For sixty years the intelligence in the enterprise sat outside the machine that ran the business. The AI-native company moves that intelligence inside, and must control what it can touch rather than what it will decide.
Enterprise computing comes down to one question: where does the program live? For sixty years it lived where we put it: on punch cards, then in application code, then in the database and the code written around it. Now it is moving into the model, a component that decides for itself.
When the program moves, three other things move with it. Behavior: who decides what the system does, and whether that is authored in advance by a person or elicited from a model as it runs. Truth: what the business treats as real. Correctness: where the guarantee lives when something has to be right.
Through every tech migration so far, the three moved together. The current era is the first to break the pattern. Behavior has moved into the model, but truth and correctness have not, and the gap between them is why enterprise AI keeps disappointing. The model now makes the decisions, while the record of what is true and the checks on whether it is right still sit in systems built for a time when a person made them. Better models and tighter autonomy settings won’t fix that.
An AI-native company is one whose truth and correctness have moved to where its behavior now lives. Every claim to be AI-native should answer one question: when the model is wrong, and it sometimes will be, which layer holds the guarantee?
The adaptive component used to be a person
Take a workflow every large company runs: a supplier invoice arrives and does not match its purchase order.
In 1965 a batch job flagged the mismatch on a printout. Behavior was authored down to the column, and truth was a master file on tape. Correctness was established by hand, before the job ran, by a programmer desk-checking the deck. The adaptive loop was a clerk reading the printout, deciding what to do, and a programmer re-punching the deck if the rule needed to change. The machine executed, but it never decided.
Thirty years later the mechanism was unrecognizable and the arrangement was identical. The ERP ran a three-way match, and the rule for what counted as a match lived in configuration and stored procedures, executing verbatim, forever. Truth was the table, guarded by the DBA. Correctness lived in constraints and at compile time. The mismatch routed to an approver’s queue, and the only adaptive component in the diagram was still a person, moved from the keypunch to a webform.
Everything the enterprise knows how to govern was designed for that arrangement. Behavior changes only when someone changes text (including code). The text is an artifact a person can read. A second person can check the first. Audit, change management and accountability all descend from one property: run it again, get the same answer.
The bolt-on inverted one thing
Then the machine grew an adaptive component of its own. From late 2022, the part that read a situation and responded to it no longer had to be a person. Few businesses got to absorb that calmly, because their competitors could reach for the same component, and the pressure pointed one way: put the model to work inside the systems that already run the company, quickly, without rebuilding anything.
The fastest way to do that is with a bolt-on. An agent loop plans, acts and observes, and a frontier model decides what happens next. Underneath, nothing changes: same schema at the center, same APIs, same authored workflows.
Back to the invoice. The agent now reads the invoice, the purchase order and the email thread with the supplier, and decides whether to approve, hold or reroute. It does the job the approver did, but does it faster and around the clock. It also has the authority to decide without owning any of the systems it decides about. State, truth, business rules and interfaces all stay where they were, and the estate still looks to the database for what is real. The model makes the decisions, but every system it depends on was designed as if a person were still making them.
Guardrails get wrapped around it to compensate, but a guardrail only stops the failures somebody thought of first. The prompt says never approve above a threshold. It does not say anything about the supplier who split one invoice into four.
A stochastic component cannot be checked for correctness before it runs, so the guarantee is forced to relocate to runtime whether anyone planned for it or not, and most of the industry is improvising that relocation. The audit still happens and the change board still meets. The artifact they inspect no longer determines what the system will do.
Set the eras side by side and the fault is easy to find.
Era III is where most enterprises are standing, and it is the only era whose columns disagree with each other. Era IV is the inversion: truth and correctness move to join behavior, producing the first architecture designed for a stochastic core rather than retrofitted around one. Era V is where most of the industry assumes this ends up: a company whose whole system is the model, with the database reduced to a tool it consults. That is possible for a company started this year with no obligations to anyone outside it. It is not possible for an existing enterprise, which has to keep records an outside party can check, and the section on Era V argues this case. For an existing enterprise, Era IV is the most likely destination.
What the exoskeleton holds
Behavior. The model still decides, exactly as in the bolt-on. The difference is that it decides inside a boundary somebody authored. The boundary is a control plane carrying identity, access and audit, and inside it a harness holding execution authority over what the agent may touch and what crosses in either direction. In the invoice case, the harness grants the agent read access to the invoice, the order and the correspondence, and grants exactly two write actions: place a hold, or route to a named approver. Approval is not in the world the agent can act in. A model that decides for itself, inside limits a person wrote down and can read, is the only version of this a regulated business can approve.
Truth. Where a system’s behavior is authored, there is source text, and reading it tells you what the system will do. A system whose behavior is elicited has no such text, and that missing text is the truth column the bolt-on skipped. The nearest thing an elicited system has is the trace: the complete record of each run, what the model saw, what it decided, what it touched, and what came back.
The table remains the record of the business and the trace does not compete with it. The trace is the record of the system’s own conduct, and in Era IV it is treated as a system of record rather than a log, because of what it is used for, not what it contains. When the auditor asks why the hold was placed, the trace is the answer, and it is the only answer there is. Source code used to answer that question. Nothing else now can. So the truth column gains a second entry rather than replacing the first.
Correctness. Because a component that can give a different answer to the same input cannot be verified, the design puts a deterministic one between it and the world, and that substitution is the main reason the exoskeleton exists. The guarantee stops being a claim about how the model will behave, which nobody can honestly make, and becomes a claim about what the model is able to do at all, which is ordinary software. A rule the model is asked to follow is only a request, while an action the harness never grants cannot happen, however the model reasons. The guarantee covers what the model can reach, not what it will answer.
Across those three columns the deterministic code has changed jobs. It no longer does the work. It decides what the work is allowed to touch, and it keeps the record.
The fourth column
Behavior, truth and correctness are enough to describe the first three eras. Era IV needs a fourth. Learning: what does the system carry forward from its own work?
For every earlier era the answer is nothing. For the first two that was deliberate, because a system that revised its own behavior would have broken every control built on top of it. For the bolt-on it is an accident. The model arrives with general capability and takes nothing from the encounter, so the twelfth agent starts exactly where the first one started and costs exactly what the first one cost. Every dollar buys the work in front of it and nothing beyond it, which is how software was paid for before platforms existed.
Era IV can answer the question, and only because truth moved first. Once the trace is a source of record, the system holds a complete account of its own work, and that account is what learning feeds on. A frontier model works out each answer from scratch every time it is asked. Most enterprise work is the same shape recurring. A system that cannot learn pays full price forever for answers it has already found and checked.
The invoice queue shows what recurrence looks like. After a few hundred runs, one pattern dominates: freight surcharges that push the total a few percent over the order. The agent reasons its way to the same hold-and-route outcome every time. That is the work to pin.
This is the part most descriptions of learning agents skip, so it’s important to be specific about how the pin happens and who controls it.
A candidate for pinning has to meet three conditions in the trace: the same inputs keep producing the same decision, the decision keeps passing the runtime check, and the inputs are ones the harness can match deterministically. When a pattern qualifies, the system proposes a procedure. A person approves it. The procedure is text again: a rule that says freight surcharges under a stated tolerance route to accounts payable without the model. It has an owner, it goes through the change board, and from that point it runs without the model at all.
Pinned procedures do not stop being traced. That is how staleness gets caught. If the supplier’s freight terms change and the pinned rule starts routing invoices that fail the downstream check, the trace shows it, the procedure is retired, and the work softens back into reasoning until a new pattern earns its place. Hardening and softening are both decisions made against evidence, and both are recorded.
The learning happens in the shell around the model, and the result is a live boundary between work that still needs reasoning and work that has hardened into procedure. Novel work stays expensive, because it should be. Everything that crosses the line stops being expensive, and the share that has crossed grows with every run. For that share, the property the bolt-on broke comes back: the change board once more inspects an artifact that determines what the system will do. The thirteenth agent starts with the procedures the first twelve produced.
Why the inversion stops at Era IV
Era V moves everything that is left. Intelligence becomes the system rather than a component inside it. Truth is weights and accumulated memory, and the database is demoted to a tool. Code stops being an asset, because the durable program is the specification and the eval suite, and a correct implementation can be regenerated on demand.
Some subsystems should never make this move, and the reason is stronger than habit. A ledger exists to be legible to an outside party: a regulator, a counterparty, a court. Its value is that someone outside the company can reconstruct what happened from the record itself, extending no trust to the system that produced it. A system that regenerates its implementation from a spec is legible at the level of intent. A ledger has to be legible at the level of the record. A better model does not turn the second requirement into the first.
Era V is open to a company that owes no record to anyone outside it. That describes a company built from nothing in the last year. It does not describe an existing enterprise. As long as any subsystem must be legible at the level of the record, and every enterprise has several, the estate keeps a deterministic core and the model reasons around it. That is Era IV by definition. The line always exists, but it moves. Any split decided once and written down will be wrong within months, because the business keeps changing.
So the durable artifact is not any particular partition of the estate, and it is certainly not the agents, which get cheaper every quarter and were always the easy part. It is the machinery that keeps re-deciding the partition against evidence, and can show what it decided, when, and on what basis.
Three questions to ask of any vendor
The framework is new, but it is already enough to test a platform against.
Show me the harness. Which actions can the agent take in my environment, where is that list held, and who changes it? If the answer is a prompt, there is no guarantee, only an instruction the model may or may not follow.
Show me the trace for a run that went wrong. Can I reconstruct what the model saw and did from the record alone, without asking the vendor?
Show me a procedure this system has pinned. What evidence qualified it, who approved it, and what happens when it stops passing?
A vendor who can answer all three is selling Era IV. A vendor who can answer none is selling a bolt-on with a longer prompt.
Any company can run a fleet of agents. An AI-native company has moved its truth and correctness to where its behavior now lives, and it can show, from its own record, where the line between reasoning and procedure sits today, who moved it, and why. When the model is wrong, that is the layer that holds.