The Permission Paradox: Why Your CEO Needs to Fight InfoSec Before You Do

I watched it happen in real time at a Fortune 500 cybersecurity company.

The board decided AI was the future. A mandate flowed down: “Present your AI adoption plans.” Middle management dutifully passed the hot potato to their teams. Teams — with no clear mission, no vision, no defined goals — started hunting for tools on their own.

Every single initiative hit the same wall: InfoSec.

Months of approval processes. Painful back-and-forth. Tool after tool was rejected. Meanwhile, the people who actually needed AI to do their jobs were stuck copy-pasting between ChatGPT on their personal phones and corporate systems they weren’t supposed to bridge. Classic shadow AI — the exact security nightmare InfoSec was trying to prevent.

This is what I call The Permission Paradox: C-level executives mandate AI adoption but never use it themselves. They can’t feel the friction. So they can’t fix it.

And it’s not just my company. Today’s headlines confirm it: AI agents are already disrupting entire markets. Monday.com, Salesforce, and Thomson Reuters have lost 30%+ of their stock value as autonomous AI agents begin replacing the SaaS tools enterprises spent decades adopting. As investor Shay Boloor put it: “Never had tech disruption at this scale.” The companies still stuck in the permission paradox aren’t just falling behind — they’re watching their entire software stack become obsolete.

The Numbers Are Brutal

The enterprise AI landscape in 2025/2026 is still a graveyard of good intentions:

88% of organizations use AI in at least one function, but only a small fraction see real scaled value (McKinsey State of AI 2025)
~95% of generative AI pilots fail to deliver measurable P&L impact (MIT research patterns persist)
~74% of companies struggle to scale AI beyond pilots (BCG patterns 2024–2025)
78%+ of AI users bring their own tools without IT approval — shadow AI is the norm (Microsoft Work Trend Index)

The consulting industry loves to frame this as a technology problem. It isn’t. As Deloitte correctly identified, successful AI implementation requires 70% focus on people and processes, 20% on technology, and only 10% on algorithms.

It’s an organizational problem. Specifically, it’s a leadership problem.

The Middle-Out Trap

Here’s the pattern I’ve seen — and lived — across organizations:

Board mandates AI → demands plans from middle management
Middle management delegates to teams
Teams lack context — they know HOW but not WHY. Goals passed mouth-to-mouth get diluted
Every initiative hits InfoSec → months of approval battles
Frustrated employees go rogue → shadow AI everywhere
InfoSec tightens controls → more friction → more shadow AI

It’s a death spiral. And it starts at the top.

Flowchart of middle-out AI adoption failure pattern — Middle-out failure pattern

The Fix: Executives Must Feel the Pain First

The solution is counterintuitive but backed by data: the CEO needs to use AI daily before anyone else.

Not as a demo. Not watching a presentation. Actually using it for their real work — querying data, preparing for meetings, drafting communications.

Here’s what happens when they do:

The CEO tries to ask their AI assistant about a client’s profitability. The AI can’t access Salesforce. It can’t see Jira. It can’t read Slack history. The CEO immediately understands why their employees are frustrated — because they feel it themselves.

The data support this approach:

Firms with CEO-led AI initiatives report significantly higher ROI and success rates
Professionals under leaders who lead by example are much more likely to see AI benefits
Moderna achieved very high adoption when the CEO personally championed and used AI tools
Many large banks see high adoption rates because leadership established clear boundaries from the top down

When someone with organizational influence feels the pain, they can actually do something about it: start the data federation work, so AI tools can access communication platforms, ticketing systems, project management, financial systems, email, and file storage.

Identity Shock: Why People Really Resist AI

Here’s something most AI adoption frameworks completely miss. The highest-risk moment for professional crisis isn’t job loss — it’s the months after successfully learning AI.

People don’t resist AI because they can’t learn it. They resist it because it challenges their professional identity. When a senior engineer watches an AI replicate in seconds what took them years to master, the threat isn’t to their job — it’s to their identity.

This is why top-down mandates with mandatory training programs backfire. They trigger defensive posturing. The fix? Start with micro-habits. Small, low-stakes wins that let people build a new professional narrative — one where they’re the orchestrator of AI, not its competitor. Which brings us to the 11-by-11 rule.

What I Actually Built (When the Walls Finally Came Down)

After months of fighting for access, I built systems that proved the thesis. It’s not about saving time — it’s about doing things that were simply impossible before.

Meeting → Automatic Project Updates: Every meeting is transcribed → AI agent checks tickets, updates them, and creates new ones only when needed. In the first week, 187 tickets and updates were automatically generated. High-level meetings produced ~30 structured tickets each.
Meeting Prep Agent: Reduced preparation from hours to 15–30 minutes — but the real gain is quality and depth of insight.
Weekly AI Reporting: Complete team activity report from every commit, repo change, and comment. Tailored for each stakeholder. Minimal fixes needed.

Before vs. After: The Real Impact

Metric	Before AI	After AI
Ambiguity	High	Low
Information loss	High	Low
Information retention	Low	High
Stakeholder communication	Poor, error-prone	We know exactly what we’re doing

The IKEA “Banana Cards”: Permission to Experiment

IKEA’s “Banana Cards” — co-signed passes that explicitly granted employees permission to experiment with AI and “go bananas” without fear of reprimand — is a powerful lesson.

Critical caveat: experimentation MUST happen in an isolated sandbox. No client data. No production. Only internal data. Once value proven → earn trust → expand access.

The 7-Step Adoption Framework

How to implement AI in your organization:
1. Decision maker starts using AI daily (the higher the level, the better)
2. They experience the friction firsthand
3. The main pain of lower-level employees is now seen and felt at the highest level
4. Data federation begins — connect communication, ticketing, project mgmt, finance, email, storage
5. Permissions and data access cascade down
6. Users adopt or innovate
7. Success: faster, better, and things previously impossible become routine

The 11-by-11 Rule: Start Small

Microsoft research on Copilot users found the tipping point: save just 11 minutes per day for 11 weeks, and AI permanently shifts from “annoying new tool” to “indispensable assistant”.

That’s it. Start with meeting summaries. Email drafts. Code reviews. Let the habit compound.

But those 11 minutes are impossible when InfoSec blocks access — which is why the CEO needs to feel that friction first.

The Architecture That Should Exist

My ideal state (which I’m actively building):

Every person has a personal agent talking to specialized company agents
Agents access specific RAGs and MCPs for company knowledge
Agents evolve with the user — acquiring skills/tools
Skill and tool exchange between agents
Agents join meetings and proactively surface relevant data

The permission paradox won’t solve itself. It requires someone with enough organizational power — and enough personal experience with AI — to break the cycle.

Start at the top. Feel the friction. Then fix it for everyone.

Krzysztof Sajna is an IT Manager building AI adoption frameworks that actually work.
Follow the full discussion on
LinkedIn
and
X (@kasajna).