AI adoption has outrun AI governance. Teams buy tools, engineers wire them in, and token spend starts to compound before anyone owns the bill. The result is a run-cost that does not show up cleanly in any single line: it is spread across shadow tools, unattributed calls and a velocity story that quietly hides code-health erosion.
Tools are bought at L2. Ownership is earned at L4. The cost hides in the gap between them.
One destination, two entry points
There are two archetypes. Greenfield estates are early: no caps, no attribution, no named owner yet. The move is to install the gateway, caps and attribution on day one and set the denominators before scale, because governance built in costs a fraction of governance retrofitted. Brownfield estates already carry substantial, unattributed spend and shadow tools. The move is to contain with a hard cap and egress block, attribute every call, retire the waste, and reprice on value, all without slowing engineers. The destination is identical: a governed, owned, P&L-measured estate.
Diagnose, govern, implement
The playbook has three pillars. Diagnose scores the estate from L1 to L5 across eight workstreams and rates cross-functional risk by owner, so the lowest score names the gap. Govern installs a tiered model gateway, per-engineer caps and full attribution, mapped to the NIST AI Risk Management Framework and ISO/IEC 42001. Implement sequences six recalibrations across 30, 90 and 365 days, each with a named owner, an exit gate and the P&L row it moves.
Why ownership is the point
Most estates score reasonably on tooling and poorly on ownership. That gap is where the cost lives, and no tool closes it, because a tool is bought, not owned. The work is to name the owner, set the caps, attribute the spend, and tie each recalibration to a P&L row. Governance is not a brake on AI. It is the thing that lets you keep adoption open without paying for it twice.