Empowering business growth: How you can secure your enterprise from AI risks with SaS

Service as Software (SaS) represents a fundamental shift from software that supports human work to software that performs the work itself. It reverses the SaaS model: instead of tools for users, autonomous, AI-driven agents deliver complete outcomes. Powered by large language models, software now understands context, executes complex workflows, and replaces repetitive human effort.

This is not an incremental improvement in delivery but a redefinition of what software is expected to do, transforming it from an organizer of work into the worker itself (Atos, 2026). With this, Autonomous Business (Meelhuijsen, et al., 2025) is quickly becoming a reality.

Value: Created by decisions and knowledge, not by processes

A critical and essential architectural insight is often overlooked.

Processes exist to sequence activities. They are necessary for flow but are inherently non-differentiating unless they directly contribute to consumer satisfaction. What consumers and customers experience as value is the outcome of knowledge-based decision-making: benefits, permits, pricing, eligibility, routing, personalization, prioritization, and resolution.

When enterprises optimize processes rather than decisioning, they create efficient bureaucracy. When they optimize decisioning, they create adaptive value. SaS starts with the premise that services exist to make and execute decisions at scale, safely, and repeatedly.

Services to living products: Architecture in motion

The Portfolio of Digital Open Standards (The Open Group, 2026) describes an enterprise organized around long-lived, autonomous teams that deliver value continuously within defined architectural guardrails. In such an enterprise, services cannot be implemented once and then operated by someone else. They must be deployable, versioned software units with clear ownership and feedback loops. with scope for continuous learning and improvements.

DPBoK™ reinforces this by shifting from projects to enduring digital products. Products integrate business behavior, software, and operations into a single lifecycle. When services are treated as software (i.e., products), architecture ceases to be a design-time activity and becomes a runtime-guided capability that is observable, testable and adaptable.

Architecture that operates

The TOGAF® 10 Standard reinforces this essential shift by reframing architecture governance as providing continuous monitoring and direction. Services defined in Business and Application Architecture deliver value only when realized as governable operational building blocks that embody TOGAF's SaS paradigm:

• Services become executable capabilities.
• Architecture principles become guardrails.
• Governance moves from reviews to ongoing runtime compliance.
• Traceability shifts from documents to telemetry.

Architecture is no longer something you describe and hope teams follow. It is something the system continuously enacts.

Conway’s Law: Designing for autonomy

Conway’s Law tells us that systems mirror the communication structures of the organizations that build them. Traditional service models violate this law by spreading ownership across design, delivery, and operations. The result is predictable: slow change and brittle systems with complex interfaces.

SaS deliberately embraces Conway’s Law. By aligning service boundaries with team boundaries, coordination is reduced to APIs and events. Autonomy becomes structural rather than aspirational. Teams own decisions; services own outcomes.

Rules as Code: Making policies executable

At this point, SaS requires a crucial component: Rules as Code (Lindqvist, 2024). Rules as Code is the practice of expressing business rules, legislation, policies and regulations in an executable, version controlled form, rather than prose. This ensures rules are explicit, testable, traceable and enforceable at runtime. Without Rules as Code, services remain dependent on human interpretation of policy, or on opaque AI models that cannot explain or justify outcomes. With Rules as Code, legislation, policies and regulations become a first class architectural asset, deterministic and auditable, embedded directly in services.

Digital Decisioning: Where value is actually produced

The Rules as Code component naturally fits into Digital Decisioning (Taylor, 2019). Decision logic, whether deterministic (e.g., DMN or RuleSpeak) or probabilistic (e.g., AI or machine learning), is treated as a separate, explicit concern from the process flow.

In a SaS architecture:

• Processes orchestrate.
• Services act.
• Decisions decide.

Processes remain the source of waste: they route and sequence. Decisions create value. By making decisions explicit and executable, enterprises gain transparency, explainability and adaptability, all of which are especially critical in regulated and high-impact domains.

Agentic and AI enabled services: Decisioning at scale

Agentic and AI-enabled services are often discussed as overlays on existing architectures. This approach fails. True agentic behavior requires services to observe, decide, act and learn autonomously within explicit guardrails. SaS provides the necessary conditions:

• Telemetry for perception of context
• Rules as Code and Digital Decisioning to provide bounded autonomy
• APIs and events that enable autonomous action
• Feedback loops for learning from outcomes
• Guardrails to enable governance

Without this foundation, AI remains an assistive tool. With it, AI becomes a responsible operational actor, safely embedded within enterprise architecture.

Service as Software across the IT4IT value streams

SaS turns IT4IT™ from a lifecycle model into a continuous value system. Here’s how it does it:

• Strategy to Portfolio (S2P): Strategy is expressed as executable product intent. Business- and IT services appear as software owned capabilities, measured by outcome metrics.
• Requirement to Deploy (R2D): The service is the unit of deployment. Architecture is enforced through pipelines, reference patterns, and automated controls.
• Request to Fulfill (R2F): Business- and IT services are self-describing and self-provisioning. Consumption occurs via APIs and events. Service levels are runtime objectives.
• Detect-to-Correct (D2C): Observability is intrinsic. Incidents become signals. Improvement is a code change. Operations become continuous learning.

This is why IT4IT ceases to be a conceptual framework and becomes an operational reality.

SaS across business value streams

Business value streams express customer value creation, while IT4IT value streams operationalize the digital lifecycle that enables those value streams to be executed at scale.

Practical architectural implications are as follows:

1. Design business value streams first. This should include customer outcome, operational decisions, and value.
2. Implement them as SaS: digital products, decisioning, agents.
3. Use IT4IT value streams to ensure those services can be consistently governed, delivered, and operated across the enterprise.

Business journeys define value creation. In a SaS model, many steps of the business journey are moved into software, enabling them to be executed, governed, and evolved at scale.

Synthesis

SaS is the architectural convergence point for SAFe, TOGAF 10, Open Agile Architecture, DPBoK, IT4IT, Rules as Code and Digital Decisioning. By recognizing that value is created by decisions, enterprises reposition processes as supporting rather than driving, thereby elevating decisioning to a first-class concern.

Large language models (LLMs) and agentic AI give software a more human-like understanding, enabling it to autonomously handle complex workflows and serve as a consultant-in-a-box that delivers outcomes, not just tools.

Services that become executable, governable software products:

• Policies that turn into policy as code
• Decisions that transform into decision as code (DMN/ML)
• Actions, which are direct system effects
• Governance that is runtime enforcement

Architecture shifts from describing the future to governing the system as it operates. IT4IT becomes a continuous flow of work and value across the digital lifecycle. Agentic AI becomes viable at the enterprise scale. In a digital enterprise, value is not just automated; it is decided on a case-by-case basis. SaS brings those decisions to life.

Wrapping up the solution: The way forward

In this article, we have discussed the following points that are integral to helping you and your organization shift from software that supports human work to SaS: software that performs the work itself.

• Service as Software is a unifying concept where services are executable, governable software products that generate value primarily through decisions, not hand offs.
• Conway’s Law aligns service boundaries with team boundaries, making autonomy and modularity structural.
• TOGAF 10 provides continuous architectural governance, turning intent and principles into runtime constraints.
• Open Agile Architecture frames services as team owned, continuously evolving capabilities governed by principles, guardrails, and intentional and continuous architecture.
• IT4IT operationalizes SaS across value streams, enabling flow from strategy to operation.
• DPBoK reinforces this by treating services as enduring digital products with end-to-end lifecycle ownership and outcome focus, providing an IT4IT-aligned scaling scenario.
• Digital Decisioning makes decisions explicit and is the primary source of value creation.
• Rules as Code makes policy and regulation executable within services.
• Agentic AI scales autonomous decision execution within architectural and policy guardrails.

Service as Software addresses a core transformation gap in businesses.

If you are looking for faster delivery, transparency, compliance, and scalable AI-enabled autonomy — all much needed for operating effectively in complex and regulated environments — your organization needs to start making executable decisions and embed them in governed, auditable, software-defined services.

Start today!

Connect with me, and let’s discuss how your organization can embrace this shift more quickly.

Posted: 16/06/26