The cost of no authority layer.
Executives don’t buy architecture. They buy the end of specific, recurring pain. Each of the costs below is what it takes to run infrastructure with no authoritative model of what is allowed — paid again every quarter, by a different team.
Six line items you already pay.
None of these appears on a budget as “missing authority layer.” They appear as audit findings, overruns, incidents, and stalled initiatives — which is exactly why they persist.
Failed audits
When ownership, intent, and change history aren’t modeled, audits become archaeology. Teams reconstruct who changed what under deadline — and any control that can’t be evidenced becomes a finding.
Repatriation overruns
Moving workloads off cloud — or back to it — runs over budget when no one holds an authoritative model of dependencies and blast radius. The surprises surface mid-migration, when they cost the most.
Security investigations
With no model of what is legitimate, every anomaly is investigated from zero: was this change authorized or not? Investigations that should take minutes stretch into days of reconstruction.
Change failures
Changes fail when their full blast radius isn’t known before they execute. Review catches some; the rest become incidents — each one a post-mortem that rediscovers a dependency no one had modeled.
Documentation drift
Documentation is written once and decays immediately, because it’s maintained by hand and kept separate from reality. By the time it’s needed, it describes a system that no longer exists.
AI deployment delays
AI initiatives stall at the safety review: no one can guarantee an agent will act within bounds, because the bounds were never modeled. The pilot works; the rollout waits on trust that can’t be established.
Every line item above is the interest you pay on authority that was never modeled.
The same operations, run with authority instead of inference.
An IOM doesn’t add a process on top of these problems — it removes their cause. Evidence is produced as a byproduct of operating, blast radius is known before execution, legitimacy is deterministic, and AI acts inside an explicit boundary instead of waiting outside one.
The costs above don’t get managed down. They stop being generated.
Put a number on your own.
The starter kit includes a gap analysis that maps these costs to your environment — so the business case is yours, not a vendor’s.