The Governance Gap Behind AI's Infrastructure Problem

Jonah Kowall
Spacelift

Ask an infrastructure team how confident they are in their ability to govern AI, and most will tell you they've got it handled. A recent survey of 406 IT decision-makers and platform engineering leaders found 86% expressing exactly that confidence. Ask the same group whether they have a formal written AI governance policy, and the number drops to 30%, according to Spacelift's Infrastructure Automation Report.

That gap between how safe organizations feel and how prepared they actually are is becoming a serious blind spot in enterprise IT, one which will increase in importance as the operational damage increases. 93% of organizations surveyed said they'd experienced at least one AI-related infrastructure incident in the past year. Major operational issues caused by AI-generated changes, security misconfigurations that reached production, compliance violations, infrastructure drift, and incidents tied to agentic systems each affected roughly a third of respondents.

Pace, Not Carelessness

The cause looks less like carelessness and more like a matter of pressure on existing resources. 89% of respondents said AI increased development velocity, and 86% of infrastructure teams said their workload has increased as a result. Pipeline strain is up 37%, and change volume is up 40% at the average organization. Development is accelerating faster than the systems meant to deploy and govern the code being built and put into production, and infrastructure teams along with cloud providers are absorbing the difference.

Part of the paradox is that governance capability often already exists and isn't switched on. 60% of respondents said their tooling vendor is what determines how much governance they can enforce, yet 38% of organizations with governance-capable tooling in place have never turned it on. It would be worth digging into why this is the case, but I suspect complexity or lack of time. In many of these organizations, confidence rests on capabilities that nobody is actually using.

4 Levels of Readiness

How well an organization handles this transition has little to do with size. Large enterprises appear in every tier of the report's four-tier framework, alongside smaller companies. The real differentiator is whether governance and automation were built before AI adoption accelerated, or whether they were catching up by retrofitting controls after the fact.

The numbers prove the point. Among organizations in the top tier, the "Pioneers," 71% enforce a written governance policy. Among the farthest behind, "Exposed," that number is 4%. Here is the breakdown of the different maturity groups:

  • Pioneers (19% of respondents): built governance and automation before adopting AI and report fewer incidents.
  • Outpacing (approx. 25%): moving aggressively on AI while governance lags.
  • Fragmented (32%, the largest group): adopted AI unevenly across teams with no consistent oversight.
  • Exposed (approx. 25%): running AI in production without the governance to manage it safely, often while feeling just as confident as everyone else.

The Automation Divide

There is also a divide in the infrastructure foundations underneath governance policies. Pioneers report infrastructure-as-code coverage above 75%, and more than 90% say their infrastructure is fully or mostly automated. Exposed organizations average just 15% infrastructure-as-code coverage and 14% automation.

Platform engineering adoption follows the same pattern. A quarter of high-performing organizations have already shifted toward platform engineering, compared with only 2% of Exposed organizations. This is important because platform engineering creates governed, self-service paths that allow developers to move quickly without bypassing security, compliance, and approval controls. The compliant path becomes the easy path rather than the slow one.

Vibe Coding Reaches Infrastructure

The risks become especially clear as vibe coding moves into infrastructure. 76% of respondents said they would approve AI-generated infrastructure code with little or no review, and 33% said they conduct no review at all — shocking! Among that no-review group, 93% had already experienced an AI-related infrastructure incident.

The problem is not simply that teams are using AI-generated code. It is that many are trusting it without the governance, automation, and policy controls needed to make that speed safe. In infrastructure, one bad change can affect security, compliance, availability, and cloud spend at once. This all begs the question: what should teams put in place first?

Where to Start

For teams starting from behind, the fix is more discipline than budget. Write the governance policy down before building any technology including the approval workflows around it. Ensure that you require both automated and manual testing, with a human in the loop for high-risk changes by adding drift detection and audit trails to ensure changes are traceable. An infrastructure-as-code coverage target above 75% is a reasonable starting goal for teams that are behind. Implementing these controls is not a large time commitment, but having ownership is essential for success.

The Next Test: Agentic AI

The hardest is yet to mature. 89% of respondents plan to adopt agentic AI for infrastructure operations, and 24% expect to do so within six months. With governance policy adoption still stuck at 30%, that combination is a recipe for disaster. Agentic systems don't just suggest changes; they make decisions which includes provisioning resources, altering configurations, and responding to incidents with break/fix implementations independently, often with no human in the loop.

One useful pattern emerging among mature organizations: automating the application of low-risk changes, while higher-risk changes are flagged for a person to review. Either way, deterministic policy enforcement is necessary, rules which will block changes. Using an LLM for policy is not a good idea as it will provide varying results on each run, and auditing how they work is a challenge.

The Bottom Line

Teams should not slow down AI adoption. The Pioneer data suggests the opposite: the organizations moving fastest with the fewest incidents are the ones that built governance and automation, not the ones that waited. The gap between confidence and readiness won't close on its own. It closes when governance stops being an afterthought and becomes part of how infrastructure gets built in the first place.
 

Jonah Kowall is SVP of Product and Design at Spacelift

Related Links

Hot Topics

The Latest

As AI Scales Across Enterprises, Breaking Points Emerge

Rapid AI adoption and the unique ways AI workloads operate is redefining the scope and structure of what these teams must deliver. This shift is forcing organizations to rethink how they manage scale, automation, and control, according to The State of SRE and Platform Engineering 2026, a new report from Dynatrace ...

Preparing Network Infrastructure for AI Starts with the Basics

AI is usually talked about as a software tool, but it also depends heavily on the network behind it. Whether a company is using AI for chatbots, automation, monitoring, analytics, or employee support, all of that information has to move across the network in a reliable and secure way. That means AI is not just an application decision. It is also an infrastructure decision. Before organizations rush into AI, they should ask a simple question: Is our network ready to support it? ...

Agentic Operations Begin with Governed Middleware Access

Enterprise AI often lacks governed access to where business processes actually execute. Without that access, AI agents may be able to reason, but they cannot operate reliably across enterprise workflows. For AI agents to effectively carry out workflows, they will require integration-layer context and controls. Organizations can implement these prerequisites by providing AI with managed access to the middleware layer ...

The Network Data Problem Slowing Down Enterprise AIOps

Enterprise networks rarely behave the same way for very long. A routing adjustment in one region may unexpectedly alter application performance in another. A cloud migration may introduce hidden dependencies that go unnoticed until an outage occurs. All the while, the network is managed by several different teams, each of whom use different tool sets — and as a result, have different views of the network ... There’s usually an engineer who remembers why traffic fails over a certain way between sites, or which transparent firewall was added where. The problem is that human memory cannot scale alongside enterprise-scale networks ...

The Governance Gap Behind AI's Infrastructure Problem

Ask an infrastructure team how confident they are in their ability to govern AI, and most will tell you they've got it handled. A recent survey of 406 IT decision-makers and platform engineering leaders found 86% expressing exactly that confidence. Ask the same group whether they have a formal written AI governance policy, and the number drops to 30%, according to Spacelift's Infrastructure Automation Report ...

MEAN TIME TO INSIGHT Podcast - Episode 27: Observability Unification

In MEAN TIME TO INSIGHT Episode 27, Shamus McGillicuddy, EMA VP of Research, Network Infrastructure and Operations, and Parker Hathcock, EMA Research Director covering IT Service/Operations (ServiceOps), discuss observability unification in modern IT operations ... 

5 Reasons Traditional VPNs Struggle in a Cloud-First World

Virtual Private Networks became a cornerstone of enterprise security at a time when corporate infrastructure looked very different from today ... For years, this model worked well. But the architecture behind VPNs assumed a centralized corporate environment—one where the network itself was the hub of activity. In a cloud — first world, that assumption no longer holds ...

What 1.8 Million Outages Say About Who Is Really On Call in August

Website outages get resolved just as fast in August as they do in November. I went looking for the opposite: the summer slowdown everyone assumes is there once the people who fix things are away. It isn't in the data we collected, covering 1.8 million confirmed outages across tens of thousands of websites ...

Why Enterprises Are So Unhappy with Their IT Infrastructure

This year, many of the cloud infrastructure contracts signed in the early days of the AI boom will come up for renewal. As the year goes on, I anticipate we'll see a significant amount of cloud vendor swapouts and multi-cloud adoption, and the reason isn't just GPU depreciation. It's because they're tired of their current cloud providers ...

Agentic AI Just Became Your Newest Production Dependency. Are You Tracking It Like One?

There's a moment the many observability teams have experienced days into bringing a new service into production: you realize that the vendor's claims of "intelligent" behavior included a large serving of hype. Their dashboards look nice until they don't, the failure modes are a black box, and no one on the team can confidently explain why the system did what it did at 2 am. Agentic AI is about to force every Ops team to relive that moment at web-scale until they start treating these systems as the dependencies they actually are ...

The Governance Gap Behind AI's Infrastructure Problem

Jonah Kowall
Spacelift

Ask an infrastructure team how confident they are in their ability to govern AI, and most will tell you they've got it handled. A recent survey of 406 IT decision-makers and platform engineering leaders found 86% expressing exactly that confidence. Ask the same group whether they have a formal written AI governance policy, and the number drops to 30%, according to Spacelift's Infrastructure Automation Report.

That gap between how safe organizations feel and how prepared they actually are is becoming a serious blind spot in enterprise IT, one which will increase in importance as the operational damage increases. 93% of organizations surveyed said they'd experienced at least one AI-related infrastructure incident in the past year. Major operational issues caused by AI-generated changes, security misconfigurations that reached production, compliance violations, infrastructure drift, and incidents tied to agentic systems each affected roughly a third of respondents.

Pace, Not Carelessness

The cause looks less like carelessness and more like a matter of pressure on existing resources. 89% of respondents said AI increased development velocity, and 86% of infrastructure teams said their workload has increased as a result. Pipeline strain is up 37%, and change volume is up 40% at the average organization. Development is accelerating faster than the systems meant to deploy and govern the code being built and put into production, and infrastructure teams along with cloud providers are absorbing the difference.

Part of the paradox is that governance capability often already exists and isn't switched on. 60% of respondents said their tooling vendor is what determines how much governance they can enforce, yet 38% of organizations with governance-capable tooling in place have never turned it on. It would be worth digging into why this is the case, but I suspect complexity or lack of time. In many of these organizations, confidence rests on capabilities that nobody is actually using.

4 Levels of Readiness

How well an organization handles this transition has little to do with size. Large enterprises appear in every tier of the report's four-tier framework, alongside smaller companies. The real differentiator is whether governance and automation were built before AI adoption accelerated, or whether they were catching up by retrofitting controls after the fact.

The numbers prove the point. Among organizations in the top tier, the "Pioneers," 71% enforce a written governance policy. Among the farthest behind, "Exposed," that number is 4%. Here is the breakdown of the different maturity groups:

  • Pioneers (19% of respondents): built governance and automation before adopting AI and report fewer incidents.
  • Outpacing (approx. 25%): moving aggressively on AI while governance lags.
  • Fragmented (32%, the largest group): adopted AI unevenly across teams with no consistent oversight.
  • Exposed (approx. 25%): running AI in production without the governance to manage it safely, often while feeling just as confident as everyone else.

The Automation Divide

There is also a divide in the infrastructure foundations underneath governance policies. Pioneers report infrastructure-as-code coverage above 75%, and more than 90% say their infrastructure is fully or mostly automated. Exposed organizations average just 15% infrastructure-as-code coverage and 14% automation.

Platform engineering adoption follows the same pattern. A quarter of high-performing organizations have already shifted toward platform engineering, compared with only 2% of Exposed organizations. This is important because platform engineering creates governed, self-service paths that allow developers to move quickly without bypassing security, compliance, and approval controls. The compliant path becomes the easy path rather than the slow one.

Vibe Coding Reaches Infrastructure

The risks become especially clear as vibe coding moves into infrastructure. 76% of respondents said they would approve AI-generated infrastructure code with little or no review, and 33% said they conduct no review at all — shocking! Among that no-review group, 93% had already experienced an AI-related infrastructure incident.

The problem is not simply that teams are using AI-generated code. It is that many are trusting it without the governance, automation, and policy controls needed to make that speed safe. In infrastructure, one bad change can affect security, compliance, availability, and cloud spend at once. This all begs the question: what should teams put in place first?

Where to Start

For teams starting from behind, the fix is more discipline than budget. Write the governance policy down before building any technology including the approval workflows around it. Ensure that you require both automated and manual testing, with a human in the loop for high-risk changes by adding drift detection and audit trails to ensure changes are traceable. An infrastructure-as-code coverage target above 75% is a reasonable starting goal for teams that are behind. Implementing these controls is not a large time commitment, but having ownership is essential for success.

The Next Test: Agentic AI

The hardest is yet to mature. 89% of respondents plan to adopt agentic AI for infrastructure operations, and 24% expect to do so within six months. With governance policy adoption still stuck at 30%, that combination is a recipe for disaster. Agentic systems don't just suggest changes; they make decisions which includes provisioning resources, altering configurations, and responding to incidents with break/fix implementations independently, often with no human in the loop.

One useful pattern emerging among mature organizations: automating the application of low-risk changes, while higher-risk changes are flagged for a person to review. Either way, deterministic policy enforcement is necessary, rules which will block changes. Using an LLM for policy is not a good idea as it will provide varying results on each run, and auditing how they work is a challenge.

The Bottom Line

Teams should not slow down AI adoption. The Pioneer data suggests the opposite: the organizations moving fastest with the fewest incidents are the ones that built governance and automation, not the ones that waited. The gap between confidence and readiness won't close on its own. It closes when governance stops being an afterthought and becomes part of how infrastructure gets built in the first place.
 

Jonah Kowall is SVP of Product and Design at Spacelift

Related Links

Hot Topics

The Latest

As AI Scales Across Enterprises, Breaking Points Emerge

Rapid AI adoption and the unique ways AI workloads operate is redefining the scope and structure of what these teams must deliver. This shift is forcing organizations to rethink how they manage scale, automation, and control, according to The State of SRE and Platform Engineering 2026, a new report from Dynatrace ...

Preparing Network Infrastructure for AI Starts with the Basics

AI is usually talked about as a software tool, but it also depends heavily on the network behind it. Whether a company is using AI for chatbots, automation, monitoring, analytics, or employee support, all of that information has to move across the network in a reliable and secure way. That means AI is not just an application decision. It is also an infrastructure decision. Before organizations rush into AI, they should ask a simple question: Is our network ready to support it? ...

Agentic Operations Begin with Governed Middleware Access

Enterprise AI often lacks governed access to where business processes actually execute. Without that access, AI agents may be able to reason, but they cannot operate reliably across enterprise workflows. For AI agents to effectively carry out workflows, they will require integration-layer context and controls. Organizations can implement these prerequisites by providing AI with managed access to the middleware layer ...

The Network Data Problem Slowing Down Enterprise AIOps

Enterprise networks rarely behave the same way for very long. A routing adjustment in one region may unexpectedly alter application performance in another. A cloud migration may introduce hidden dependencies that go unnoticed until an outage occurs. All the while, the network is managed by several different teams, each of whom use different tool sets — and as a result, have different views of the network ... There’s usually an engineer who remembers why traffic fails over a certain way between sites, or which transparent firewall was added where. The problem is that human memory cannot scale alongside enterprise-scale networks ...

The Governance Gap Behind AI's Infrastructure Problem

Ask an infrastructure team how confident they are in their ability to govern AI, and most will tell you they've got it handled. A recent survey of 406 IT decision-makers and platform engineering leaders found 86% expressing exactly that confidence. Ask the same group whether they have a formal written AI governance policy, and the number drops to 30%, according to Spacelift's Infrastructure Automation Report ...

MEAN TIME TO INSIGHT Podcast - Episode 27: Observability Unification

In MEAN TIME TO INSIGHT Episode 27, Shamus McGillicuddy, EMA VP of Research, Network Infrastructure and Operations, and Parker Hathcock, EMA Research Director covering IT Service/Operations (ServiceOps), discuss observability unification in modern IT operations ... 

5 Reasons Traditional VPNs Struggle in a Cloud-First World

Virtual Private Networks became a cornerstone of enterprise security at a time when corporate infrastructure looked very different from today ... For years, this model worked well. But the architecture behind VPNs assumed a centralized corporate environment—one where the network itself was the hub of activity. In a cloud — first world, that assumption no longer holds ...

What 1.8 Million Outages Say About Who Is Really On Call in August

Website outages get resolved just as fast in August as they do in November. I went looking for the opposite: the summer slowdown everyone assumes is there once the people who fix things are away. It isn't in the data we collected, covering 1.8 million confirmed outages across tens of thousands of websites ...

Why Enterprises Are So Unhappy with Their IT Infrastructure

This year, many of the cloud infrastructure contracts signed in the early days of the AI boom will come up for renewal. As the year goes on, I anticipate we'll see a significant amount of cloud vendor swapouts and multi-cloud adoption, and the reason isn't just GPU depreciation. It's because they're tired of their current cloud providers ...

Agentic AI Just Became Your Newest Production Dependency. Are You Tracking It Like One?

There's a moment the many observability teams have experienced days into bringing a new service into production: you realize that the vendor's claims of "intelligent" behavior included a large serving of hype. Their dashboards look nice until they don't, the failure modes are a black box, and no one on the team can confidently explain why the system did what it did at 2 am. Agentic AI is about to force every Ops team to relive that moment at web-scale until they start treating these systems as the dependencies they actually are ...