Recently I have referred to AI as layer 8 of the OSI model. It started as a joke, and it has become the plainest way I have of explaining what is changing.
Network engineers and sysadmins have always had a layer 8. The model stops at seven, the application layer, and anything that went wrong above that was the person using the application, so "it's a layer 8 problem" meant the fault was the user, not the network. I said it myself for years as an engineer.
What has changed is that there is now software at layer 8. An AI layer sits between the person and the applications: the person states an outcome, and the software decides which applications to use, in what order and with what data. You won't find it in the standard, but it's what is being built.
I once heard Claude described as the anything app. I can't remember who said it, but it resonated, because I can see the world it describes: people no longer dealing with a disparate array of apps and operating systems, just talking to an AI layer that sits on top of all of them.
Parth Shah's XDA Developers article from August is an early account of that in practice. His headline says Anthropic is turning Claude into a productivity OS; his description of what he actually uses is more careful, and more useful: "Claude doesn't replace any OS or a dedicated productivity app I use, but it is becoming the layer that connects them all." The apps stay, and what is new sits between him and all of them.
I run a small version of the same layer at home, and that is where the control question first came up for me. The same request made from my phone is allowed to reach fewer systems than the identical request made from my desk. That rule doesn't live in any of the applications it protects. It lives in the layer above them, and I had to write it myself, because nothing underneath provides it.
The organisations I work with rely on controls that all work the same way. Access is granted by role. Actions are recorded in an audit log. A system is accredited before it goes live. Every one of those controls is attached to a system. When a person states an outcome and software chooses the systems, the decision that matters most, which systems were touched and why, is made in none of them. Each system's log shows a call arriving. None of them shows the intent behind it, or why the layer chose that system and not another.
Access, audit and accreditation now have to apply to that layer as well, and I haven't yet worked with an organisation that has an owner for it.
Sources