Governing generative AI in organizations: a design theory and quasi-experimental field study of sociotechnical guardrails

You’re listening to “Governing generative AI in organizations: a design theory and quasi-experimental field study of sociotechnical guardrails,” by Maikel Leon. Published in The Journal of Supercomputing on August 16, 2026.

Abstract.

Generative AI adoption has outpaced organizational governance capabilities. We conceptualize AI guardrails as sociotechnical governance mechanisms, comprising policy, technical, and workflow components that embed organizational norms in deployed AI systems. Extending norm-based coordination accounts, we specify three mechanisms (norm encoding, output monitoring, and escalation) targeting four prop-erties: predictability, fairness, safety, and auditability. We instantiate the theory in a three-layer artifact at a Fortune 500 firm and evaluate it through a stepped-wedge quasi-experiment covering 20 teams, 28 weeks, and 10,200 interactions. Guardrails reduced interaction entropy by 35%, narrowed the fairness gap from 0.18 to 0.05, halved hallucinations, and raised audit-trail completeness from 53% to 96%, at a 12% task-time cost and a temporary satisfaction decline.

At least 35% of teams cir-cumvented guardrails perceived as opaque or disproportionate, identifying perceived legitimacy as a boundary condition. Analysis of nine US executive orders (2019–2025) yields design implications for regulatory resilience.

Generative AI systems are no longer experimental tools confined to research and development contexts; they now sit at the operational core of organizations across industries. A 2024 survey found that more than 65 percent of firms had deployed gen-erative AI in at least one business function, more than double the share recorded one year earlier, with the heaviest adoption in software development, knowledge manage-ment, and client-facing professional services. The speed of adoption is remarkable.

Equally remarkable are the governance failures that have accompanied it. A legal AI system fabricated judicial citations submitted to a federal court. A healthcare resource-allocation model encoded racial bias at scale. A financial services chatbot disclosed confidential client data to unauthorized users. These incidents are not isolated; they reflect a systemic pattern in which organizations deploy powerful AI systems before the governance mechanisms needed to make those systems predictable, fair, and traceable are in place.

The governance challenge posed by generative AI is qualitatively distinct from that of prior algorithmic decision systems. Classical predictive models operate within fixed feature spaces and produce bounded outputs that can be validated against known distributions. Generative models, by contrast, produce open-ended natural language, recommendations, and artifacts whose correctness, safety, and fairness cannot be verified by comparing outputs to a reference distribution. The stochastic and context-dependent nature of generative outputs means that governance mechanisms must operate at the point of generation and interaction, not merely at the point of model training or deployment, a shift that existing IS governance frameworks have not yet accommodated.

The information systems (IS) literature has engaged this challenge with growing urgency. Scholarship documents algorithm aversion among users who distrust opaque models, the blackboxing of algorithmic decisions across organizational layers, thepersistenceoffairnessfailuresinautomatedsystems,andthediffusionofhuman responsibility to machine agents. This diagnostic tradition is valuable, but it focuses on how people respond to algorithms already in place rather than on how organizations can design governance mechanisms that proactively shape what algorithms do. A complementary design-theoretic tradition in IS builds prescriptive knowledge about governance artifacts, but has not yet been applied systematically to AI guardrails. The question of how to build governable AI systems from the inside out remains, at present, largely unanswered in IS research.

In practice, technology teams and enterprise architects have converged on an informal answer: AI guardrails. As the term is used in industry, guardrails refer to configurations of policy, technical, and workflow mechanisms embedded within or around AI systems that constrain outputs, guide user interaction, and enforce organi-zational norms. The concept is widely referenced in enterprise AI documentation and regulatory guidance, and IS theory has recently begun to catch up: develop the first IS design theory of guardrails, conceptualizing them as norm-based coordi-nation mechanisms and proposing design principles for predictability in human–AI ecologies. Yet three consequential gaps remain.

Guardrail theory to date is centered on a single target property (predictability), whereas the governance failures documented above implicate fairness, safety, and auditability as well; the theory has not been instan-tiated and evaluated in a production deployment, so there is no causal field evidence of guardrail effectiveness under realistic organizational conditions; and the behavioral boundary conditions under which guardrails fail, most importantly user circumven-tion, remain untheorized. Organizations are therefore investing substantial resources in guardrail implementations whose multi-property performance and behavioral limits remain unclear. Section 2.4 develops this positioning in detail.

This paper addresses those gaps on three fronts. First, building directly on the norm-based coordination account of, we develop a formal construct definition and an extended design theory for AI guardrails, grounded in sociotechnical systems theory, algorithmic governance, and human–AI coordination research. The theory specifies three guardrail mechanisms (norm encoding, output monitoring, and escalation) and four target organizational properties (predictability, fairness, safety, and auditability), and maps the mechanism-to-property relationships through testable hypotheses. Sec-ond, we instantiate the theory in a three-layer guardrail artifact (policy, technical, and workflow layers) deployed at a Fortune 500 professional services firm, following established design science prescriptions.

Third, we evaluate the theory’s effec-tiveness through a stepped-wedge quasi-experimental field study spanning 20 teams, 400 users, and 28 weeks, using pre-trend validation and multiple robustness checks to support causal inference. To place the findings in a regulatory context, the study also analyzes nine US presidential executive orders on AI governance from 2019 to 2025, a period during which federal AI policy shifted dramatically between administrations and created new design constraints for enterprise guardrails.

The study makes three contributions to IS research. First, it consolidates and extends the emerging IS construct of AI guardrails, broadening the norm-based coordination account of from predictability to a four-property theory that spans predictabil-ity, fairness, safety, and auditability. It also bridges the algorithmic governance and human–AI coordination literatures to provide a foundation for cumulative inquiry into AI governance mechanisms. Second, it offers the first instantiation and causal field evaluation of a guardrail design theory, with formally specified design require-ments, a production artifact, and pre-trend-validated quasi-experimental evidence. Third, it identifies perceived legitimacy as a boundary condition for guardrail effec-tiveness, establishing workaround behavior as a theoretically important phenomenon that governance designs must anticipate.

The paper proceeds as follows. Section 2 reviews cumulative IS traditions and adjacent literature on AI governance, closing with an explicit positioning against the closest prior design theory. Section 3 develops the conceptual foundation. Section 4 presents the research model and hypotheses. Section 5 describes the guardrail artifact and its mapping to established design science guidelines and design theory compo-nents. Section 6 surveys the US federal AI governance landscape. Section 7 presents the research methodology. Section 8 reports results. Section 9 discusses theoretical, methodological, practical, and policy implications. Section 10 concludes.

2 Literature review and theoretical positioning

BuildingcumulativeISknowledgerequiressituatingnewconstructswithinestablished research traditions and articulating what prior work cannot explain. This section first reviews the IS streams most directly relevant to AI guardrails, then identifies the specific explanatory gap that motivates this study, and closes by reviewing the concept of guardrails as it appears in adjacent literature.

2.1 Cumulative IS traditions on algorithmic governance and human–AI work

Three IS research streams are most directly relevant to the guardrail construct.

The IS literature on algorithmic decision making and governance documents the organizational consequences of deploying automated decision systems, encompassing algorithm aversion, blackboxing of decisions across organizational layers, del-egation of responsibility to machine agents, and the systemic failures that emerge when algorithmic systems operate without adequate oversight. This stream establishestheorganizationalstakesofgovernancefailuresandprovidesvalidatedcon-structs (including aversion, delegation, and accountability diffusion) that the guardrail framework must theoretically accommodate. Its limitation, for the purposes of this study, is that it is diagnostic rather than prescriptive: it characterizes what goes wrong but not how to build mechanisms that prevent it.

The IS literature on human–AI coordination examines how humans and intelligent systems jointly perform work. This stream establishes that effective coordi-nation requires predictable AI outputs and interpretable explanations so that users can decide when to delegate, override, or escalate. Prior work shows that coordination fail-ures arise from unpredictable system behavior, cognitive overload in oversight tasks, and the erosion of human accountability when errors can be attributed to the machine. This stream provides the coordination rationale for guardrails (they exist to structure and stabilize the human–AI interaction interface) but does not specify how such structures should be designed.

The IS design science tradition provides the methodological logic for building and evaluating governance artifacts. Design science research produces artifacts that instan-tiate kernel theories within specific problem contexts, evaluated against functional requirements derived from the organizational environment. IS design theories must specify a meta-requirement (the class of goals the design satisfies), a meta-design (the class of artifacts that satisfy it), kernel theories (the scientific foundations), and testable design hypotheses. This framework is applied explicitly in Sect. 5. The design science tradition provides the architectural logic for integrating the findings of the preceding two streams into a prescriptive theory of guardrail design, but has not been applied previously to AI guardrail systems.

Together, these three streams establish the intellectual space occupied by the guardrail construct: it sits at the intersection of algorithmic governance (what AI sys-tems need to achieve), human–AI coordination (how humans and AI systems interact), and design science (how governance artifacts should be built and evaluated). Recent work has begun to occupy this space (most directly the guardrail design theory of, examined in Section 2.4), but the streams collectively still leave open the questions this paper addresses: a multi-property specification of what guardrails must achieve, field evidence of whether they achieve it, and an account of when and why they fail.

2.2 Governance failures in enterprise generative AI

The field site that motivates this study is a Fortune 500 professional services firm that introduced a generative AI copilot to assist management consultants with summarizing client documents, drafting deliverables, and generating recommendations. Because tool capability shapes both failure modes and governance requirements, we disclose the system’s technical profile at the outset. The copilot was built on a commercially licensed, GPT-4-class large language model with retrieval over the firm’s approved knowledge bases; it supported document upload, long-context summarization, and free-form drafting, but had no autonomous (agentic) task execution capability. The same model version was held fixed for the duration of the study reported in Sect.

7, so the findings characterize governance of a specific, disclosed capability generation; the implications of the rapidly moving capability frontier for the durability of these findings are taken up in Sections 9.6 and 9.7. Initially deployed through a general-purpose chat interface with minimal constraints, the system gave consultants the ability to upload proprietary client data, request predictions about engagement outcomes, and act on AI outputs directly without review or oversight.

Within the first six months of production operation, the organization encountered four distinct categories of governance failure that collectively made the unguarded deployment untenable. The first was factual unreliability: the system produced hal-lucinated citations, fabricated statistics, and confidently incorrect domain claims that consultants, under time pressure, passed to clients without verification. This is the pattern that management research has labeled “botshit,” the uncritical organizational use of hallucinated chatbot content, and that recent large-scale industry evi-dence identifies as a majority behavior among enterprise AI users when the human labor of verifying AI output goes unmanaged and unrewarded.

The second was bias propagation: outputs contained gendered language in staffing recommendations and racially stereotyped descriptions in market analyses, replicating a pattern well documented in large-scale NLP systems. The third was security exposure: sen-sitive client data were disclosed to unauthorized users through multi-session context leakage, and the system was susceptible to prompt injection attacks, consistent with risks documented in complex multi-system IT environments. The fourth was accountability collapse: interaction logs were incomplete, there was no reliable record of when consultants acted on AI recommendations rather than on independent judg-ment, and responsibility for errors could not be traced, conditions that prior IS research associates with systematic algorithmic blackboxing.

What matters about these failures is not their novelty but their generality. Table 1 maps analogous failures documented in prior IS research across six industry domains, illustrating that the governance problem motivating this study is not idiosyncratic to professional services. In each case, an AI system operates without mechanisms capable of ensuring that its outputs are safe, fair, and traceable. Guardrails are a class of mechanisms designed to close precisely this gap.

2.3 Guardrails in adjacent literatures

The term guardrail has acquired distinct meanings in several research streams, and synthesizing these perspectives is necessary for a coherent IS theory. In algorithmic governance research, policy mechanisms and technical constraints are identified as the

Note: Entries illustrate the generality of the governance gap; sources contain supporting evidence or closely analogous documented cases primary instruments for regulating algorithmic decisions, with transparency, account-ability, and fairness as the central governance objectives. In cybersecurity IS research, monitoring architectures, anomaly detection, and adversarial robustness frameworks provide tools for maintaining system integrity against malicious and acci-dental threats. In fairness research, formal criteria such as equality of opportunity and calibration specify the equity properties that bias-mitigation components must satisfy. Algorithmic ethics provides normative foundations for the policy layer.

None of these streams alone is sufficient for a design theory. Algorithmic governance specifies what guardrails should achieve but not how to build them. Cyber-security specifies how to detect threats but not how to encode organizational fairness norms. Fairness research provides criteria, but not the governance architecture to enforce them. A comprehensive design theory for AI guardrails must synthesize all of these perspectives into a coherent prescriptive framework, which is the task undertaken in Sections 3 through 5.

The closest prior work, and the theoretical foundation on which this study most directly builds, is the guardrail design theory of. Their theory conceptualizes guardrails as norm-based coordination mechanisms in human–AI ecologies and proposes design principlesunderwhichorganizationsencodenormsintoAIsystems,monitoroutcomes for deviations from those norms, and intervene and update when deviations occur, with predictability as the central design objective. The mechanism chain at the heart of the present theory (norm encoding, output monitoring, and escalation) is a direct descendant of that encode–monitor–intervene logic, and we make no claim of novelty for it. What this study claims instead is a set of specific extensions and complements,

Table 2 Mapping to design science guidelines

Note: DiD, difference-in-differences; CMV, common method variance. The three candidate architectures evaluated during the design search are described in Appendix A which we state explicitly so that the incremental contribution can be assessed on its own terms.

First, the theory is extended from one target property to four. design for pre-dictability; the governance failures documented in Section 2.2 show that enterprise deployments also fail on fairness, safety, and auditability, and these properties are neither reducible to predictability nor achievable by the same component configura-tions (Section 4.2 establishes their discriminant validity; Table 4 shows that different components serve different properties). Second, the theory is instantiated and causally evaluated. develop their design theory conceptually; the present study deploys a full three-layer instantiation in a production organization and evaluates it through a stepped-wedge quasi-experiment with pre-trend validation, providing the first causal field evidence on whether guardrails deliver their theorized effects.

Third, the evalu-ation surfaces a boundary condition that conceptual theorizing could not: perceived legitimacy. The workaround behavior reported in Section 8.3 shows that guardrails perceived as opaque or disproportionate are circumvented, so that coordination-by-norms depends on norms being accepted, not merely encoded. Fourth, the study adds a regulatory design dimension that is outside the scope of the coordination account: an analysis of how oscillating US federal AI governance constrains guardrail archi-tecture (Sect. 6). Where this paper uses the encode–monitor–intervene vocabulary, it should therefore be read as applying and extending, and the contribution claims throughout are framed accordingly.

3 Conceptual foundation

Three theoretical perspectives from IS scholarship provide the conceptual scaffolding for the guardrail design theory. Each explains a different aspect of the governance problem and contributes a distinct set of theoretical commitments to the overall framework.

Sociotechnical systems theory holds that organizational technologies are configu-rations of technical artifacts, human actors, and institutional structures that co-produce organizational behavior over time. Generative AI systems do not merely automate professional work; they restructure the relationships among people, processes, and institutional rules that govern how professional judgment is exercised and attributed. A sociotechnical lens implies that governance cannot be achieved by configuring the technical system alone: it requires aligning the policy environment, user practices, and technical constraints in a mutually reinforcing configuration. This is precisely the logic that motivates a three-layer guardrail architecture combining policy, technical, and workflow components.

Algorithmic governance research examines how organizations regulate decision-making systems through policy, monitoring, and technical constraints, with trans-parency, accountability, and fairness as recognized governance objectives. This stream supplies the normative vocabulary for guardrail design: formal fairness criteria such as equality of opportunity and fairness through aware-ness specify what bias-mitigation components must satisfy; end-to-end audit frameworks specify how accountability mechanisms should be structured; and soft governance principles specify the ethical commitments that policy guardrails must encode. Algorithmic governance thus provides both the goals and partial blueprints for individual guardrail components.

Human–AI coordination research focuses on how people and intelligent systems jointly perform knowledge work, emphasizing the conditions under which human delegation to AI is appropriate, effective, and recoverable. Coordination failures arise from unpredictable AI outputs, the cognitive difficulty of monitoring system behavior under time pressure, and the erosion of accountability when errors can be attributed to the machine. Guardrails address each failure mode: norm encoding makes AI behavior more predictable; output monitoring reduces the cogni-tive burden of oversight by automating deviation detection; and escalation preserves accountability by creating mandatory human checkpoints and documented decision records.

The broader literature informing the framework spans cybernetics and behavioral science, IS security and privacy research, and AI safety evalua-tion. Behavioral science grounds predictions about how users will respond to guardrail interventions over time, including the habituation dynamics that determine whether alerts remain effective and the legitimacy perceptions that determine whether users comply or circumvent. Security research contributes technical architectures for monitoring and threat detection. AI safety evaluation literature documents the adver-sarial and failure modes that guardrails must address. The synthesis of these streams is represented in the research model presented in Sect. 4.

4 Research model and hypotheses

This section translates the conceptual foundation into a testable research model. Sec-tion 4.1 states a formal definition of the AI guardrail construct and distinguishes it from neighboring constructs; Section 4.2 specifies the four target properties that guardrails are designed to produce; Section 4.3 develops the three mechanisms through which they produce them; and Section 4.4 derives five testable hypotheses linking mechanisms, properties, and organizational outcomes.

4.1 Formal construct definition

Building on the conceptual foundation, we offer the following formal definition of the central construct.

An AI guardrail is a sociotechnical governance mechanism comprising policy, technical, and workflow components that jointly encode organizational norms within a deployed AI system, monitor compliance with those norms at runtime, and route non-compliant outputs to designated human reviewers to make AI-assisted organizational work predictably norm-conforming, equitable across groups, secure against harmful outputs, and traceable to accountable decision makers.

This definition satisfies established IS design theory construct validity requirements: it specifies the class of objects (policy, technical, and workflow components), the class of goals (predictability, fairness, safety, auditability), the generative mecha-nisms (norm encoding, output monitoring, escalation), and the organizational context (deployed AI systems in production organizational settings). The definition distin-guishes guardrails from related constructs: unlike content filters, which only screen outputs, guardrails encode norms at the input stage; unlike audit logs, which only record actions, guardrails actively intervene in the interaction process; and unlike access control systems, which govern who may use a system, guardrails govern what the system may do and produce.

4.2 Target properties

The research model, displayed in Fig. 1, identifies four target properties that guardrails are designed to produce. These properties are defined with explicit attention to discriminant validity.

Predictability is the degree to which users can accurately anticipate AI system behavior and outputs across varied interaction contexts. It is distinct from accuracy: a system can be consistently wrong yet highly predictable. Guardrails increase pre-dictability by constraining the output space through norm encoding and flagging deviations before they reach the user.

Fairness is the degree to which AI-assisted decisions produce equitable outcomes across individuals and groups, operationalized as equality of opportunity. Fairness is distinct from predictability because a guardrail could enforce consistent yet system-atically biased outputs; the bias monitor specifically targets this condition. Guardrails promote fairness by embedding rules that detect and interrupt discriminatory outputs at the point of generation.

Safety is the degree to which AI systems produce outputs free of hallucinations, confidential data disclosures, and adversarial manipulation. It is conceptually orthog-onal to both predictability (a system can be safely unpredictable) and fairness (a safe system may still produce biased outputs). Guardrails improve safety by filtering harm-ful content, running security monitors, and requiring human approval before high-risk outputs are acted upon.

Auditability is the degree to which AI-assisted decisions can be traced, explained, and evaluated after they occur. It is the governance infrastructure that makes the other three properties verifiable over time. Without auditability, fairness improvements cannot be demonstrated to regulators, and predictability degradations cannot be diag-nosed when they arise. Guardrails improve auditability by generating comprehensive interaction logs and linking them to specific decision outcomes.

4.3 Mechanisms

Three guardrail mechanisms connect to these properties. Norm encoding (the trans-lation of organizational norms into policies and prompt constraints) primarily drives predictability and fairness by delimiting the output space before generation occurs. Output monitoring (the application of technical filters, bias detectors, and security ana-lyzers to generated outputs) contributes to all four properties by catching deviations that escape the encoding layer. This breadth is a deliberate design feature rather than a violation of the model’s parsimony: output monitoring is the runtime backstop of the architecture,anditscontributiontoeachpropertyissecondaryandcontingent,catching what the property-specific mechanism misses, whereas the primary, property-specific leverage comes from norm encoding (for predictability and fairness) and escalation (for safety and auditability).

The mapping is thus parsimonious at the level of primary pathways, with output monitoring supplying intentional redundancy across all four. Escalation (the routing of flagged outputs to designated human reviewers) primar-ily drives safety and auditability by creating a human-in-the-loop checkpoint and a documented approval record.

4.4 Hypotheses

Five hypotheses follow directly from the model. For each hypothesis, we first state the expected direction, then articulate the theoretical mechanism, and then acknowl-edge the alternative that the hypothesis must rule out, consistent with established IS conventions for design-theoretic hypothesis development.

H1 (Predictability): Implementing norm-based guardrails increases predictability in human–AI interactions.

The mechanisms are norm encoding and output monitoring, which jointly constrain output variation and flag non-conforming responses before they reach users. Prior work shows that predictability is a necessary condition for appropriate reliance and trust. The null alternative, that guardrails do not affect output consistency, would hold if users systematically circumvent constraints or if the encoding layer is too coarse to reduce behavioral entropy in practice.

H2 (Fairness): Guardrails that embed bias monitors and expert-informed prompt constraints reduce biased outcomes and narrow group-level performance disparities.

Prompt-based learning with expert annotations has been shown to reduce demo-graphicbiasinNLPclassificationtasks.Thenullalternativeholdsiftheannotation reference sets are too small to generalize, if bias patterns shift faster than monitoring can track them, or if users rephrase queries to bypass the bias monitor.

H3 (Safety): Guardrails reduce harmful outputs and security incidents by filtering hallucinations, preventing data leakage, and requiring human approval for high-risk outputs.

Enterprise-wide monitoring reduces breach incidence in complex IT environments, and adversarially robust detection improves resilience against prompt injection. Differentiated warnings mitigate alert habituation. The null alternative holds if the security monitor’s false-positive rate is high enough to induce habituation, or if threat actors adapt their injection strategies faster than the red-team loop can identify them.

H4 (Auditability): Guardrails enhance auditability by generating complete audit trails and clarifying delegation boundaries.

Mandatoryapprovalgatescreatetimestampeddecisionrecordsthatcounteractalgo-rithmic blackboxing. The null alternative holds if users find ways to act on AI outputs outside the logged workflow, or if the audit records are too granular to be interpretable by oversight teams.

H5 (Trade-offs): Guardrails impose costs on user efficiency and satisfaction, particularly in the short term, with costs diminishing as users habituate.

Approval gates slow workflows; content filtering creates friction when legitimate queries are blocked; monitoring increases cognitive load. These costs are expected to diminish as users habituate to the workflow. The alternative to temporal recovery, that satisfaction permanently declines, would hold if users develop persistent negative attitudes toward governance constraints rather than adapting to them.

5 Guardrail design and design science grounding

This section moves from theory to artifact. Section 5.1 grounds the design in estab-lisheddesignscienceprescriptionsandshowsthatthestudyexhibitsthefullanatomyof an IS design theory; Sections 5.2 through 5.4 describe the three layers of the deployed artifact (policy, technical, and workflow guardrails), and Section 5.5 illustrates the artifact in operation through representative interactions.

5.1 Design science prescriptions and artifact mapping

The guardrail theory of Section 4 is instantiated in a three-layer artifact following established design science prescriptions. Table 2 maps the study to the seven design science guidelines, establishing the artifact’s scientific grounding before describing its components.

The artifact was selected from three candidate architectures evaluated during a six-week design sprint prior to the field study. A prompt-only architecture applied con-straintssolelyattheinputstageandwasrejectedbecauseitproducedunacceptablyhigh false-positive rejection rates (41 percent) during pilot testing. An output-only archi-tecture applied filtering only to generated text and was rejected because it could not prevent data leakage from prompt content. The three-layer architecture was selected because it achieved the lowest false-positive rate (12 percent in pilot, subsequently tuned to 7.2 percent in production) while covering all four target properties. Full details of the design search are provided in Appendix A.

Because this study claims the status of an IS design theory in the full sense, not merely conformance to design science method, the theory must also exhibit the anatomy that specify: the eight components of a complete design theory. Table 3 maps each component to its realization in this study. The mapping shows that all eight components are present and identifiable, including the two that design-oriented IS studies most often leave implicit: artifact mutability, which is addressed through the version-controlled separation of the policy layer from the monitoring and escalation infrastructure (Section 6.2) and through threshold tuning and red-team-driven updates; and testable propositions, which are stated formally as H1 through H5 and evaluated in Sect. 8.

The three layers of the artifact are interdependent: the policy layer sets norma-tive targets, the technical layer enforces them at runtime, and the workflow layer ensures human oversight when automated enforcement is insufficient. Table 4 maps

Table 3 Mapping to the eight components of an IS design theory

Component labels follow. FPR, false-positive rate all eleven design components to their mechanisms and target properties. Two clar-ifications govern how the table should be read. First, layers and mechanisms are orthogonal dimensions of the design, not a one-to-one mapping: a layer describes where a component resides organizationally (who owns and operates it), whereas a mechanism describes what the component does theoretically. The correspondence is many-to-many by design. Red-team loops, for example, are operated by people within the workflow layer, yet what they do is output monitoring: they probe the system for deviations that the automated monitors have not yet learned to detect. Second, a single component may serve multiple target properties, reflecting the intentional redundancy discussed in Section 4.3.

Layers and mechanisms are orthogonal dimensions (see text): a layer denotes where a component resides organizationally, a mechanism denotes what it does. Red-team loops accordingly sit in the workflow layer while implementing the output monitoring mechanism. The auditability served by escalation paths encompasses the clarity of responsibility assignment enabled by escalation records 5.2 Policy guardrails

Policy guardrails translate organizational norms, legal requirements, and ethical guidelines into explicit rules governing the use of the AI system. Three categories were implemented. Data-use policies specified allowed data sources (non-privileged research datasets and approved knowledge bases), prohibited content categories (pro-tected health information, personally identifiable information, and client-contractual data), and compliance requirements aligned with GDPR and the firm’s information security standards. Fairness policies embedded equality of opportunity metrics as binding criteria for recommendation outputs and required bias assessments against expert-annotated reference datasets before any new model configuration could be deployed.

Disclosure policies mandated that all AI-generated deliverables be labeledasmachine-assisted,thatAIconfidencescoresbevisibletosupervisoryreview-ers, and that all inputs and outputs be logged and retained for a minimum of 36 months. These requirements align with the accountability principles of Executive Order 13960 and subsequent OMB implementation guidance.

A natural question is whether an organizational AI policy can, by itself, constitute a sufficient guardrail; that is, whether a policy document that specifies technical and workflow requirements renders the other two layers redundant. The conceptual answer is that policy can specify technical and workflow elements but cannot self-enforce them: a policy stating that outputs must be reviewed does not review any output. The empirical answer at this field site is instructive. All four baseline governance failures documented in Section 2.2 occurred while the firm already had applicable written policies (GDPR-aligned data-handling standards, information security pol-icy, and professional review norms) in force. Policy alone failed because compliance depended entirely on individual discretion under time pressure, precisely the condi-tion under which verification labor is skipped.

We therefore theorize policy-only governance as sufficient only under restrictive conditions: when interaction volume is low enough for manual oversight, when task stakes are low, and when strong profes-sional norms make voluntary compliance the path of least resistance. Outside those conditions, which describe few enterprise generative AI deployments, policy requires the technical layer to make norms binding at runtime and the workflow layer to make exceptions reviewable, which is the central sociotechnical claim of the three-layer design.

5.3 Technical guardrails

Technical guardrails encode norms into the AI system through four components oper-ating in sequence at the point of inference. Prompt constraints are applied before generation: they block or rewrite queries seeking disallowed information, including discriminatory language, requests for proprietary data from unauthorized users, and prompt injection patterns. The output filter uses a secondary large language model as a policy classifier, scoring generated text across four risk dimensions (potential bias, hallucination probability, confidentiality exposure, and policy violation) and routing outputs exceeding configurable thresholds to human review rather than delivering them directly. The bias monitor applies a prompt-based learning method, using expert-annotated examples to detect discriminatory patterns without requiring large-scale labeled datasets.

The security monitor implements the RADAR adversarial robust-ness architecture to detect prompt injection attempts and anomalous data access in real time. Each delivered output is accompanied by a natural-language explana-tion of AI reasoning and a confidence score, supporting transparency and algorithm appreciation.

5.4 Workflow guardrails

Workflow guardrails define the human oversight structures that activate when the tech-nical layer identifies outputs it cannot handle safely without intervention. Approval gates require supervisor review before consultants may act on any output classified as high risk by the output filter or bias monitor. Escalation paths route sensitive cases to designated specialists: potential fairness violations go to the firm’s fairness officer, security anomalies go to the information security team, and outputs touching client-contractual obligations go to legal review. Red-team loops run on a bi-weekly schedule, submitting a rotating battery of adversarial prompts to probe system integrity and iden-tify new vulnerability classes before they appear in production.

When the bias monitor flags a recommendation, the escalation sequence pauses the interaction, notifies the fairness officer, generates an in-line explanation for the consultant, and creates a times-tamped audit record. This architecture reflects evidence that differentiated, contextual warnings sustain user attention better than generic alerts, and that non-embedded feedback produces more durable behavioral learning.

Examples are anonymized composites constructed from interaction-log categories; verbatim content is withheld under the confidentiality agreement with the field site 5.5 Illustrative guardrail interactions

To make the artifact concrete for readers assessing its relevance to their own contexts, Table 5 presents representative interactions spanning the main guardrail pathways: a prohibited prompt blocked at the input stage, a prompt injection attempt caught by the security monitor, a flagged output routed through the approval gate, a bias escalation to the fairness officer, and a fully permitted interaction delivered with its confidence score and explanation. Under the confidentiality agreement with the field site, verbatim prompts and outputs cannot be reproduced; the examples are paraphrased composites that preserve the structure and system behavior of logged interactions while removing all client-identifying and proprietary content.

6 US federal AI governance: executive orders and guardrail design implications

Enterprise guardrail design does not occur in a regulatory vacuum: over six years, nine presidential executive orders have repeatedly redefined the normative expecta-tions within which organizations deploy AI systems. This section is deliberately brief. Its purpose is not regulatory history for its own sake but the derivation of two design-relevant facts: the regulatory environment oscillates between competing governance logics, and that oscillation occurred during the present study, directly shaping the arti-fact. Table 6 summarizes all nine orders; readers primarily interested in the empirical study may review the table and proceed to Sect. 7.

6.1 Two governance logics across nine orders (2019–2025)

The order sequence reveals two recurring governance logics in tension. A risk-management logic treats AI as a potential source of harm and mandates proactive evaluation, transparency, and accountability; a competitiveness logic treats AI as a strategic economic and geopolitical resource and minimizes friction on develop-ment and deployment. The first Trump Administration established the competitiveness frame (EO 13859, 2019) while also supplying the foundational auditability mandate: EO 13960 (2020) required traceability, accountability, and regular monitoring of fed-eral AI, providing direct regulatory grounding for the audit-trail components of the guardrail architecture.

The Biden Administration shifted to risk management: EO 14110 imposed safety evaluations, bias testing, and procurement standards that effectively required guardrail-equivalent mechanisms, with the accom-panying AI Bill of Rights principles mapping closely onto the four target properties of the present framework. The second Trump Administration then reversed course: EO 14148 (January 20, 2025) rescinded EO 14110 outright, EO 14179 (January 23, 2025) replaced the risk-first posture with an innovation-first one and revoked the associated OMB equity memoranda, and a sequence of 2025 orders addressed procurement, education, export, and infrastructure. Most consequentially for fairness guardrail design, the Preventing Woke AI order directed agencies to procure only AI systems that do not alter factually accurate outputs on the basis of protected characteristics.

Under this constraint, components that escalate poten-tially discriminatory outputs to human review remain defensible, while components that algorithmically rewrite outputs are not.

The timing of these shifts relative to the study matters, and we state it precisely to clarify which regulatory regime the artifact was designed under. The guardrail artifact was designed during a six-week sprint in July and August 2024, while EO 14110 was in force, and its bias-testing, disclosure, and audit-trail requirements directly informed the policy layer specifications of Section 5.2. The field study then ran from September 2024 through March 2025 (Section 7.1), so the January 2025 rescission of EO 14110 occurred in approximately week 20 of the 28-week study window. The firm’s governance committee elected to retain the EO 14110-aligned requirements unchanged after the rescission, both to preserve the integrity of the ongoing evaluation and because the

Table 6 US federal AI executive orders and guardrail design implications

EO 14110 is included because it shaped artifact design choices (see text for timing), though it was formally rescinded by EO 14148 on January 20, 2025. The final row reflects the output-altering vs. output-escalating distinction from Sect. 5 requirements remained aligned with state-level, international, and client-contractual obligations. The artifact’s compliance posture was thus initially mandatory in spirit and subsequently voluntary, and its escalation-rather-than-alteration approach to bias management, adopted before the Preventing Woke AI order was issued, turned out to satisfy the neutrality requirements of the competitiveness logic while still serving the fairness objectives of the risk-management logic. This robustness to both logics is not accidental; it is the design principle developed in Section 6.2.

6.2 Modular architecture as regulatory resilience

The oscillation between risk-management and competitiveness logics across admin-istrations creates planning uncertainty for organizations designing guardrail systems intended to operate over multi-year horizons. The practical implication is that modular guardrail architectures (those that separate the policy configuration layer from the tech-nical and workflow layers) are more resilient to regulatory volatility: when governance requirements shift, the policy layer can be reconfigured without rebuilding the monitor-ing and escalation infrastructure. This design principle is operationalized in the artifact described in Sect. 5, where policy files are maintained as version-controlled configu-ration documents separate from the technical components, enabling reconfiguration within days rather than months when regulatory requirements change.

7 Method

Having developed the guardrail theory and artifact in Sections 3 through 5, and situated it in a regulatory context in Sect. 6, we turn to the empirical evaluation. This section describes the study design, randomization procedure, control condition, data sources, construct operationalization, and analysis strategy. Figure 2 presents the study design schematically.

We evaluate the guardrail artifact through a stepped-wedge quasi-experimental design in which all 20 teams begin in the control condition and transition to the guardrail con-dition at staggered, randomly assigned time points. The randomization procedure was conducted prior to data collection: team identifiers were assigned random num-bers using a computer-generated sequence (R sample with no seed stratification), and teams were allocated to rollout waves in the resulting order. The research team had no knowledge of team-level baseline outcomes at the time of randomization, and allocation was concealed from team leaders until 48h before their assigned transition week to minimize anticipation effects.

Thestepped-wedgedesignisethicallyappropriatewhentheinterventionisexpected to be beneficial and prolonged withholding raises ethical concerns. Given the doc-umentedbaselineharms(biasincidents,dataexposure,andaccountabilityfailures),the organization’s governance committee concluded that withholding guardrails beyond

Rollout begins the six-week baseline period was not justifiable. The study received IRB approval from the lead author’s institution (protocol blinded for review) and organizational ethics review from the firm’s data governance committee. All participants provided written informed consent and were notified that interaction logs would be used for research purposes. Data were anonymized at the individual level before analysis; no individual-level identifiers appear in any reported finding.

A note on researcher positionality is warranted. The research team had access to comprehensive interaction logs of employees at a partner organization. This access creates a power asymmetry that requires explicit management: we mitigated this by (a) excluding all qualitative content of individual consultant interactions from the analysis and reporting only aggregate behavioral and outcome metrics, (b) ensuring that the firm’s data governance committee reviewed all findings prior to publication, and (c) confirming that no individual consultant’s behavior can be inferred from any reported statistic.

The study ran for 28 weeks in total, from September 2024 through March 2025: a six-week baseline followed by 22 weeks of staggered rollout in four waves of five teams each. As noted in Section 6.1, this window spans the January 2025 federal rescission of EO 14110; the firm held the guardrail configuration constant throughout, so the regulatory shift did not alter the treatment. The survey was administered at baseline (S1), week 13 (S2), week 19 (S3), and week 28 (S4). Table 7 summarizes sample characteristics.

7.2 The control condition

Because causal interpretation depends on the counterfactual, we describe the control condition precisely. During baseline and control periods, all teams used the unguarded copilot through the same chat interface that persisted throughout the study. No informal

Table 7 Study sample characteristics by period

High-stakes tasks include client proposals, executive briefings, and regulatory submissions. Balance tests: p > 0.20 for all covariates. The 3-point decline in survey response rate showed no selective attrition (all p > 0.30) governance norms were imposed or encouraged by management during the control period; the research team did not provide any guidance on prompt construction or out-put review to control-condition teams. The firm’s IT team confirmed that the identical underlying model and interface were used across conditions, with the guardrail stack being the only systematic difference between guardrail-active and control periods.

Contamination between conditions was mitigated by the following: teams in differ-ent rollout waves were assigned to separate project portfolios with no shared client engagements during the study period; and inter-team communication about AI usage practices was monitored through interaction-log metadata, with no evidence of sys-tematic cross-team information sharing about guardrail mechanics detected before any transition.

7.3 Manipulation check

Before testing the hypotheses, we verified that the guardrail was actually used differently by teams in guardrail-active periods relative to control periods. Three manipulation check criteria were applied to interaction logs. First, the prompt con-straint layer was triggered in guardrail-active periods at a rate of 14.3 constraint activations per team-week, compared to 0 in control periods, confirming that the input-stage filtering was operative. Second, the output filter reviewed 100 percent of outputs in guardrail-active periods (as designed) versus 0 percent in control periods.

Third, the approval gate was invoked on 7.2 percent of outputs in guardrail-active periods, producing supervisor review records that are absent from the control period logs. (The approval-gate invocation rate, the share of all outputs routed to supervisor review, is conceptually distinct from the output filter’s false-positive rate reported in Section 5.1 and Appendix A, which is the share of legitimate outputs incorrectly flagged; the numerical proximity of the two figures in production is coincidental.) All three checks confirm that the guardrail treatment was implemented with high fidelity and that the control condition was genuinely unguarded.

7.4 Measures and construct operationalization

We collected four types of data and operationalized each construct from multiple independent sources to limit common method variance. Table 8 summarizes construct operationalizations, data sources, and validity indicators. Harman’s single-factor test was applied to survey data; the first unrotated factor explained 24 percent of variance, well below the 50 percent threshold, providing no evidence of pervasive com-mon method bias. Survey constructs assessed using confirmatory factor analysis demonstrated adequate convergent validity (average variance extracted, AVE, exceed-ing 0.50 for all constructs) and discriminant validity (AVE exceeding the square of all inter-construct correlations). Composite reliability (CR) exceeded 0.80 for all multi-item survey constructs.

Global fit of the three-factor measurement model (satisfaction, accountability understanding, perceived guardrail fairness; 11 items) was acceptable at the baseline wave: χ 2 = 71.8, p =.002; CFI = 0.97; RMSEA = 0.046 (90% CI [0.021, 0.067]); SRMR = 0.043. The significant chi-square statistic is expected at this sample size; the approximate fit indices fall within conventional thresholds (CFI ≥ 0.95, RMSEA ≤ 0.06, SRMR ≤ 0.08). Full item loadings, inter-construct correla-tions, and per-wave fit statistics are included in the replication package described in the data availability statement.

Interaction logs captured every prompt, AI-generated response, consultant edit, supervisor approval or rejection decision, and timestamp. Decision outcome data comprised client quality ratings from engagement managers, hallucination counts val-idated against a manually annotated sample, and security incident records from the IS ticketing system. Fairness metrics were computed from an NLP pipeline calibrated against 600 manually annotated outputs (Cohen’s kappa = 0.82 across two indepen-dent coders). Survey data were collected at S1 through S4 using validated multi-item scales adapted from prior IS research.

Predictability was operationalized as the inverse of Shannon entropy over interaction-sequence patterns within each team-week cell (lower entropy reflects more predictable patterns) and as the proportion of outputs accepted without escalation. Both indicators are derived from interaction logs, independent of survey self-report. The convergence of these two indicators (r = 0.71) provides evidence that predictabil-ity is captured meaningfully rather than tautologically. Fairness was measured as the equality-of-opportunity false-negative rate gap between underrepresented and majority groups, computed from the NLP pipeline. Safety was measured by hallu-cination incidence per task, output rejection rate, security incident count, detection latency, and the security monitor’s false-positive rate.

Auditability was assessed by coding whether each deliverable had a complete audit trail (two coders, kappa = 0.78) and by the survey-based accountability understanding scale (three items, alpha = 0.84, AVE = 0.62, CR = 0.83). User satisfaction was measured with a validated five-item scale (alpha = 0.88, AVE = 0.61, CR = 0.89) adapted from prior IS research on

Table 8 Construct operationalization summary algorithm appreciation. Task completion time was extracted from log timestamps and requires no self-report.

7.5 Pre-trend test and analysis strategy

The validity of the difference-in-differences estimator rests on the parallel pre-trends assumption: in the absence of the guardrail intervention, treated and control teams would have followed parallel outcome trajectories. We test this assumption directly using a pre-trends specification in which we interact a linear time trend with the wave-of-assignment indicators during the six-week baseline period. The F-test for joint significance of these interaction terms yields F = 0.87, p = 0.47, providing no evidence of differential pre-trends across rollout waves. The test is repeated separately for each of the five outcome constructs; none yields a significant pre-trend interaction (p > 0.20 in all cases). This result strengthens confidence that post-rollout divergences in outcomes reflect the guardrail intervention rather than pre-existing team differences.

The primary causal estimator is a two-way fixed-effects difference-in-differences specification with team and calendar-week fixed effects: yit = αi + λt + β · Guardrailit + X′ it γ + εit, where yit is the outcome for team i in week t, αi and λt are team and week fixed effects, Guardrailit is an indicator equal to one after team i has transitioned to the guardrail condition, Xit includes time-varying team-level controls (team size and mean project complexity), and standard errors are clustered at the team level. Robustness checks include a synthetic control analysis matching each treated team to a weighted com-bination of control teams on pre-transition outcome trends, and Rosenbaum bounds sensitivity analyses quantifying the unobserved confounding required to overturn each result.

For fairness metrics, bootstrap confidence intervals (1,000 replications, clus-teredbyteam) areusedbecausethefalse-negativerategaplacks aclosed-formstandard error. Heterogeneity analyses interact the guardrail indicator with task stakes (high vs. low), user seniority (senior vs. junior), and team social distance. Survey data are analyzed with mixed-effects models with random intercepts for teams. Qualita-tive coding of open-text responses and audit log annotations used thematic analysis with two independent coders (Cohen’s kappa = 0.78), with disagreements resolved through structured discussion.

Standardized effect sizes (Cohen’s d) are computed for all primary outcome com-parisons to supplement the significance tests and support assessment of practical significance. Values below 0.2 are interpreted as small, 0.2 to 0.5 as moderate, and above 0.5 as large, following established conventions.

Tosupportreplication,wespecifytheanalysispipelineprecisely.Allstatisticalanal-yses were conducted in Python 3.11. Two-way fixed-effects models were estimated with linearmodels (PanelOLS with entity and time effects and clustered covari-ance at the team level); mixed-effects survey models with statsmodels (restricted maximum likelihood, random intercepts for teams); and bootstrap confidence intervals with a team-level cluster bootstrap (1,000 replications). The synthetic control analysis follows the nested-optimization approach of Abadie and colleagues: for each treated team, donor weights over not-yet-treated teams were chosen to minimize the mean squared prediction error of the outcome over all pre-transition weeks, with predic-tors comprising pre-transition outcome values, team size, and mean task complexity.

Rosenbaum bounds were computed on the matched team-week pairs using the signed-rank test statistic, reporting the sensitivity parameter  at which the upper-bound p-value crosses 0.05. The full analysis code is included in the replication package (see the Data availability statement).

Because the study estimates effects on eleven primary outcome indicators plus heterogeneity contrasts, the treatment of multiple comparisons requires an explicit statement.Noformalfamilywisecorrectionwasapplied,fortwostatedreasons:thefive hypotheses were specified ex ante, each with a small set of designated primary indica-tors, so the tests are confirmatory within pre-specified families rather than exploratory scans; and the substantive conclusions rest on effects estimated at p < 0.01 with moderate to very large effect sizes, which is conservative relative to the number of primary tests conducted.

Two consequences of this policy are flagged for the reader: the satisfaction decline (H5), significant only at p < 0.10, should be interpreted as suggestive rather than confirmed; and all heterogeneity results in Section 8.3 should be read as exploratory, a caution reinforced by the power analysis that follows.

Finally, we report a design-based minimum detectable effect (MDE) calculation for the subgroup analyses, because the number of clusters, not the number of interactions, governs their power. For a moderator that splits the 20 teams at the median (such as team social distance), a team-level comparison of 10 versus 10 clusters at α = 0.05 (two-sided) and 80 percent power can reliably detect only differences of approximately d = 1.3 at the cluster level. Moderators that vary within teams (task stakes and user seniority) are estimated from within-team contrasts across 10,200 interactions and are considerably better powered, but their inference is still governed by 20 clusters through the clustered covariance. The subgroup findings should accordingly be treated as hypothesis-generating estimates of heterogeneity whose replication in larger multi-site samples is a priority (Section 9.7).

8 Results

The findings are organized around the five hypotheses. We report main effects, then trade-off dynamics, then heterogeneity and robustness analyses, and close with a ded-icated treatment of workaround behavior as an emergent, theoretically significant finding. Table 9 reports all estimated effects with standardized effect sizes.

Guardrails increased predictability on both indicators, supporting H1. Interaction entropy decreased by 35 percent (p < 0.01, d = 0.81), and the no-escalation rate rose from 62 to 81 percent (p < 0.01, d = 0.76). Client quality ratings from engagement managers improved by 0.4 points on a five-point scale (p < 0.05, d = 0.41), confirm-ing that more predictable AI behavior translated into higher-quality deliverables as

Table 9 Estimated effects of guardrails on target properties and outcomes

Two-way fixed-effects DiD with team and week fixed effects; standard errors clustered at the team level. EoO = equality of opportunity; FNR = false-negative rate; d = Cohen’s d. p < 0.10; p < 0.05; p < 0.01. Satisfaction decline is temporary (first month); recovers by S3 (week 19). Pre-trend F = 0.87, p = 0.47 perceived by managers who were blind to team guardrail status. The convergence of the entropy and no-escalation indicators (r = 0.71) supports the convergent validity of predictability as an operationalized construct.

Fairness improved substantially, supporting H2. The equality-of-opportunity false-negative rate gap fell from 0.18 at baseline to 0.05 under guardrails (p < 0.01, d = 0.94), a 72 percent reduction, representing a large effect. Manual annotation confirmed a parallel decline in the surface properties of deliverables: gendered and racially stereotyped language decreased from 8.3 to 1.1 percent of outputs (p < 0.01, d = 0.88). The annotation-based evidence that improvement is visible beyond the NLP pipeline metrics addresses the concern that the fairness gains might reflect a measurement artifact rather than genuine output change.

Safety improved across all indicators, supporting H3. Hallucinations per task declined by 50 percent (p < 0.01, d = 0.77). No major security incidents (unau-thorized disclosure of client-confidential data) occurred after guardrail deployment, compared with three during the baseline period (p < 0.05). Detection latency aver-aged 1.3s with a false-positive rate of 2.1 percent, consistent with published RADAR benchmarks. Notably, the safety interaction with task stakes was not significant (p = 0.31), unlike the pattern for the other three properties. This asymmetry suggests that safety monitoring operates as a constant floor rather than a task-stakes-contingent ceiling: the system monitors all outputs equally, regardless of stakes, whereas users engage with predictability and fairness requirements more carefully when conse-quences are salient.

This null result is theoretically informative and is discussed in Sect. 9.

Auditability improved dramatically, supporting H4. Audit-trail completeness rose from 53 to 96 percent (p < 0.01, d = 1.42), the largest effect in the study. Inci-dents where the responsible party could not be identified fell by 70 percent. The share of survey respondents reporting clear accountability understanding rose from 34 to 79 percent. The convergence of the log-based and survey-based auditability indica-tors provides strong construct validity evidence: the structural changes enforced by the guardrail architecture generated both objective completeness improvements and genuine perceptual changes in users’ accountability understanding.

8.2 Trade-offs and adaptation dynamics

The costs of guardrails were real and followed the pattern predicted by H5. Task completion time increased by 12 percent (from 30.0 to 33.6min, p < 0.05, d = 0.38), a moderate effect driven primarily by the time spent reviewing flagged outputs and completing approval workflows. User satisfaction declined by 0.2 points (on a five-point scale) in the first month of implementation (p < 0.10, d = 0.19, a small effect) before recovering to near-baseline levels as users adapted. Escalation counts peaked in week three of the post-rollout period and declined steadily thereafter, indicating that users internalized the encoded norms and submitted fewer non-compliant prompts over time.

The temporal pattern of the satisfaction recovery, measured at S2, S3, and S4, showed monotonic improvement after the initial dip, a pattern consistent with habituation dynamics documented in security warning research and cognitive friction theory. The task completion time penalty did not fully dissipate within the 28-week window (d = 0.38 at study end), suggesting that some structural workflow overhead persists beyond the initial learning period.

Open-text survey responses identified three recurring themes: frustration when legitimate queries were blocked by the output filter; confusion about which esca-lation path applied in ambiguous cases; and a perception that the approval workflow was designed for compliance rather than productivity. These themes indicate that the costs of guardrails are not purely mechanical, but also cognitive and motivational, reinforcing the conclusion that technical deployment must be accompanied by active change management.

Consistent with the power analysis in Section 7.5, the heterogeneity results reported here should be read as exploratory: with 20 teams as the clustering unit, only large moderation effects are reliably detectable for between-team splits (MDE ≈ 1.3 at the cluster level), and even the better-powered within-team contrasts rest on 20 clusters for inference. With that caution stated, the observed patterns are consistent and theoret-ically interpretable. Effects were significantly stronger for high-stakes tasks than for low-stakes tasks (p < 0.01 for predictability, fairness, and auditability interactions; p = 0.31 for safety). The theoretical interpretation is that users engage more deliber-ately with guardrail outputs when professional consequences are salient, amplifying normative compliance in high-stakes contexts and attenuating it in low-stakes ones.

Safety does not show this moderation because the security monitor operates indepen-dently of user engagement: it screens all outputs regardless of whether the user is paying attention.

Less experienced consultants (fewer than three years of tenure) showed larger qual-ity and fairness gains (d = 0.61 for junior versus d = 0.28 for senior on the fairness outcome), consistent with the interpretation that guardrails partially substitute for the professional judgment that experienced practitioners supply independently. This finding has direct implications for guardrail policy design: organizations with predom-inantly junior AI user populations stand to realize disproportionately large governance returns.

Teams with high social distance (mean social familiarity below the sample median) showed larger fairness improvements than close-knit teams, extending a prior social distance–equity pattern from social referral systems to AI governance contexts. The synthetic control analysis confirmed that the main results are robust to alternative counterfactual specifications. Rosenbaum sensitivity analyses indicated that an unob-served confounder would need to produce an odds ratio of at least 2.8 to overturn the predictability and fairness results.

Workaround behavior constitutes the most consequential emergent finding of the study. In 7 of 20 teams (35 percent), at least one consultant was observed, through metadata patterns in the interaction logs and through responses to the S3 and S4 open-text survey items, switching to a personal device or an unmonitored communication channel to complete tasks that the guardrail system had blocked. In 3 of 20 teams (15 percent), consultants submitted deliberately incomplete prompts designed to avoid triggering the content filter and then manually assembled partial responses outside the logged workflow. Workaround behavior was significantly more prevalent in teams whose survey responses indicated lower perceived fairness of the guardrail policies (mean guardrail fairness score of 2.7 vs.

3.8 on a five-point scale in non-workaround teams, p < 0.01), and in teams where the output filter’s false-positive rate exceeded 10 percent (that is, where more than one in ten legitimate queries was being incorrectly blocked). Two qualifications discipline the interpretation of these figures. First, the detected rates are lower bounds. Workarounds were identified through log metadata and self-report, and both channels are structurally biased against detecting exactly the behavior they target: a consultant who successfully routes work around the log-ging infrastructure is, by construction, invisible to that infrastructure, and the most successful circumvention is the least likely to be self-reported. The true prevalence of workaround behavior is therefore almost certainly higher than the 35 percent of teams and fewer-than-4-percent of interactions we observe.

Second, and consequently, the detected workarounds did not materially affect the main quantitative results as measured (detected circumvention accounted for fewer than 4 percent of logged inter-actions), but because undetected circumvention removes interactions from the logs entirely, the reported treatment effects are best interpreted as effects on governed, logged work rather than on the totality of consultants’ AI use. Section 9.6 discusses this measurement limitation in full.

The work-product evidence sharpens the interpretation of circumvention incen-tives. Client quality ratings from engagement managers who were blind to guardrail status were higher under guardrails (4.0 vs. 3.6 on a five-point scale; Section 8.1), so consultants were not circumventing an inferior tool to protect deliverable qual-ity. The incentive to circumvent came instead from the friction documented above (time costs, false-positive blocks, and opaque escalation), which is consistent with the legitimacy account: workarounds concentrated where the guardrail imposed costs per-ceived as disproportionate, not where it degraded output value. Whether work products produced through workaround channels matched the quality of governed outputs can-not be assessed, precisely because those interactions escaped the logging and rating infrastructure.

Nonetheless, the detected workarounds establish a legitimacy-based boundary condition for guardrail design theory: governance mechanisms perceived as opaque or disproportionate generate circumvention behavior that, if it scales, will erode coverage in precisely the interaction contexts where the guardrail was most needed. This finding echoes AI safety research on displacement effects and iden-tifies guardrail transparency and false-positive calibration as functional, not merely ethical, design requirements.

9 Discussion

The results support all five hypotheses and, in doing so, extend IS knowledge on AI governance along four dimensions. This section develops the theoretical, methodolog-ical, practical, and policy implications, addresses rival explanations, and concludes with an explicit statement of the study’s limitations and an agenda for future research.

9.1 Theoretical implications

The most important theoretical contribution is the empirical confirmation that guardrails are causal governance mechanisms producing measurable improvements in the structural properties of AI-enabled work, not merely compliance documentation. The findings support and extend the theorized claim that guardrails transform human– AI ecologies by making AI behavior more predictable and reconfiguring delegation patterns. Several extensions are noteworthy.

First, the mechanism–property decomposition sharpens the theoretical account of byspecifyingwhichmechanismcarrieswhichproperty.Normencodingcontributes primarily to predictability and fairness by constraining the output space before gen-eration; escalation drives safety and auditability by creating mandatory checkpoints that generate accountability records; and output monitoring contributes to all four properties in a backstop role, catching at the point of inference the deviations that the property-specific mechanisms miss (Section 4.3). This decomposition distinguishes guardrail theory from more general accounts of IS governance, which typically treat governance as an undifferentiated bundle of controls.

Second, the results extend blackboxing theory by demonstrating the structural conditions under which algorithmic decisions can be systematically traced rather than obscured. The 96 percent audit-trail completeness achieved under guardrails is not an incidental byproduct of better logging practices; it is the direct result of approval gates that cannot be bypassed without creating a record. The critical insight is that auditability is not a property of logging technology but of the workflow enforcement logic that makes logging unavoidable.

Third, the null result for the safety-by-stakes interaction is theoretically informative. Unlike predictability, fairness, and auditability, safety monitoring operates as a task-stakes-invariant floor: the security monitor screens all outputs regardless of whether the user is cognitively engaged with the stakes of the task. This asymmetry suggests that the three target properties that benefit from user engagement (predictability, fair-ness, and auditability) are sensitive to motivational moderators. In contrast, safety operates more like an autonomous system property.

Design theory for AI governance should treat safety and the engagement-sensitive properties as differently structured governance targets: safety is better served by automated, user-independent monitoring, while predictability, fairness, and auditability benefit from user-facing transparency mechanisms that sustain engagement.

Fourth, the workaround findings establish a legitimacy-mediated boundary condi-tion for guardrail design theory. The correlation between perceived policy fairness (mean score 2.7 in workaround teams vs. 3.8 in non-workaround teams) and cir-cumvention behavior aligns with institutional legitimacy theory: governance mechanisms that lack procedural legitimacy in users’ eyes will be circumvented even when users agree with the underlying governance objectives. The tripartite typol-ogy of legitimacy (pragmatic, moral, and cognitive) provides a useful lens for interpreting this finding. The workaround teams exhibited low pragmatic legitimacy perceptions (the guardrail was seen as imposing costs without commensurate benefits) and low cognitive legitimacy (the guardrail’s decision logic was opaque, preventing users from forming a coherent mental model of when and why outputs would be flagged).

Moral legitimacy, whether the guardrail served socially valued goals, was not contested; even workaround-team members endorsed the principle of AI governance in open-text responses. This pattern suggests that guardrail designers should prioritize pragmatic and cognitive legitimacy through transparent rationale documen-tation and calibrated false-positive rates, rather than assuming that moral legitimacy alone will sustain compliance. The implication for IS design theory is that guardrail transparency (providing accessible, just-in-time explanations of why a given output was flagged) is a functional design requirement, not merely an ethical aspiration, because it is the primary mechanism through which users form legitimacy judgments.

The workaround findings also demand engagement with a theoretical tradition that the governance framing alone does not supply: workplace surveillance. A guardrail architecture that logs every prompt, scores every output, and routes exceptions to designated reviewers is, whatever else it is, a monitoring infrastructure, an instance of what termed the information panopticon, in which the same systems that informate work render workers continuously visible to managerial observation. From aFoucauldianperspective,thedisciplinaryforceofsuchvisibilityoperateslessthrough individual acts of intervention than through workers’ anticipation of being observed, and critical organizational communication scholarship warns that such systems can extend managerial control into domains of professional discretion that employees regard as their own.

Read through this lens, the finding that consultants in 7 of 20 teams shifted work to personal devices and unmonitored channels is not only a legitimacy failure but a recognizable act of resistance to an intensified surveillance regime. Moreover, the structural undercount acknowledged in Section 8.3 is itself a classic feature of surveillance systems, which are least informative about precisely the behavior that evades them. Our design partially anticipated this dynamic (interaction content was excluded from analysis, individual-level data were anonymized, and the perceived-fairness items capture some of the procedural dimension), but we did not directly measure whether participants experienced the guardrail as continuous with the firm’s existing monitoring norms or as a tightening of them, and that omission is registered as a limitation in Section 9.6.

The design implication is nonetheless clear and actionable: guardrail architectures should be built with surveillance minimization as an explicit requirement. In practice, this means logging what accountability requires and no more, being transparent about who sees what, and preferring privacy-preserving aggregation. A guardrail experienced primarily as surveillance will be resisted regardless of the governance goods it delivers.

Finally, the temporal pattern of satisfaction recovery contributes a dynamic dimen-sion to algorithm aversion theory. The initial decline followed by recovery over 28 weeks mirrors the aversion-to-appreciation trajectory, but the study adds the behav-ioral mechanism: as users learned which query types would be flagged and why, they revised their prompting practices rather than abandoning the system, a form of human-side adaptation (algorithmic accommodation) that prior work has not described. This mechanism also connects the findings to emerging industry evidence on the hidden human labor of enterprise AI.

Large-scale practitioner research documents that AI adoption quietly generates substantial unmanaged verification work (colloquially, “botsitting”) and that when this labor is invisible and unrewarded, workers either absorb it or skip it, the latter producing the unverified-output pattern. The guardrail architecture can be read as a formalization of exactly this labor: approval gates and escalation paths convert verification from a discretionary, invisible individ-ual burden into an explicit, resourced, and auditable organizational process. The 12 percent task-time cost measured here is, on this reading, not new work created by governance but previously hidden work made visible and assigned, a reframing with direct implications for how organizations should budget for and evaluate guardrail deployments.

9.2 Rival explanations

Three rival explanations for the observed effects deserve explicit consideration. First, the improvements might reflect a Hawthorne effect: teams may have improved their behavior because they were aware of being studied rather than because of the guardrail intervention itself. The manipulation check evidence argues against this interpretation, as behavioral differences align closely with the structural features of the guardrail stack (constraint activations, output filter reviews, approval-gate invocations) rather than with mere awareness of observation. Moreover, all teams were aware of the study from baseline onward, yet performance differences emerged only after guardrail activation.

Second, the results might reflect time-varying maturation: consultants may have become more proficient with the AI copilot over time, regardless of guardrails. The pre-trend test (F = 0.87, p = 0.47) provides no evidence of differential maturation across rollout waves, and the staggered design ensures that improvements at different calendar times are attributed to guardrail activation rather than secular trends. The syn-thetic control analysis further confirms that control teams did not exhibit comparable improvements during the same calendar periods.

Third, the task completion time increases and satisfaction dips might reflect dis-ruption from any organizational change rather than guardrail-specific costs. This alternative is difficult to rule out entirely, but the specificity of the open-text complaints (targeted at output filter false positives, escalation path confusion, and approval work-flow friction) suggests that the costs are attributable to guardrail mechanics rather than to generic change resistance.

9.3 Methodological implications

The multi-method approach demonstrates how design science evaluation and causal field inference can be productively integrated in IS research on AI governance. The pre-trend test (F = 0.87, p = 0.47) confirms the parallel-trends identifying assumption that is the Achilles’ heel of DiD studies; reporting this test should become standard practice in IS field research using stepped-wedge or staggered-adoption designs. The combination of log analysis, NLP pipeline metrics, IS ticketing data, and four-wave survey measurement achieves construct coverage across all four target properties from sources that are logically independent of one another, substantially limiting common method bias concerns.

A key methodological caution concerns the single-site design. Effect magnitudes should be treated as order-of-magnitude indicators rather than precise transferable estimates: the Fortune 500 professional services context (large teams, dedicated fair-ness and security officers, high-quality IT infrastructure) may produce effect sizes that are difficult to replicate in smaller organizations without those resources. Multi-site collaborative designs that pool stepped-wedge data across firms and industries, using federated analysis to preserve organizational confidentiality, would substantially strengthen the external validity of findings in this research stream.

Designs replicating this study should also develop privacy-preserving protocols for interaction log collection. The comprehensive logs gathered here were possible only because the firm’s data governance committee granted access under strict anonymiza-tion procedures. Differential privacy methods in log aggregation offer a promising path to enabling broader replication while respecting employee privacy rights.

9.4 Practical implications

For managers implementing generative AI in enterprise settings, the findings support six evidence-grounded design recommendations. The first is risk-calibrated deploy-ment: concentrate the most restrictive components on high-stakes tasks, where the evidence shows the largest governance returns. The second is norm-first sequencing: encode organizational norms into policies and prompt constraints before users access the system; retrofitting governance after incidents occur is both more costly and less effective. The third is annotation investment: the performance of the bias monitor and output filter depends directly on the quality of expert-annotated reference datasets; this investment should be budgeted as a first-class deployment cost.

The fourth is trans-parent escalation: approval gates and escalation paths must be accompanied by clear rationale documentation, and false-positive rates must be actively monitored and cal-ibrated; the workaround data demonstrate that perceived disproportionality generates circumvention behavior that erodes governance coverage. The fifth is log-to-outcome linking: logging interactions is necessary but not sufficient; governance value is real-ized only when logs are connected to downstream decision outcomes so that the causal chain from AI input to organizational impact can be reconstructed. The sixth is change management investment: a persistent productivity cost and an initial period of reduced satisfaction should be anticipated, budgeted for, and managed through active user education about the purpose and mechanics of the guardrail system.

9.5 Policy implications

The findings speak directly to the governance tension revealed by the executive order analysis in Sect. 6. The oscillation between risk-management and competitiveness logics has created uncertainty about what guardrail investments are required versus optional. The empirical evidence suggests that this tension is less severe than either camp assumes. Guardrails produce large improvements in fairness and auditability at costs that are moderate in magnitude: the satisfaction decline is small and temporary, fading as users adapt, while the 12 percent task completion time increase persists as structural workflow overhead (d = 0.38) that client quality improvements partially offset.

For regulators, the implication is that mandatory guardrail requirements need not significantly impede AI performance if they are designed with user experience in mind and calibrated to task stakes. The Preventing Woke AI order’s prohibition on output alteration is technically and legally workable within an escalation-based architecture, because the bias monitor routes flagged outputs to human review rather than modify-ing them algorithmically; the order’s neutrality condition is satisfied while the fairness objective is preserved. Standards bodies should consider developing a certification framework that distinguishes output-altering from output-escalating guardrail com-ponents and specifies minimum performance standards for each, providing regulatory clarity while enabling comparative research across organizational contexts.

9.6 Limitations

Several limitations bound the scope of the findings. The study was conducted at a single site in a single industry over a 28-week window. Whether effect magni-tudes generalize to healthcare, financial services, education, or government contexts is an open empirical question; the large resource endowment of the field site may produce effect sizes that smaller organizations cannot replicate. The stepped-wedge design, while appropriately chosen given the ethical constraints, does not fully rule out time-varying unmeasured confounders, even with synthetic control and Rosenbaum robustness checks; the pre-trend test is a necessary but not sufficient condition for causal identification.

The operationalization of fairness as the equality-of-opportunity false-negative rate gap, while grounded in established fairness criteria, captures only one dimension of algorithmic fairness; alternative criteria such as calibration or individual fairness may yield different assessments of guardrail effectiveness.

A limitation that deserves separate emphasis is the structural bias in workaround detection. Workarounds were identified through interaction-log metadata and open-text self-report, and both channels systematically miss the most successful circumven-tion: a consultant who effectively routes work around the logging infrastructure leaves no trace in it, and effective circumventors have the least incentive to self-report. The detection method is therefore biased against observing exactly the behavior it mea-sures, and the reported figures (35 percent of teams, under 4 percent of interactions) are lower bounds of unknown tightness. Two consequences follow.

The claim that workarounds did not materially affect the main results holds only for results as mea-sured on logged interactions; undetected circumvention removes interactions from the measurement frame entirely, so the treatment effects characterize governed work rather than the totality of consultants’ AI use. And the legitimacy boundary condition identified in Section 8.3 is, if anything, understated: if circumvention is more prevalent than detected, the erosion of governance coverage under low perceived legitimacy is correspondingly larger.

The subgroup and heterogeneity findings carry their own caveat, developed in Sec-tion 7.5: with 20 teams as the clustering unit, between-team moderator splits can reliably detect only cluster-level differences of roughly d = 1.3 at conventional power, and within-team moderators, though better powered, still rest on 20 clusters for infer-ence. The heterogeneity results are accordingly exploratory and require replication in designs with more clusters before they should inform policy.

The findings are also indexed to a specific tool generation. The governed system was a GPT-4-class copilot (Section 2.2) whose model version was frozen during the study, and generative AI capabilities have advanced rapidly since the study window: newer frontier models exhibit different baseline hallucination rates, different suscepti-bility to injection, and increasingly agentic capabilities that create governance surfaces (tool use, autonomous multi-step execution) that this artifact did not need to govern. We expect the mechanism-level theory (encode, monitor, escalate, under a legiti-macy boundary condition) to travel across model generations better than the specific effect magnitudes, which should be treated as estimates for the disclosed capability class rather than as constants of guardrail governance.

The 28-week window like-wise does not permit assessment of long-run effectiveness as the AI system undergoes model updates, as users develop more sophisticated workaround strategies, or as the regulatory environment continues to evolve.

Two further limitations remain. The study did not directly measure how participants experienced the guardrail’s monitoring apparatus relative to the firm’s pre-existing surveillance norms (whether it was perceived as continuous with familiar oversight or as a tightening of it), so the surveillance interpretation developed in Section 9.1, while consistent with the workaround evidence, could not be tested against a purpose-built construct. Finally, the study was conducted with the knowledge and active support of the firm’s leadership; Hawthorne effects on consultant behavior cannot be entirely ruledout,thoughthemanipulationcheckevidenceindicatesthatbehavioraldifferences align closely with the structural differences in the guardrail system rather than with awareness of being studied.

9.7 Future research agenda

The guardrail design theory opens several productive research directions. Longitudinal studies extending beyond the 28-week window should examine whether effectiveness persists as AI systems are updated, as users develop more sophisticated circumven-tion strategies, and as regulatory requirements continue to evolve. Of particular interest is whether the algorithmic accommodation behavior documented here (users adapt-ing their prompting practices in response to guardrail feedback) becomes durable or degrades as novelty wanes.

Equally pressing is replication across model generations: as organizations move from chat-based copilots of the class studied here to more capable and increasingly agentic systems, research should test which elements of the design theory are capability-invariant and which components (particularly the output filter thresholds and the escalation taxonomy) must be re-derived for systems that act rather than merely generate.

Multi-site replication designs pooling stepped-wedge data across firms and indus-tries would establish the generalizability of effect magnitudes and design principles. Such designs should explicitly vary organizational resource levels, industry risk pro-files, and regulatory environments to identify the boundary conditions under which guardrail effectiveness strengthens or weakens.

Cross-national comparative research can assess how different regulatory regimes (the EU’s risk-based AI Act, the US competitiveness-first executive order sequence, and emerging frameworks in Asia and the Global South) shape guardrail architectures andtheirgovernanceeffectiveness.Themodulararchitectureprincipleidentifiedinthis study provides a testable prediction: organizations operating under volatile regulatory regimes should benefit more from modular designs than those operating under stable regimes.

The workaround finding calls for dedicated research on legitimacy dynamics in AI governance. Studies should examine whether transparent rationale documentation and lower false-positive rates causally reduce circumvention behavior, or whether legitimacy perceptions are shaped by deeper organizational and cultural factors that transparency alone cannot address. Such work should include purpose-built mea-surement of surveillance perceptions (whether users experience guardrail monitoring as continuous with existing organizational oversight or as an intensification of it ) and should develop detection strategies for circumvention that do not depend on the monitored infrastructure itself, such as anonymous audits or third-party instrumentation, to bound the undercount identified in Section 9.6.

Finally, the IS field needs algorithmic auditing standards that allow external evaluators to assess guardrail performance without requiring access to sensitive orga-nizational data, creating the conditions for evidence-based AI governance that both enterprises and policymakers urgently need.

10 Conclusion

Organizations are deploying generative AI at a pace that consistently outstrips their governance capabilities. The result is a widening gap between what these systems can do and what organizations can ensure about what they actually do in practice. This paper addresses this gap by designing, implementing, and evaluating AI guardrails as sociotechnical tools thathelp make AI-assisted work more predictable, fair, safe, and accountable.

Three contributions stand out. Theoretically, the paper consolidates and extends the IS construct of AI guardrails: building directly on the norm-based coordination design theory of, it broadens the theory from predictability to four target properties, formally specifies the construct, and develops a design theory connecting three mecha-nisms to four target properties and thence to organizational outcomes. The framework provides the IS community with a shared vocabulary and a testable theoretical structure for cumulative inquiry into AI governance mechanisms.

Empirically, the stepped-wedge field study provides the first pre-trend-validated causal evidence on guardrail effectiveness under realistic organizational conditions, supporting all five hypotheses with effect sizes ranging from small to very large, and identifying perceived legitimacy as a boundary condition that prior theory did not anticipate. The workaround finding in particular, detected in at least 35 percent of teams when guardrails were perceived as opaque or disproportionate, establishes that governance mechanisms must earn user legitimacy to sustain their effectiveness over time.

Practically, the evidence-based design playbook, design science mapping, and regulatory analysis offer managers and policymakers a principled framework for guardrail investment decisions in a regula-tory environment that has shifted dramatically between administrations and shows no sign of stabilizing.

Appendix A: Design search: candidate architectures evaluated

Three candidate architectures were evaluated during the six-week design sprint prior to the field study. The evaluation criteria were: false-positive rate below 15 percent in pilot testing; coverage of all four target properties; and implementation feasibility within the firm’s existing IT infrastructure.

Architecture 1 (prompt-only) applied constraints solely at the input stage through prompt filtering and rewriting. This design achieved full predictability and safety coverage but produced a false-positive rejection rate of 41 percent in pilot testing, as the prompt filter was unable to distinguish legitimate professional queries from policy-violating requests without extensive context. The architecture was rejected on criterion 1.

Architecture 2 (output-only) applied filtering only to generated text, leaving prompt inputs unconstrained. This design achieved fairness and predictability coverage but could not prevent data leakage from prompt content: a consultant could attach a full client contract as context without any constraint, even if the resulting output was filtered. The architecture was rejected on criterion 2 because it did not cover the data-leakage dimension of safety.

Architecture 3 (three-layer: policy, technical, workflow) was selected as it satisfied all three criteria: a false-positive rate of 12 percent in pilot testing (subsequently cali-brated to 7.2 percent in production through threshold tuning), coverage of all four target properties, and integration with the firm’s existing GDPR compliance infrastructure for the policy layer and its IS ticketing system for the escalation workflow.

Appendix B: Survey instrument items

The following items were administered at survey waves S1 through S4. Response scales are noted in brackets.

User satisfaction (adapted from prior IS research; five-item scale, 1 = strongly disagree, 5 = strongly agree): (SAT1) I am satisfied with the way the AI copilot supports my work. (SAT2) The AI copilot helps me accomplish my tasks effectively. (SAT3) Overall, the AI copilot meets my expectations. (SAT4) Using the AI copilot is a positive experience for me. (SAT5) I would recommend the AI copilot to a colleague performing similar tasks.

Accountability understanding (three-item scale, 1 = strongly disagree, 5 = strongly agree): (ACC1) I know who is responsible for reviewing AI-generated outputs before I act on them. (ACC2) I understand how errors in AI-assisted work are traced and attributed in this organization. (ACC3) I am clear about my personal accountability when I act on an AI recommendation.

Perceived guardrail fairness (three-item scale, administered at S2 through S4 only; 1 = strongly disagree, 5 = strongly agree): (PGF1) The rules governing what the AI system will and will not do are reasonable. (PGF2) The AI system applies its policies consistently across different types of requests. (PGF3) When the AI system blocks or flags my request, I understand why.

Funding This research received no funding.

Data Availability Data availability. Due to the confidentiality agreement with the partner organization, individual-level interaction log data cannot be made publicly available. However, the primary analyses reportedinTable9operateonteam-weekaggregates,andthefirm’sdatagovernancecommitteehasapproved release at that level. A replication package accompanying this article therefore contains: (a) the de-identified team-week panel (20 teams × 28 weeks) for all outcome variables, treatment indicators, and timevarying controls used in the difference-in-differences, synthetic control, and Rosenbaum bounds analyses; (b) the complete analysis code (Section 7.5); (c) the CFA input correlation matrices and per-wave fit output; and (d) the codebook.

The package permits independent reproduction of every coefficient, effect size, and fit statistic reported in the paper without access to any individual-level or content-level data. The survey instrument items are reproduced in full in Appendix B.

Author Contributions M. Leon is the only author of this paper.

Code Availability The complete analysis code is included in the replication package described under Data availability.

Declarations

Conflict of interest The author declares no conflict of interest.

Ethical approval The study received institutional review board approval from the author’s institution (proto-col blinded for review) and organizational ethics review from the partner firm’s data governance committee. All participants provided written informed consent (Section 7.1).

OpenAccess ThisarticleislicensedunderaCreativeCommonsAttribution4.0InternationalLicense,which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the

1. McKinsey & Company: The state of AI in 2025: Agents, innovation, and transformation.

Survey report, McKinsey Global Institute (2025). the linked source

2. Tanriverdi H, Akinyemi J-PO (2025) Algorithmic social injustices: Antecedents and mitigations.

MIS

3. Kronblad C, Essén A, Mähring M (2024) When justice is blind to algorithms: Multilayered blackboxing.

4. Jussupow E, Benbasat I, Heinzl A (2024) An integrative perspective on algorithm aversion and.

5. Teodorescu MHM, Morse L, Awwad Y, Kane GC (2021) Failures of fairness in automation require a.

6. Stelmaszak M, Möhlmann M, Sørensen C (2025) When algorithms delegate to humans: exploring.

7. Hevner AR, March ST, Park J, Ram S (2004) Design science in information systems research. MIS Q.

8. Jones D, Gregor S (2007) The anatomy of a design theory.

J Assoc Inf Syst 8:312–335. the linked source.

9. Grisold T, Berente N, Seidel S (2025) Guardrails for human-AI ecologies: Norm-based coordination.

10. Teferra BG, Johny N, Huang S, Rueda A, Kamaleddin MA, Dunlop K, Zhang Y, Jha M, Sharma D.

Bhat V (2026) Assessing the impact of safety guardrails on large language models using irritability metrics. NPJ Digit Med 9:1–2. the linked source

11. Dong Y, Mu R, Jin G, Qi Y, Hu J, Zhao X, Meng J, Ruan W, Huang X (2024) Building Guardrails for.

12. Adam M, Mishra AN, Benlian A (2025) Agent-based data curation practices: Customer responses to.

human versus algorithmic data requesters in established Business-to-Business relationships. Inf Syst Res. the linked source

13. Fu R, Huang Y, Singh PV (2021) Crowds, lending, machine, and bias.

Inf Syst Res 32:72–92. https://

14. BatraD,XiaW,ZhangM(2017)Collaborationinagilesoftwaredevelopment:Conceptanddimensions.

Commun Assoc Inf Syst 41:429–449. the linked source 15. Aral S, Dellarocas C, Godes D (2013) Introduction to the special issue on social media and business transformation: A framework for research. Inf Syst Res 24:3–13. the linked source. 0470

16. Walls JG, Widmeyer GR, El Sawy OA (1992) Building an information system design theory for vigilant.

17. Hannigan TR, McCarthy IP, Spicer A (2024) Beware of botshit: How to manage the epistemic risks of.

generative chatbots. Bus Horiz 67:471–486. the linked source 18. Work AI Institute: The work AI index 2026: Botsitting, botshitting, and the hidden human labor of AI at work. Technical report, Glean Technologies (2026). the linked source reports/work-ai-index 19. Wei D, Chau M, Li ZL (2025) Mitigating bias in hate speech detection with a small number of expert annotations: A prompt-based learning approach. MIS Q 49:1483–1512. the linked source misq/2025/18416

20. Liang H, Srinivas S, Xue Y (2023) How mergers and acquisitions increase data breaches: A complexity.

perspective. MIS Q 49:211–242. the linked source 21. Tanriverdi H, Kwon J, Im G (2025) Taming complexity in the cybersecurity of multihospital systems: The role of enterprise-wide data analytics platforms. MIS Q 49:243–274. the linked source misq/2024/17752

22. Chouldechova A, Roth A (2020) A snapshot of the frontiers of fairness in machine learning. Commun.

ACM 63:82–89. the linked source 23. Floridi L, Cowls J (2022) A unified framework of five principles for AI in society. Machine Learning and the City. pp 535–545. the linked source 24. O’Neil C (2016) Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy. Crown, New York 25. Ebrahimi R, Chai Y, Li W, Pacheco J, Chen H (2025) RADAR: A framework for developing adver-sarially robust cyber defense AI agents with deep reinforcement learning. MIS Q 49:1385–1416. the linked source

26. Vance A, Jenkins JL, Anderson BB, Bjornn DK, Kirwan CB (2018) Tuning out security warnings:.

A longitudinal examination of habituation through fMRI, eye tracking, and field experiments. MIS Q 42:355–380. the linked source 27. Hardt M, Price E, Srebro N (2016) Equality of opportunity in supervised learning. Adv Neural Inf Process Syst 29: 28. Floridi L, Taddeo M (2025) Moral vs legal norms: Soft and hard ethics. A Companion to Digital Ethics. pp 11–23. the linked source 29. Giddens A (1984) The Constitution of Society: Outline of the Theory of Structuration. Polity Press, Cambridge 30. Dwork C, Hardt M, Pitassi T, Reingold O, Zemel R (2012) Fairness through awareness. In: Proceedings of the 3rd Innovations in Theoretical Computer Science Conference. ITCS’12, pp. 214–226. ACM, New York, NY, USA. the linked source 31. Wiener N (1948) Cybernetics: Or Control and Communication in the Animal and the Machine

MIT Press, Cambridge, MA 32. Fogg BJ (2003) Persuasive Technology: Using Computers to Change What We Think and Do 35. Gao Y, Gu M, Liu D (2025) Behind privacy labels: Data tracking and advertising competition on app platforms. MIS Q 49:1595–1626. the linked source 36. Lin F, Samtani S, Zhu H, Brandimarte L, Chen H (2024) Automated analysis of changes in privacy policies: A structured self-attentive sentence embedding approach. MIS Q 48:1453–1482. the linked source 37. Datta P, Acton T (2025) Promises and perils of generative AI in cybersecurity 38. Schneier B, Vance A (2025) Guest editorial:“complexity is the worst enemy of security”: Studying cybersecurity through the lens of organizational complexity. MIS Q 49:205–210. the linked source 10.25300/misq/2025/49.1.075 39.

Hagendorff T, Derner E, Oliver N (2025) Large Reasoning Models Are Autonomous Jailbreak Agents. arXiv. the linked source 40. Yin D, Mullarkey M, Vreede G-J, Limayem M (2025) Learning by phishing via post-simulation feedback: From embedded to non-embedded training. MIS Q 1–21. the linked source 2025/19354 41. The White House: Executive Order 13960: Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government. 85 Fed. Reg. 78939 (2020). the linked source 2020/12/08/2020-27065/promoting-the-use-of-trustworthy-artificial-intelligence-in-the-federal-government 42. Office of Management and Budget: Driving efficient acquisition of artificial intelligence in government. Memorandum OMB M-25-22, Executive Office of the President (2025). the linked source omb/information-for-agencies/memoranda/ 43.

Leon M (2026) GPT-5 and open-weight large language models: Advances in reasoning, transparency, and control. Inf Syst 136:102620. the linked source 44. The White House: Executive Order 13859: Maintaining American Leadership in Artificial Intel-ligence. 84 Fed. Reg. 3967 (2019). the linked source 45. The White House: Executive Order 14148: Initial Rescissions of Harmful Executive Orders and Actions. 90 Fed. Reg. 8237 (2025). the linked source 46. The White House: Executive Order 14179: Removing Barriers to American Leadership in Artifi-cial Intelligence. White House Presidential Action (2025). the linked source 47. The White House: Restoring Common Sense to Federal Procurement. White House Presidential Action (2025). the linked source 48. The White House: Advancing Artificial Intelligence Education for American Youth. White House Presidential Action (2025). the linked source 49.

The White House: Promoting the Export of the American AI Technology Stack. White House Presiden-tial Action (2025). the linked source 50. The White House: Accelerating Federal Permitting of Data Center Infrastructure. White House Presidential Action (2025). the linked source 51. The White House: Preventing Woke AI in the Federal Government. White House Presiden-tial Action (2025). the linked source 52. Brown CA, Lilford RJ (2006) The stepped wedge trial design: A systematic review. BMC Med Res Methodol 6: the linked source 53. Podsakoff PM, MacKenzie SB, Lee J-Y, Podsakoff NP (2003) Common method biases in behavioral research: A critical review of the literature and recommended remedies. J Appl Psychol 88:879–903. the linked source 54. Hong Y, Pavlou PA, Shi N, Wang K (2017) On the role of fairness and social distance in designing effective social referral systems.

MIS Q 41:787–809. the linked source 55. Suchman MC (1995) Managing legitimacy: Strategic and institutional approaches. Acad Manag Rev 20:571. the linked source 56. Zuboff S (1988) In the Age of the Smart Machine: The Future of Work and Power. Basic Books, New York 57. Foucault M (1977) Discipline and Punish: The Birth of the Prison

Pantheon Books, New York. Translated by Alan Sheridan 58. Deetz SA (1992) Democracy in an Age of Corporate Colonization: Developments in Communication and the Politics of Everyday Life. State University of New York Press, Albany, NY

Publisher’s Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.