AI suppliers are handing companies new controls, and companies using AI now have to prove who checks it and what it replaced.
The AI Transformation Brief
The controls for AI are moving into the hands of the companies that use it. Anthropic now lets security teams check every request and every action before Claude runs it. Anthropic OpenAI released its most capable security AI only to vetted customers and recommends a person oversee risky steps. Pure AI Twelve companies cited AI in official layoff filings without saying what AI now does. FourWeekMBA The controls exist. Someone inside each company now has to use them.
Anthropic made two checks generally available for Claude Enterprise on November 5. One sends each prompt to a company's own security tools before Claude answers; the other checks each action Claude plans to take, such as using a connected app, before it runs. Anthropic One setup covers Claude, Claude Code and Cowork. the Claude Help Center A new security page compares a company's settings with Anthropic's recommendations, and admins can sign a person out everywhere and block personal Claude accounts on company computers. Anthropic
This puts the rules where they belong: with the company, applied before the AI acts. Security teams can reuse rules they already wrote for email and files. The catch is ownership. Anthropic says the security page is guidance, not a guarantee of compliance with any law. Anthropic Name who writes the rules each check applies, review blocked actions every week, and turn off personal AI accounts on company machines.
The company's security team answers for the rules each check applies, and Anthropic answers for running the checks. If no one updates the rules, the AI acts on yesterday's policies.
OpenAI released a new security AI on November 5 that can find software flaws and build working attacks, giving it Critical, its own highest risk rating. Only a small group of approved security-testing customers can use it for now. OpenAI says it built attacks for 948 Linux flaws, 588 of them previously unknown, and found 81 high-severity Firefox flaws. Customers must use approved company networks, and OpenAI recommends isolated test setups and human oversight for high-risk work. Pure AI
OpenAI's own research shows why the person matters. In one early test that reported 200 successful attacks, human reviewers found 20 had succeeded through a different flaw than the one assigned. Some early AI-written fixes created new problems. Pure AI Treat AI findings and fixes as drafts: require a person to confirm each one, and decide in advance who may approve changes to live systems.
FourWeekMBA reviewed 35 US-listed companies whose 2026 layoff filings turned up in searches mentioning AI. Twelve named AI in the section describing the cut, with estimated charges totaling up to about $1.6 billion, $1 billion of it Cisco's. The median cut among the eight that gave a percentage was 9.5%, and Cloudflare's was the largest at about 20%. SoundHound, which began cutting about 27% of staff on November 4, cited profitability instead. FourWeekMBA
None of the 12 filings says AI now performs the eliminated jobs. FourWeekMBA Naming AI in a layoff tells investors a story. Proof that the work changed is a separate matter. Canva, cutting 1,271 roles, said its changes were not about using AI to do the work of people leaving. AI Layoffs Before citing AI in any restructuring, show which tasks AI now handles, who checks them, and what it costs.
Palmer looks at OpenAI's planned purchase of Pierre, whose tools store and review code inside Codex. He sees the appeal of keeping work in one place, and the dependency it creates. His test before moving more work there: move a project out with its history and approval records, hand it to another team, and see how much survives. Shelly Palmer
Suppliers are handing you the controls for AI, and running them is now your job.
This quarter, assign who sets the rules for each AI tool, who approves risky actions, and who can switch it off.
Suppliers now compete on the checks they give customers, and the most capable AI goes only to buyers who prove they can supervise it.
Companies with weak oversight will get weaker tools.
Treat AI output as a draft.
For every AI task, set who confirms results, who approves changes to live systems, and how the work and its history could move to another supplier.
When management cites AI in a restructuring, ask which tasks AI now performs, who checks that work, and what it costs.
Approve no AI-linked cut without that evidence.
The shift this edition is that AI suppliers are handing control to their customers: checks before AI acts, access only for buyers who can supervise, and records that should travel. The assumption it breaks is that the supplier carries the risk. The decision it forces is to staff the controls with rules, reviewers and a way out.
If you cited AI in your next restructuring, could you show the work it now does?
Make AI accountable. Measure the results. Redesign the business.