Most teams govern AI workloads at the application layer. They configure guardrails for their Bedrock agents, scope IAM roles ...