In many service companies there is a collections follow-up that has been running by itself for a year. It works every night: it classifies, drafts, fires off reminders. The manager who configured it does not work there anymore. Nobody knows exactly what permissions it has, nobody measures it, and nobody could say with certainty who can turn it off.
That system still produces something useful, so nobody looks at it. The uncomfortable question is a different one: what happens the day the process it automates stops being necessary? The honest answer, in most organizations, is "nothing". It will keep running. With its credentials, its access, and its authority intact. Working for nobody.
The book AI Employee gives that creature a name: digital zombie. And it argues something more uncomfortable than the metaphor: your company probably already has several.
What exactly is a digital zombie
It is not an automation that fails. It is one that lost its reason to exist and nobody retired it. The role it occupied stopped making sense in the face of the current strategy, but the resource keeps operating because no process forced it to justify itself. It can even meet its metrics: impeccable efficiency in the service of a job nobody needs anymore.
It is not only waste: it is risk surface with no return, a set of live keys that open doors nobody watches anymore.
There is the difference with the abandoned software of all time. An unused license costs money. A digital zombie has active credentials, reads production data, writes to real systems, and keeps delegated authority. Every access nobody remembers is a door nobody closes. Waste is measured in dollars; risk surface is measured in incidents that have not happened yet.
Why nobody notices them: the triggers that get lost
Pointless human roles sometimes get pruned by themselves. Not always: bureaucracies carry dead roles for decades. But there are weak triggers that work every now and then. A salary line that the budget review questions. A resignation that forces someone to decide whether the replacement is justified. Somebody who gets bored and asks for something else.
An artificial role eliminates even those weak triggers. Its cost does not appear as a line that somebody has to defend: it lives fragmented across licenses, inference, integration, and hours of human review that nobody counts. And nobody ever resigns from it. It does not ask for a raise, it does not complain, it does not leave for the competition. A pointless artificial role does not only persist by default: it loses the last occasions on which somebody would notice it.
What accumulates has a name: organizational debt. Like technical debt, it does not hurt when you take it on. It gets paid later, with interest, the day an auditor asks who authorized that access or an incident comes in through a door nobody remembered leaving open.
The sentence that protects every zombie is the same one: "it works, and nobody has time to touch it right now". Both things are usually true. Neither one answers the only question that matters: is this responsibility still necessary? Good performance is the usual anesthetic against the question of existence.
The hunt begins with an inventory
You cannot retire what you cannot see. The first instrument against digital zombies is the map of your invisible workforce: three columns, without looking for perfect accuracy. Work done by people, human work assisted by AI, and work executed by software. The first pass is surprising: the proposal the salesperson "makes" has an artificial draft underneath it, the analyst's report is a pipeline with retouches, and collections has been running by itself for a year.
Then, to each activity in columns two and three, ask the questions that rarely come up during a technology purchase. Who answers for the result? Not who configured it: who answers. How do we know if it works, or do we only have an absence of complaints? What permissions does it possess, not which ones should it have? What information does it consult and who decided that it could consult it? Who can suspend it, and has that ever been done, even as a test? What happens when an exception it does not understand shows up?
A shrug at the first question signals an administrative orphan: the perfect zombie candidate. And the discomfort of the exercise is the majority position: in Deloitte's survey of more than three thousand business and technology leaders across twenty-four countries, 84% of organizations had not redesigned their jobs around AI capabilities. The technology came in first and work design comes behind. Zombies are born exactly in that gap.
The vaccine: re-justification with a date
The inventory finds the existing zombies. To avoid manufacturing new ones you need a review that is different from all the others: one that does not ask about the efficiency of the role but about its existence. Is this responsibility still necessary in the face of the current strategy?
The standard that accompanies the book sets it in clause HWF-63 with two triggers: a cadence never greater than twelve months and a declared window after every material change of strategy, policy, regulation, product, or structure. The logic of the calendar is simple: the problem was never one of judgment, it was that the question had no date. And continuity is never the default: the role is re-justified or it is retired, and its access ends with it. The closing of the clause deserves to be quoted as is: "retirement is the result of a failed justification, never of a missed calendar".
There is a nuance that avoids bureaucratic zeal: the review considers first whether a modified scope keeps the role current before concluding its retirement. But with a lock: that new scope is justified on its own merits, it never inherits the previous justification, and work invented to preserve a role is a failed justification, not a redesign.
Retiring without creating a zombie
The other zombie factory is the badly done retirement. Turning off the visible workflow and leaving everything else: the credentials, the tokens, the scheduled routines, the queues that keep receiving work. That is why the offboarding of an artificial role is as important as its onboarding.
The orderly exit has concrete steps: revoke credentials, disable tools, stop routines and queues, rotate secrets, transfer the pending work, preserve the evidence the audit will need. Clause HWF-64 condenses it: offboarding must revoke access and transfer or destroy context securely. A retired role whose access outlives it is not retired. It is unattended.
That is, in the end, the difference between administering an artificial workforce and collecting tools that are switched on. Digital zombies are not a technical accident: they are the symptom that artificial work was bought but never administered. The cure is not more technology. It is a complete lifecycle, where every role knows that its continuity is earned.
Frequently asked questions
It is an AI Employee or automation whose role lost its justification but that keeps operating with credentials, data access, and current authority, working for nobody. It is the most dangerous form of organizational debt: it not only wastes licenses and inference, but keeps live keys over real systems without anybody answering for them or watching them. A digital zombie can even meet its metrics: the problem is not its efficiency but its existence, because it executes with precision a job the organization no longer needs and that nobody questioned again.
Because it loses even the weak triggers that sometimes prune human roles. A salary is a visible line that the budget review can question; a resignation forces someone to decide whether the replacement is justified. An artificial role has none of that: its cost lives fragmented across licenses, inference, integration, and human review, so it rarely appears as a figure somebody has to defend, and nobody ever resigns from it. With no visible friction, it persists by default. That is why the review of existence needs its own calendar: with no date, the question never gets asked.
With an inventory of the artificial workforce: a map in three columns (human work, human work assisted by AI, work executed by software) followed by six questions for each active automation: who answers for the result, how it is measured, what permissions it really possesses, what information it consults, who can suspend it, and what happens with the exceptions it does not understand. An administrative orphan (nobody answers for the result) combined with current access is the zombie's signature. The goal of the first pass is not perfect accuracy: it is visibility.
With a complete offboarding, as disciplined as the onboarding: revoke credentials, disable tools, stop scheduled routines and queues, rotate secrets, transfer the pending work, and preserve the evidence for auditing. Clause HWF-64 of the Hybrid Workforce Standard requires it: offboarding must revoke access and transfer or destroy context securely. The acid test is simple: if any access outlives the role, the retirement did not finish. A retired role whose access outlives it is not retired, it is unattended.
For the complete map of what is already running by itself in your company, read Invisible workforce. For the cycle that avoids manufacturing new zombies, read No role lasts forever.
Want the full method? Read AI Employee. For executive AI consulting or keynotes and workshops.
Go deeper
Want to bring your team to the next belt?
Book a discovery call or explore the full book.