A credit officer opens the next file. The model has already scored it. The recommendation is presented in the language of a conclusion, not a question. The applicant history is partial. The adverse signals are summarised, but not explained. The queue target is brutal: two hundred decisions an hour, with exceptions watched more closely than approvals. There is an override button. Everyone knows what happens when it is used. The officer must write a reason, create an audit trail, slow the queue, and invite a manager into a decision the system has already made feel finished.

On the workflow diagram, this is human-in-the-loop.

In the room, it is theatre.

That distinction is where the Enablement pillar stops being the soft part of the framework. In the first essay in this series, I argued that AI governance becomes real when it can change a decision before the decision becomes something the organisation has to explain afterwards. Reversibility is central to that claim. But reversibility cannot be made operable by a mailbox, an appeals page, or a generic assurance sentence after launch. It depends on people inside the workflow who can contest the system before harm hardens.

The workforce is the contestability layer. Without D11.2 meaningful human review, D6.4 reversibility is theatre.

This is the unpopular part of enablement, because it does not sound like enablement. It sounds like workflow design, authority, time allocation, evidence quality, and consequence management. That is exactly the point. Training alone does not make a human review step meaningful. A capable operator with no time is a rubber stamp. A well-intentioned operator with no evidence is guessing. A trained operator with no authority is decoration. An authorised operator without the skill to recognise failure modes is a liability.

D11.2 has to be tested against four conditions: skill, time, evidence, and authority.

Skill means the person understands the decision they are reviewing, the permitted role of the model, the common failure modes, and the moments where escalation is required. This is not generic AI literacy. It is role-tier literacy tied to a real workflow. Learning-design specialists determine curriculum content and sequencing; the operating model determines whether the organisation has defined the capability requirement by role, risk, and decision authority.

Time means the operator has a real intervention window. Not the theoretical ability to pause a case while the queue punishes them for doing it. Not a service-level target that treats challenge as waste. If the business model requires a human to approve two hundred AI-shaped decisions an hour, the design is making a claim about the depth of review. Often the claim is false.

Evidence means the operator can see enough to challenge the recommendation. The file must expose the decision basis, uncertainty, missing data, policy rule, model contribution, and any vendor-generated summary in a form that can actually be used. A score without context is not evidence. A green, amber, red label is not evidence. A model explanation written for procurement due diligence is not evidence for a frontline decision.

Authority means the operator can change, escalate, or stop the outcome without being punished for slowing the machine. This is where many regulated-industry designs fail the most quietly. The override exists, but it is socially expensive. The escalation path exists, but it is operationally inconvenient. The manager says judgement is welcome, while the dashboard ranks staff by throughput. Review is human in name and automated in behaviour.

The legal and employment boundaries matter here. AI operating models affect job design, consultation, monitoring, and sometimes redundancy. HR and employment counsel determine redundancy and consultation timing. Privacy counsel determines privacy obligations under the Privacy Act 1988 (as amended by the Privacy and Other Legislation Amendment Act 2024). Anti-discrimination specialists determine protected-attribute questions in HR analytics. The framework does not pretend to answer those specialist questions. It asks whether they have been surfaced early enough to shape the design, rather than discovered after rollout.

The cascade is the reason this small pillar is load-bearing.

If D11.2 fails, D6.4 fails with it. Reversibility is not only a later path for an affected customer, employee, supplier, citizen, or internal stakeholder to challenge an AI-enabled outcome. It is also the earlier design discipline that makes intervention possible while the decision is still alive. A human cannot reverse what they cannot see. They cannot contest what they are not trained to question. They cannot stop what the organisation has made unsafe to stop.

That is why the dependency map matters. The dimensions do not sit beside each other as a neat catalogue. They feed each other. Workforce capability feeds contestability. Contestability makes reversibility usable. Reversibility supports the framework’s larger claim that AI governance can change a decision in time.

D12.1 carries the other half of the cascade. Adoption instrumentation is often reduced to activity: licences assigned, active users, workshop attendance, number of prompts, number of automations, number of champions. Those numbers may be useful. They are rarely enough. The harder question is whether the organisation can distinguish adoption, dependency, avoidance, compliance, workaround behaviour, and realised value.

That distinction feeds D2.2. A stop-or-pivot threshold is not a statement of executive discipline. It is a decision that needs signal. If a customer-service assistant is rarely used in complex cases, the reason might be poor answer quality, latency, distrust, missing workflow fit, or fear of accountability. If a credit workflow shows very few overrides, the system might be excellent, or the review layer might be intimidated. If an agentic workflow completes tasks while staff quietly rebuild the work around it, the productivity dashboard may be hiding operational debt.

Without D12.1, D2.2 has no evidence to act on.

This does not mean turning the workforce into a measurement surface. Adoption instrumentation has to be proportionate, lawful, and honest about what metrics can prove. Statisticians and UX researchers determine adoption-metric methodology: sampling, attribution, bias, interpretation, and whether the data actually supports the inference being made. Employment and privacy specialists determine legal constraints where workplace and personal information are involved. The operating-model question is narrower and still difficult: what signal would cause us to scale, redesign, constrain, or stop?

Board literacy sits at the top of this stack. The AICD has been explicit: directors need enough AI literacy to ask better questions. For prudentially regulated entities, APRA expects board AI literacy under standards governing risk, outsourcing, operational resilience, data, and customer outcomes.

That does not mean directors need to build models. It means they need to spot three distinctions:

The framework has only two Enablement dimensions: Workforce and HITL, and Adoption and Change. That small count is misleading. Pillar 3 is where the organisation learns whether the other pillars are real. Strategy can define posture and stop thresholds. Responsible agentic AI can define reversibility, observability, and incident handling. Enablement is where people either receive the conditions to contest the system, or become the surface that lets the system pass as governed.

That is the Monday-morning question for a CHRO, transformation lead, risk executive, or accountable business owner: when the model recommendation is wrong, can the human actually change the AI decision?

If the answer depends on heroics, the pillar is not soft. It is already failing.

This is the third pillar essay in the thesis blog. The next essay drills into D1 Strategy and Leadership: where AI leadership becomes a named accountability path rather than a preferred title. New essays publish each Tuesday and Friday morning at 06:00 AEST. If you’re new here, About is where to start; Archive collects the rest.