Governance

A company-wide push to use AI produced employee-built projects, several of them touching member data and intended for production. The conversation was being had as a project management problem when it was a compliance one.

A binary gate. Any project that touches member data runs inside the environment IT already governs (identity-aware proxy, secrets management, audit logging, models called through the company's cloud account) or it does not go to production. No exceptions for how small it is or who built it.

The proposal engine already met the standard. It's easier to ask for a rule you're already following.