The Multiplication Problem
A curious pattern emerges from this week's governance landscape: every attempt to add control creates new surfaces that need controlling. Treasury wants AML/CFT frameworks for stablecoin issuers. Federal contractors face new DEI-related compliance clauses. Vercel discovers that OAuth integrations with AI tools create unexpected attack vectors. Each solution spawns its own governance challenge.
This isn't just regulatory accumulation — it's governance sprawl. Organizations aren't simply adding new requirements to existing frameworks; they're creating entirely new control domains that overlap, conflict, and multiply the very risks they're meant to mitigate.
The OAuth Paradox
Vercel's breach through a compromised AI integration tool perfectly illustrates the sprawl problem. The company implemented OAuth to enable secure third-party integrations — a governance best practice. But when an employee connected Context.ai, that very security mechanism became the attack vector. The control designed to manage access risk created a new access risk.
This mirrors what's happening across the governance landscape. Stablecoin issuers implementing Treasury's proposed AML/CFT requirements will need to monitor not just traditional financial transactions, but also smart contract interactions, cross-chain movements, and DeFi protocol integrations. Each monitoring point becomes a potential failure point. Each integration requires its own security assessment.
The traditional approach — add more controls — no longer works when the controls themselves become the complexity.
The Compliance Collision
Federal contractors now face a particularly acute version of this problem. The new Executive Order on DEI-related contract clauses doesn't exist in isolation. These organizations already navigate:
- Existing equal opportunity requirements
- State-level DEI mandates (often conflicting with federal positions)
- Corporate ESG commitments to investors
- International subsidiaries' local employment laws
The result? Compliance teams must now maintain multiple, potentially contradictory policy sets for the same workforce. A multinational contractor might need one set of DEI policies for U.S. federal work, another for California state contracts, and a third for European operations. The governance sprawl isn't just adding complexity — it's creating inherent conflicts that no amount of documentation can resolve.
The Discovery Dilemma
Even the courts are grappling with governance sprawl. As generative AI enters legal discovery, judges must now consider protective orders that address not just traditional document handling, but also:
- AI training data contamination
- Model memory of privileged information
- Cross-case information leakage
- Hallucination risks in AI-assisted review
The protective order — a fundamental governance tool in litigation — must now govern technologies that didn't exist when the Federal Rules of Civil Procedure were last substantially updated. Courts are essentially writing new governance frameworks on the fly, case by case, creating a patchwork of precedents that will take years to harmonize.
The Architecture of Exhaustion
Perhaps most telling is the emergence of movements like "Free Your IT" in enterprise architecture. When governance becomes so complex that entire communities form around escaping it, we've reached a tipping point. The Big Tech "lock-in" that EA Voices describes isn't just about vendor control — it's about governance exhaustion. Organizations are so overwhelmed managing compliance across multiple platforms that they'll accept vendor lock-in just to reduce the number of governance frameworks they must maintain.
This exhaustion shows up in subtle ways:
- ERP adoption guides now focus as much on change management as on technical implementation
- Vulnerability summaries like CISA's weekly report contain hundreds of items, making prioritization nearly impossible
- Even recycling programs create new compliance obligations, as companies must now track and govern the entire lifecycle of discarded materials
The Path Forward: Consolidation Over Accumulation
The solution isn't more governance — it's smarter governance. Organizations need to shift from accumulating controls to consolidating principles. Instead of separate frameworks for AI security, OAuth management, and third-party risk, they need unified approaches that address the underlying risks regardless of the specific technology or regulation.
This means:
- Statement-level governance that can be assembled into different policy configurations without rewriting entire documents
- Risk-based prioritization that focuses on outcomes rather than compliance checkboxes
- Automated policy assembly that can generate context-specific governance documents from a single source of truth
- Continuous monitoring that identifies when controls create new risks
The irony is stark: in trying to control everything, we're controlling nothing effectively. The path forward requires not just adding new governance capabilities, but fundamentally rethinking how governance accumulates and interacts across an organization.
As regulatory requirements continue to multiply and technologies create new risk surfaces faster than policies can address them, the organizations that thrive will be those that master consolidation over accumulation. They'll build governance systems that bend without breaking, that add new requirements without multiplying complexity.
The alternative — continuing down the path of governance sprawl — leads only to paralysis. When every action requires checking dozens of overlapping frameworks, when every new technology creates more governance requirements than it solves, when compliance becomes so complex that it requires its own compliance framework, we've lost the plot entirely.
The future belongs to those who can govern more with less.
Sources
- Treasury Proposes AML/CFT and Sanctions Compliance Requirements for Permitted Payment Stablecoin Issuers — Volkov Law — Corruption, Crime & Compliance
- Preparing for Compliance with New Executive Order’s DEI-Related Contract Clause for Federal Contractors and Subcontractors — NYU PCCE Enforcement
- Top techniques attackers use to infiltrate your systems today — CSO Online
- Hackers exploit Vercel’s trust in AI integration — CSO Online
- Sidley Discusses Protective Orders and Generative AI in Discovery — CLS Blue Sky Blog (Columbia Law)
- Rule 14a-8 Permits Precatory Proposals, and the SEC Can’t Just Say It Ain’t So — CLS Blue Sky Blog (Columbia Law)
- Your ERP Adoption Rate Guide — Prosci Change Management
- Declaring Independence: Why We Are Starting the “Free Your IT” Movement — EA Voices
- Why your recycled clothes could end up in this South American desert — BBC Business