Two AI governance platforms with identical policy language will produce completely different results depending on where each one sits. A tool inspecting network egress cannot read what a user typed into a page served over TLS. A browser extension cannot see a server to server API call. A model side guardrail sees the prompt and knows nothing about who sent it or from which device. Placement fixes the ceiling on what a platform can observe and what it can stop, and no amount of policy sophistication moves that ceiling. Start the comparison there and most of the shortlist decides itself.
Overview: five things placement determines
- What is visible. Network, browser, identity, endpoint and model side each see a different slice, and none sees all of it.
- Whether the tool can block or only report. Inline placement can stop a request. Log based placement can tell you about it afterward.
- Who the action is attributed to. Egress inspection sees an IP address. Identity and browser placement see a person.
- What breaks when it fails. An inline enforcement point in the traffic path is a dependency, and its outage is your outage.
- Deployment cost and time to value. A browser policy pushes in a day. A gateway in the path of production traffic is a project.
This is written for IT directors and security leads at firms between 50 and 500 people who have been asked to put controls around AI use and are looking at a category where every vendor claims the same capabilities. If you are still working out what is in use, the discovery side comes first. For agent specific controls, our piece on enterprise grade AI agent governance covers that ground.
Why AI governance platform comparisons mislead
Enterprise AI governance platform marketing converges on the same four verbs, which are discover, monitor, enforce and report, and every product in the category uses all four. The words are accurate and they hide the thing that actually differs.
Discovery scope that depends entirely on the vantage point
A platform reading identity provider grants discovers applications that authenticated against your tenant. One reading network telemetry discovers domains being reached. One installed in the browser discovers what people actually opened. These produce different lists, and the overlap is smaller than anyone expects.
The counter argument is that a good platform correlates several sources, and the better ones genuinely do. Confirm which sources are included in the tier you are buying rather than the ones in the architecture diagram, because correlation across four telemetry sources is usually the enterprise plan.
Enforcement that turns out to be alerting
Many products described as enforcing policy operate on logs, which means they detect a violation after it occurred and raise an alert. That is worth having. It is not the same as preventing a paste of client data into a consumer chat interface, and the distinction rarely survives a sales conversation intact.
The honest case for detection only deployment is that it carries no outage risk and no user friction, which makes it the right first step for most firms. Deploy in observe mode, learn what your traffic actually looks like, then decide where blocking is worth its cost. Turning on enforcement first produces a queue of angry exceptions and a bypassed control.
Attribution that stops at an IP address
A finding saying an unapproved model endpoint received traffic from your office address cannot be actioned, because nobody knows who did it. A finding naming a user and a device can be. Attribution quality is a function of placement, and it determines whether the platform produces work or produces noise. The same principle underpins our network security monitoring practice.
Comparing platforms by where they sit
AI control plane placement falls into five positions, and reading a shortlist by position rather than by vendor name makes the trade visible immediately. Most firms end up with two of these rather than one, chosen so their blind spots do not overlap.
Network egress inspection
Sitting at the network edge sees every destination reached from the corporate network, which makes it strong for discovering unapproved services and weak for anything else. Modern traffic is encrypted, so content inspection needs TLS interception, which brings certificate management and a set of applications that will break under it.
It also misses everything off the corporate network, which at a firm with remote staff is most of the traffic. Treat it as a discovery source rather than a control, unless you already run interception for other reasons. Where a firm has invested in this layer already, the marginal cost of adding AI destinations to it is close to zero.
The browser as an enforcement point
Browser based controls see the page, the paste, the upload and the user, without needing TLS interception, because they operate inside the session. For the dominant real world risk, which is staff pasting sensitive content into a consumer AI interface, this is the position with the clearest view.
The limitation is coverage. It governs managed browsers on managed devices and sees nothing on a personal phone or an unmanaged laptop. It also does not see server to server API traffic at all, which is where production integrations live. Firms running a zero trust posture already have the device management to make this work, and our comparison of zero trust providers for mid sized businesses covers that foundation.
Identity and OAuth grant governance
Governing at the identity layer catches applications requesting access to company data and can revoke that access centrally. It is the cheapest position to operate because the data already exists in your identity provider, and it gives clean attribution.
What it cannot see is a tool somebody uses without connecting it to anything, which is the most common pattern of all: open a browser tab, paste, copy the answer back. Identity governance covers integrations rather than usage, and reading it as coverage of usage is the most common mistake in this area.
Gateway or proxy in front of the model
An API gateway sitting between your applications and model providers sees every production call, can enforce policy inline, and produces a complete log of what the business actually sent. For governing the systems you build, this is the strongest position available.
Its cost is that it becomes a dependency in the path of production traffic, so its availability is now your availability, and it needs capacity planning and failover. It also governs only what routes through it, so a team calling a provider directly bypasses the control entirely unless egress rules prevent it. That combination of inline control plus egress enforcement is what our managed security work usually implements together.
Model side guardrails from the provider
Platform native controls filter inputs and outputs at the model, which is convenient, requires no infrastructure, and is included with what you already pay for. For content safety and obvious data patterns it is effective and free.
It is also per provider, so policy has to be reimplemented in each console, and it has no view of who sent the prompt or from where. Use it as a backstop rather than as the policy layer, because a control you cannot enforce consistently across providers is not really a policy. Approaches that combine model side filtering with organisational context are covered in our AI enhanced security work.
Choosing a combination rather than a product
Governance coverage comes from pairing positions whose blind spots differ, and the pairing that fits depends on which half of the risk a firm is more exposed to.
Staff usage against production systems
Firms whose exposure is mostly staff pasting content into consumer interfaces want the browser position plus identity governance, and gain little from a gateway. Firms whose exposure is a customer facing AI feature want the gateway plus model side guardrails, and gain little from browser controls.
Most organisations have both risks and one budget. When forced to pick, the deciding question is which failure would be worse: a member of staff exposing a client document, or a production system producing a harmful output to a customer. Answer that first and the pairing follows. Our AI risk assessment work exists to make that answer evidence based rather than intuitive.
What to test during a pilot
Test what the platform sees rather than what it claims. Run a representative action through it, whether that is pasting a sample document, calling a model from a test application, or connecting an add-on, and check whether the event appears, whether it is attributed to a person, and whether blocking works without breaking the workflow.
The pilot most vendors propose skips this in favour of a dashboard tour. Insist on the traffic test, because a dashboard populated with sample data tells you nothing about your own blind spots. The same evaluation discipline applies as in our review of network security companies, and the zero trust architecture behind it is described in our ShieldHQ piece.
Frequently Asked Questions
What does an AI governance platform actually control?
It controls whatever passes through the position it occupies. A browser based tool governs what users do in managed browsers, a gateway governs API calls routed through it, and identity governance controls which applications hold access. None of them covers all three.
Can an AI governance platform block staff using consumer chat tools?
Browser based placement can, because it sees the paste and the upload inside the session. Network level blocking can stop the destination being reached on the corporate network and does nothing off it, while identity governance does not see this pattern at all.
Do we need a governance platform if our model provider has guardrails?
Provider guardrails are a useful backstop and are not a policy layer. They are configured per provider, carry no knowledge of who sent a prompt, and cannot be enforced consistently across several vendors, so they complement a chosen position rather than replacing it.
Should AI governance be deployed in blocking mode from the start?
Observe mode first is almost always the better sequence. It shows what your traffic actually looks like without generating exceptions or outages, and blocking rules written from real observed patterns hold up far better than rules written from assumptions.
How many governance platforms does a mid sized firm need?
Usually two, chosen so their blind spots do not overlap. A common pairing is browser plus identity for staff usage, or gateway plus model side guardrails for production systems, with the choice driven by which failure would be worse for the business.
Who is behind this guidance
Mindcore has designed and run security architectures for small and mid sized firms for more than two decades, which means most of our AI governance work is a placement conversation before it is a product conversation. The patterns above come from engagements where a platform had been bought, deployed, and could not see the activity the client was worried about, alongside the network security monitoring and zero trust work we run in the same estates.
Matt Rosenthal, our chief executive, focuses on how firms without large security teams get real coverage rather than the appearance of it. His view on this category is that a control which cannot see the behaviour it was bought to stop is worse than no control, because it ends the conversation about that risk.
Map the risk to a position before you shortlist
The sequence that avoids buying the wrong thing is short. Decide which failure would hurt more, staff exposing data or a production system producing a bad output. Pick the position that sees that behaviour: browser and identity for staff usage, gateway and model side guardrails for production. Deploy in observe mode and read what your real traffic looks like. Test the platform with a real action and confirm the event appears attributed to a person. Only then write blocking rules, from what you observed rather than from what you assumed.
If you want help mapping your exposure to the right position, book a free strategy call and we will work through where your traffic actually goes.
