Shadow AI and the Monitoring Paradox: A Typological Theory of Governance Visibility Erosion

Abstract

Organizations increasingly face AI capabilities that evade effective oversight even when they are embedded in systems that are formally approved and actively monitored. Existing accounts of shadow IT and shadow AI do not fully explain this pattern because they assume that once relevant activity is discovered, governability can be restored. This paper develops a typological theory of shadow AI by reconceptualizing it as a governance condition rather than an authorization status. The theory identifies two generative mechanisms, visibility erosion and authorization decay, and shows how they degrade three governance capabilities: observation, attribution, and auditability. It yields four shadow AI types: Approved but Ungoverned, Unauthorized Tools, Undisclosed Vendor AI, and Ambient AI, and introduces the Monitoring Paradox, a boundary condition under which increased monitoring intensity yields diminishing returns because the constraint lies in signal availability rather than monitoring effort. The paper reframes governance from monitoring investment to delivery architecture design.