A policy might say that high-impact AI decisions require human oversight. Fair enough. But where does the approval happen? Who can stop the action? What record shows that somebody actually reviewed it?
Those questions are where governance becomes engineering work. For each significant risk, name the accountable owner and the system component that enforces the control. Keep evidence that answers a specific question, such as who approved a release or why a tool action was allowed.
The controls should match the consequences. A private note-summarizing assistant doesn't need the same approval path as an agent that updates customer accounts. Treating them identically creates paperwork without necessarily reducing risk.
Choose one policy statement and trace it into a real workflow. Follow the request from user to model to tool. If nobody can show where the policy changes the outcome, that is the first gap to fix.