From policy PDF to runtime: enforcing AI governance on every agent call

There's a gap between having an AI usage policy and enforcing it. The document says "the support agent doesn't access financial data". But who guarantees that on call #4,385, at 2 a.m., when nobody is