Enterprise AI governance keeps getting framed as a policy problem. Write acceptable-use rules. Turn on SSO. Add RBAC. Review risky PRs more carefully. That is all useful, but it still misses the one thing auditors, security teams, and incident responders actually need when AI-generated code reaches production: provenance.
Not “did someone use AI.” Not “did the vendor log usage.” Provenance.
When a critical bug lands in production, the question is not theoretical. Someone has to answer:
What was generated?
What was asked?
