes institutional AI valuable in the first place.

The fork in the road

Strip away the vendor positioning and the strategic questions for an operator are reasonably clear. Where does the institutional context accumulate, and who controls it. What is the foundation of definitions, ownership, and permissions that any of this depends on, and is the firm willing to do that unglamorous work before expecting the magic. How is autonomy bounded and audited as agents move from drafting to acting. And which is the firm actually optimizing for, the cost savings of doing today's work faster, or the harder and less commoditized prize of seeing and deciding better than competitors who lack the same vantage point. None of these is a directive. They are the questions that separate the organizations that will compound an advantage from the ones that will cancel a project in 2027.

The shape of the market is becoming legible even if the winners are not. This will almost certainly be plural rather than winner-take-all, with the foundation labs, the productivity incumbents, the systems of record, the pure-play horizontals, and the in-house assemblers all reaching the same position from different starting points, and with each firm's existing stack exerting a gravitational pull toward one of them. That is the familiar pattern of enterprise software, and there is little reason to expect this layer to break it.

What is not yet decided is the question that matters most, and it is worth ending on because it determines whether institutional AI is a liberation or a trap. The institutional context, the living model of how a firm works, is the most valuable and most sensitive asset in this entire shift. The open fork is whether that context becomes portable, an asset the firm owns and can carry from one vendor to the next, or whether it becomes sticky, a moat the vendor owns and the firm rents back at the price of total dependence. If it is portable, institutional AI hands every organization a compounding advantage built from its own work and a continuous, honest view of itself. If it is sticky, the same technology hands a small number of platforms the most intimate map of the economy's operations ever drawn, and quietly makes every firm a tenant on top of its own institutional memory. The technology will support either outcome. Which one a firm gets is not a feature it can buy. It is a decision it has to make, and most have not yet noticed it is theirs to make.