Restrictive AI policies “feel” responsible. They’re also one of the most reliable ways to make sure your AI investment never pays off.
There’s a sentence that comes up when I meet with technology leaders about AI. It’s never the first thing anyone says. It shows up after we’ve covered the budget, the tools, the security review and the board, usually in a quieter voice:
“I don’t want to ALWAYS be the one who says no.”
I know the feeling. When a new technology arrives, IT’s reflex is to fence it in until we understand it: approved tool lists, locked-down access, a review board, a policy that mostly describes what you’re not allowed to do.
With AI, I’ve come to believe that reflex is one of the biggest reasons the return hasn’t shown up.
What “no” buys you in an AI decision
Let me give restriction its due first, because the people writing these policies aren’t wrong about the risks. Data walks out of the building. Token bills climb with no warning. Regulators ask questions that are near-impossible to answer, and a CTO or CIO who shrugged at any of that would be negligent.
But look at what restriction is buying.
Pick your survey and the number moves. McKinsey’s 2025 State of AI found 39% of organizations reporting any EBIT impact from AI. A survey of 380 C-level executives put the share scaling AI with strong returns at about 7%. The numbers disagree with each other. They agree on the direction.
When I look at the companies I actually know in that small group, the common thread isn’t the best model or the tightest policy. It’s that they have people who use AI every day, including on the executive team. Q2 is one of them. I recently sat down with Adam Blue on their Cut to Context podcast, and it’s obvious within five minutes that the people steering their AI decisions are practitioners.
That’s the problem with restriction. It sets the floor, which is what it’s built to do. It also sets the ceiling. The value in AI comes from people who know the tools well enough to build what matters for their own work, and you never get those people if access is frozen at the level of the least experienced user in the company.
Here’s the uncomfortable part: restriction doesn’t even work very well. What policy stops someone from taking a screenshot of a Salesforce running in a browser on their laptop and pasting it into a personal chatbot on their phone? I can’t think of one.
So, the alternative is to make the sanctioned option so good that people would rather use it.
We said “yes” first
That’s what we tried to do with AI Studio, the internal AI platform we built at Presidio. I’ll be honest about how we did it, because it isn’t the textbook method.
We didn’t have a governance framework when we first deployed it. We didn’t build a training or enablement program first, either. We put it in people’s hands.
That sounds reckless, so here’s what made it defensible. Every user’s workspace is isolated, all the way down to where the files live and where the code runs. My agent can’t reach into your workspace unless you explicitly share something with me, so if someone puts data where they shouldn’t, the blast radius is one person.
Think of it like a house. If the place is a mess but nobody outside the family knows, that’s a private problem. The trouble starts when things leave the house.
Isolation let us start before we had a complete governance policy, which was lucky, because we couldn’t have written one. Nobody knew what all the rules should be. You find out by watching people actually use the tools and seeing the patterns.
We got things wrong along the way. The upside of going first is a long list of “don’t do that, we already broke it” that we now get to hand to clients.
The expensive middle
Watch enough people adopt AI and you start to see the same progression. “What is AI?” “This beats web search.” “Agents are neat.” “Agents are awesome.” “I need more tokens.” “More tokens, please?” “Okay, build with less bloat. Lean and mean.”
Cost doesn’t rise steadily along that path. It spikes in the middle, when people discover agents and run them inefficiently: loops inside loops, sub-agents calling sub-agents, the same work done three times. Rework is the biggest driver of token spend I’ve seen in agentic workflows, and then, as people get fluent, spend comes back down because they learn to build lean.
To be clear, that’s a pattern I’ve drawn from watching our own people and our clients, not a curve from a controlled study. But value climbs the whole way through, and that’s the part most policy misses.
Most restrictive policies are an attempt to keep people out of the expensive middle. The trouble is that the middle is where fluency gets built. Block it and nobody reaches the lean end; leave it unmanaged and the bill scares the CFO into shutting everything off.
The goal is to get people through the middle faster, without the bill.
Here’s what that looks like for us: Alongside the commercial models in AI Studio, we run an open-weight model on our own hardware. In a recent 30-day window it handled about 8.8 billion tokens across roughly 101,000 requests.
Billed at commercial rates, it would have been our third-largest AI expense, somewhere around $6,000 to $7,000. Our variable cost was zero.
Before anyone writes in: yes, we paid for the hardware. That’s the point. A fixed cost is a number you decide once; a variable cost is a number your most curious people have to think about every time they try something.
One of our engineers ran about 5 billion of those tokens in a couple of weeks. That’s roughly $4,000 of exploration he would never have run on a metered model, because he knew what it would cost. “I find so much value in having it there to innovate and explore at rapid speed,” he wrote to me, “but at fixed costs, zero variable cost.”
Without that, his three weeks of work probably would have happened 10 months from now. More likely, not at all.
My colleague Caitlin Schuman put the underlying point better than I can: “Tokens are the atomic unit of AI. They are not the atomic unit of value.” Five billion tokens tell you nothing about what Ryan’s three weeks cost us, or what they were worth. That’s the question to answer before your next budget cycle, and you’ll answer it far better once your people have actually used the tools.
Earn the next level
So, if not restriction, what?
Think about how games work. You don’t start with the best gear or on the hardest level; you earn them, one boss fight at a time. The progression feels fair because the challenge grows with your ability, and you don’t resent a level you worked for.
That’s how we approach access. People start in an isolated workspace with plenty of room to explore and very little room to hurt anyone. As they show they can judge the output, they get more: more capable tools, more data, more autonomy.
Governance stops being the gate in front of the work. It becomes the thing that decides who’s ready for more.
The same logic answers the regulated-industry question I get constantly. If your data can’t leave the building, keep the AI in the building too. Start everyone on models you host yourself, build fluency there, then open up commercial AI services as the patterns become clear.
Where I still say “no”
None of this means anything goes.
User-initiated work, one person in their own isolated workspace, is largely a solved problem for us. Autonomous agents are not. Once an agent runs on its own, across systems, on behalf of people with different rights to see different things, identity and access get hard fast.
The CRO can see every account and a rep can see their own. An agent serving both has to know the difference every single time. This is the next area of focus for our development efforts – exploring options between build, buy, and integration with partner solutions – as no one has fully solved for this yet.
It gets stranger. Agents will tell you they did something, and then you read the trace and find they got the right answer by a route you never approved, skipping steps or guardrails you put there on purpose. A correct answer is not proof the workflow worked.
That’s where caution belongs. Not on the analyst who wants to try something new in their own workspace. On the autonomous system that can touch everything.
I still say no. I just say it about far fewer things than I used to, and I’m far more confident they’re the right ones. It took us a while to learn which things those are.
We learned it by saying yes first.
