The New Workforce / Field Notes
A Platform Playbook · FN-03
The CIO playbook
for digital labor.
Platform leadership for a workforce of agents. You are being asked to do four jobs. Pick two.
Begin reading
The New Workforce / Field Notes
Platform leadership for a workforce of agents. You are being asked to do four jobs. Pick two.
Executive summary
The job now spans HR, payroll, finance, and security. All for a workforce that is partly synthetic. No CIO staffs all four jobs well. Own the platform. Govern the security perimeter. Run AI FinOps on top of both. Hand the workforce decision to the CHRO. Hand budget allocation to the CFO. The five points below are what follows from that choice.
Build an agent runtime with a clear API, observability, and identity controls. The role is platform owner. Not procurement officer.
Only 5% of security leaders are confident they could contain a compromised agent (Saviynt, 2026). Any API key older than 90 days is a breach waiting to happen.
78% of FinOps teams already report to the CIO. In late 2025, one developer ran up $100,000 in cost from a single script. Cost observability is no longer optional.
Buy the platform. The agent itself is a workforce decision. The CHRO owns it. The CIO supports it.
IDC expects agent counts to grow 80x by the end of 2026. Build the platform before the volume hits. Or rebuild a broken one in 2028.
Contents
If IDC's forecast holds, an enterprise running 100 agents this year will be running 8,000 by the end of 2027. The infrastructure choices you make now will compound for a decade.
Part One · Platform
An enterprise running 100 agents in 2026 will be running 8,000 by the end of 2027 if IDC's forecast holds. The infrastructure decisions made now compound for a decade.
Every agent deployment runs on a stack of infrastructure: the model, the orchestration framework, the tool and data access layer, observability, and identity. Most enterprises in 2026 have built or bought the first two and are improvising the rest.
The CIO's first job is to define the agent runtime as one platform. Not a pile of vendor contracts. It needs a clear API, a published SLA, observability that works the same across every agent, and a deployment path any team can use. Without that, every agent becomes a custom IT project. And the CIO becomes the bottleneck for the entire digital labor program.
Three layers, three answers.
What the CIO publishes internally as the agent platform should have four layers, each with a clear owner. Click a layer to expand its scope.
The architecture matters because it makes the CIO's role specific. The CIO owns these four layers. The CIO does not own the agents that run on top of them. That separation is what FN-02 calls the joint motion.
Part Two · Observability
78% of FinOps functions report into the CIO. Cost-per-outcome economics are now part of the platform's job, not an afterthought.
Inference cost is variable, agent-driven, and spikes fast. In late 2025, one developer ran a loop that burned 55,000 tokens and $100,000 in cost. Observability is no longer optional. Without it, the CFO sees the spike before you do.
This is the metric that turns engineering math into business language. A SOC triage agent at $0.04 per ticket beats the human alternative. The same agent at $0.40 per ticket eats the savings it was meant to create. That is fine if you measure it. A problem if you don't. Track it per agent. Not per platform.
Model layer unit economics.
Orchestration unit economics.
Above 20% → investigate. Above 50% → the workflow changed; supersede the displacement case.
The platform layer needs hard caps, not just dashboards. A model gateway with per-agent and per-team rate limits stops a runaway script before it becomes a P&L event. A credit budget (agent X gets Y dollars per month before approval is required for more) gives the CFO predictability and the CHRO a workforce-style envelope to manage to.
The FinOps Foundation's 2025 State of FinOps survey ranks pre-deployment architecture costing as the most-requested capability for AI workloads.8 The reason: by the time the bill arrives, the architectural choice that drove the cost is already in production. Costing the architecture before deployment is where the spend gets controlled.
FN-02 proposed a quarterly review attended by CFO, CHRO, and CIO together. The CIO arrives with three artifacts: spend by agent and by function, cost per outcome trends, and the forward request — what the platform needs to support the workforce plan the CHRO is building for the next two quarters. That third item shifts the conversation from how much are we spending to where does the spend create value, and what does the platform need next.
Part Three · Partnership
The CIO who tries to own everything ends up owning nothing. The seat that compounds is platform leadership. Workforce decisions go to the CHRO. Budget envelopes go to the CFO.
The most consequential part of the CIO's role in 2026 is the one most underbuilt today. Agent identity is unlike any prior security problem. Agents authenticate continuously, delegate to other agents, accumulate standing access, and operate at machine speed. Legacy IAM was built for humans logging in once a day.
Saviynt's 2026 CISO AI Risk Report (n=235) found that 47% of security leaders have already observed AI agents exhibiting unintended or unauthorized behavior, and only 5% feel confident they could contain a compromised agent.2
The Cloud Security Alliance and Oasis Security survey (n=383) framed the same gap from the IAM side: 79% have moderate or low confidence preventing non-human identity attacks, 92% lack confidence that legacy IAM tools can manage AI risks specifically, and 78% have no documented policies for creating or removing AI identities.9
What the CIO function actually owns here is concrete. An inventory of every agent and every MCP server connection. A lifecycle policy for agent identities covering creation, scope, rotation, retirement. Just-in-time credentials with TTLs and purpose binding. Runtime enforcement that validates what an agent does, not just whether it authenticated. None of this is theoretical.
The vendor relationship for agent platforms is different from the SaaS relationship the CIO function knows well. SaaS contracts price seats and uptime. Agent contracts price outcomes, tokens, and retries. Most procurement templates handle none of this correctly.
Three contract terms that need to change for agent vendors: per-outcome pricing with a defined success metric (not per-seat or per-token, where the vendor controls cost); retry economics (who pays when an agent fails and retries — the customer or the vendor); and data and decision logs as customer property (the agent's traces are training data and audit evidence, not vendor IP).
FN-02 introduced the decision rights matrix from the workforce side. Same matrix, viewed from the CIO function:
The platform decision is the CIO's. Everything else is a partnership where the CIO is a consultant, not a commander. That discipline is what gets the CIO invited to more decisions, not fewer.
The cultural mechanism that makes the joint motion work is a single number all three executives optimize for. If the CFO is targeting budget reduction, the CHRO is targeting headcount growth, and the CIO is targeting platform reliability, the motion fragments into three competing scorecards.
The shared number is total workforce capacity per dollar: revenue divided by the sum of employee, contractor, and agent spend. It rises when humans get more productive with copilot AI. It rises when agents substitute for the right work. It falls when agent spend grows without producing outcomes, or when headcount grows without revenue. All three executives can read it and act on it.
The CIO supports the build-vs-buy decision on agents but does not own it. The owner is the CHRO and the function lead. The CIO's contribution is the architectural read: can our platform run a custom agent of this complexity, and what does the cost-per-outcome look like across the build and buy options?
The default in 2026 should be buy. Build only when (a) the workflow is core to the business, (b) the agent encodes proprietary process knowledge, and (c) the company has the engineering capacity to maintain it for at least three years. Most build cases fail the third test.
Section 04
Six failure modes specific to the CIO function in 2026.
Procuring the platform, deploying the agent, and effectively making the headcount decision. The CHRO finds out from the org chart. Hiring plans then conflict with deployments already live.
Every team uses the SDK directly. No central logging, no rate limits, no model-selection governance. Cost surprises are guaranteed. Audit trail is impossible to assemble.
Provisioning agents like service accounts. Long-lived API keys, no scope limits, no rotation policy. The first compromised agent becomes the perimeter breach the board hears about.
Cost reporting without enforcement. The dashboard shows the spike after it happened. The CFO asks why the limit wasn't enforced. The platform team scrambles to add caps post-incident.
Signing agent vendors on SaaS terms. Per-seat pricing on a function that scales with volume. The vendor captures the upside; the customer carries the variance. Re-papering takes 18 months.
Letting teams ship agents to production without a cost-per-outcome model. Six months later, three agents are profitable, seven are losing money, and nobody can tell which is which.
Section 05
Five disciplines. The CIO function that runs all five compounds. The function that defers any of them accumulates debt that gets expensive to repay in 2027.
→ The takeaway
Own the platform. Govern the perimeter. Run FinOps. The other two jobs belong to the CHRO and the CFO. Hand them over and stay invited.
About TeamOhana
TeamOhana is the platform 64 enterprise customers, including CoreWeave, Scale AI, Pure Storage, and Vercel, use to govern workforce capital decisions before they reach Workday, Greenhouse, or the FP&A model. The platform brings the hiring manager, Finance, HR, Talent, and Leadership into one decision surface, and stores every workforce decision with its evidence and approvals.
The Digital Labor extension applies the same governance model to agents. The Digital Labor Registry tracks deployments. The Companion Model extends the requisition workflow to human-plus-agent and standalone-agent configurations. The metric introduced in FN-02 (Digital Labor Mix) is reported natively. The platform feeds the CIO's quarterly pack referenced in this playbook.
Be among the first to govern digital labor at your company. Get early access, design-partner invites, and new Field Notes before they go live.
Sources & citations
"The CIO seat in 2027 belongs to whoever can already answer three questions: what is running, what does it cost, and who is keeping it safe. Everything else gets reorganized around the answer."