Approving AI and governing AI are different decisions, and most companies only make the first one.
Approval happens at the team level. A manager clears a small subscription. Governance is the harder question: which models are allowed, whose keys are in use, what leaves your environment, and who can see the audit trail.
When the tools are bought per team, the second question rarely gets asked at all.
For 1,000+ employee companies, the practical version of governance tends to be four things: SSO and SCIM so access follows your identity system, self-hosting and data residency where work cannot leave your environment, and admin audit that shows what was actually used.
That is what Bolt for Enterprise is built around — a gateway governing models, keys, and tools, with pooled consumption at cost + 5%.
Worth asking: if your board asked who governs AI tooling today, what would the answer be?