u/PassengerSilly4394

Curious how CIOs are approaching governance as AI moves from experimentation into actual business workflows.

Are you mainly focused on model/vendor approval, or are you also governing what an AI agent is allowed to do once it's connected to enterprise systems?

Things like action-level permissions, human approval for high-risk actions, audit trails, data boundaries, and short-lived credentials seem increasingly important as agents become more capable.
Would be interested to hear what governance controls you've found genuinely useful in production, rather than just on paper.