Is anyone actually enforcing AI governance, or just writing policies?

A lot of companies now say they have “AI governance.” Usually that means usage guidelines, approved tools list, internal policy docs and maybe some security training..... But in practice, AI usage is much messier.....People paste logs into ChatGPT.....Agents....connect to internal tools....Teams try random automation workflows....Someone wires an LLM into a Slack bot or CRM process. None of this feels risky in the moment. It just feels like getting work done....That’s the problem...!!! Most governance lives in documents, but agent behavior happens at runtime.....A policy can say “don’t send sensitive data,” but the workflow itself usually doesn’t know that what data is sensitive, what the agent is allowed to use, what tool call is risky, whether context should move from one step to another or when a human should approve an action..... So the gap is not “do we have AI rules?”....The gap is whether those rules are actually enforced inside agent workflows. # For people building agents in companies: How are you handling this? Are you enforcing controls in the workflow itself, or mostly relying on policy and user behavior?