AI-Native Organisations Run on Skills: How to Structure and Scale Them — Imad Touil, QuantumBlack
Imad Touil explores the critical need for governing AI skills within organizations, asserting that skills represent the true repository of enterprise know-how. He contrasts simplified coding agent loops with complex, real-world product lifecycles, demonstrating how ungoverned skills lead to technical debt—including duplication, quality degradation, security risks, and lack of discoverability. Proposing a microservices-inspired approach, Touil outlines a centralized skills platform and human-led governance model essential for achieving deterministic workflows, boosting productivity, and mitigating risks in AI-native enterprises.
Imad Touil, a Distinguished Engineer at Quantum Black, highlights a critical challenge in AI-native organizations: while many professionals create and use AI skills, few effectively share, govern, or maintain them across their enterprise. He argues that this lack of governance leads to a significant form of technical debt, impeding the scalability and reliability of AI initiatives.
Touil first deconstructs the agentic software stack, which comprises an “inner loop” (code agents, context managers, tools, memories, skills loaders) and an “outer loop” of workflows (skills, sub-agents, MCP servers, hooks). Crucially, enablement components like environment sandboxes, model gateways, and knowledge graphs underpin this stack, with a context layer providing task-specific information. He clarifies that while typical coding agents focus on a simplified “specify, plan, task, implement” loop, real-world product delivery lifecycles are vastly more complex. These involve comprehensive stages from product strategy and market research to data preparation, platform engineering, and continuous optimization, often managed by diverse departments with varying methodologies.
The core of Touil’s argument is that within these complex workflows, “know-how” primarily resides at the skills level. Hooks merely trigger events, sub-agents largely serve to manage context windows, and most organizations consume rather than build their own MCP servers. Consequently, if skills remain unstructured and ungoverned, workflows lose their determinism and become unpredictable. He points to the rapid rise in skills adoption and the emergence of open standards, noting that benchmarks clearly demonstrate the superior, more deterministic outcomes achieved when agents utilize well-defined skills.
To address the governance challenge, Touil advocates for designing and managing skills using principles borrowed from the microservices era:
- Reusable, Modular, Discoverable: Skills should be easily found and applied across different contexts.
- Portable: Usable across various workflows and agent harnesses, given evolving standards.
- Specialized: Focused on single, well-defined tasks, avoiding monolithic designs.
- Composable: Designed to be combined without conflicts or duplication, enabling complex functionalities like audit trails through regulatory compliance skills (e.g., data retention, GDPR rules).
- Consistent & Deterministic: Ensuring reliable and predictable outcomes.
- Cost-Efficient: Skills, particularly through “progressive disclosure,” reduce token usage by providing agents with precisely the right information at the right time.
Without proper governance, organizations face severe consequences:
- Duplication: Teams on similar tech stacks repeatedly build identical skills.
- Quality Degradation: Skills aren’t re-tested against new models, leading to decay.
- Lack of Ownership & Discoverability: No clear accountability or means to find existing capabilities.
- Impaired Composability: Skills cannot be effectively combined.
- Security Risks: Skills can contain scripts, posing supply chain risks (e.g., prompt injection, insecure code) if public skills are pulled without vetting.
- Permission Issues: Sensitive business logic in skills necessitates strict access control.
Touil proposes a three-tiered solution:
- Individual Level: Enable engineers to create, test, and use skills using agreed-upon tools.
- Team Level: Foster collaboration and sharing within teams to improve skills.
- Centralized Platform: The cornerstone for enterprise-wide skills management, featuring:
- A searchable catalog with rich metadata.
- Dependency management and versioning for reliable updates.
- Robust access control.
- Evaluation and observability mechanisms. Crucially, Touil stresses that governance is where technology stops solving the problem. This requires human leadership, with architects, engineering leads, infrastructure leads, and cyber leads defining policies and owning specific domains to ensure skills adhere to organizational standards and drive change.
Through a simulation of 15 teams over six months, Touil illustrates that ungoverned environments result in low visibility, inconsistent productivity, high costs, and compromised quality and security. Conversely, a governed approach—where a centralized platform ensures skills are discovered and reused—significantly boosts productivity, quality, and security while optimizing costs. He extends this concept, suggesting that the same governance principles should apply to entire workflows, centralizing them for reuse and continuous improvement.
Looking ahead, Touil emphasizes the need for skills registries (often integrated into Internal Developer Portals) and robust skills evaluation methods (e.g., based on best practices). He also warns about the emerging trend of auto-evolving skills, stressing that implementing such closed-loop systems without prior, strong governance and guardrails could lead to uncontrolled and potentially detrimental changes.