Why does governance require platform discipline rather than policy alone?

Because policies on paper are not enforced. A policy that says 'do not paste PII into ChatGPT' is broken every day in every company that has only policy. Governance requires technical enforcement at the platform level so the safe path is also the easy path. s