Principles published as frameworks (AI Principles, Frontier Safety Framework, SAIF 2.0 with its three agent rules), then productized as configurable primitives: org-policy model allowlists, Model Armor floors, VPC-SC perimeters, and an agent control plane (identity, registry, gateway, sandbox). Posture: 'shared fate' — secure defaults plus contractual commitments (no training on customer data without permission; generative AI indemnification).

Written down in: AI Principles · Frontier Safety Framework v3 · SAIF 2.0 · AI/ML Privacy Commitment

Enforcement center of gravity: Platform and network layer: org policies in the resource hierarchy, Model Armor inline / at the gateway / at the load balancer, IAM down to agent identity, SCC watching posture across it all.

Governance as an extension of the M365 compliance estate: the Responsible AI Standard v2 internally, and for customers, identity- and data-centric enforcement — sensitivity labels and Purview DLP flow into Copilot, agents get Entra directory identities, and Agent 365 acts as a tenant-wide agent control plane.

Written down in: Responsible AI Standard v2 · Responsible AI Transparency Reports

Enforcement center of gravity: Many layers, many consoles: Purview at the data layer, Entra at identity, Content Safety at model endpoints, Defender for posture, Copilot Control System / Agent 365 at the app and agent layer.

Builder primitives over bundled suites: eight responsible-AI 'dimensions', per-service AI Service Cards, and composable governance services — Bedrock Guardrails as a standalone policy engine (ApplyGuardrail works on any model), evaluations as a service, AgentCore for agent infrastructure — assembled by the customer, logged in the customer's account.

Written down in: AWS Responsible AI dimensions · AI Service Cards · ISO 42001 whitepaper

Enforcement center of gravity: Service layer, composable: IAM/SCPs gate model access; Guardrails execute on the inference path (when attached); CloudTrail and opt-in invocation logs land in the customer's own account.

Model-provider-first: safety invested in the model and its normative spec — the Model Spec's chain of command (platform > developer > user; tool outputs carry no inherent authority), deliberative alignment for reasoning models, the Preparedness Framework for frontier risk — plus a real workspace admin layer for ChatGPT Enterprise. App-layer safety for API builders ships as open-source components the customer runs.

Written down in: Model Spec · Usage Policies (universal, Oct 2025) · Preparedness Framework v2

Enforcement center of gravity: In the model (spec-trained behavior, safety classifiers) and at the account/workspace layer (admin controls, Compliance API). API application-layer enforcement is intentionally the customer's code.

Safety-research-first, enforced in the model and in frontier-risk process: Constitutional AI with the full constitution published (CC0, Jan 2026), the Responsible Scaling Policy with ASL-3 protections active since May 2025, and unusually deep enterprise controls for a lab — including Claude Code managed settings developers cannot override. Deliberately ships no standalone guardrails product; runtime filtering comes from cloud partners or gateways.

Written down in: Claude's Constitution (published in full) · Responsible Scaling Policy · Usage Policy

Enforcement center of gravity: In the model (constitutional training, classifiers), at the frontier process level (RSP gates what ships), and at the workspace/admin layer. Inline filtering by design comes from the distribution channel (e.g., guardrails on Bedrock or Vertex, or a gateway).

No model vendor productizes your use-case registry, intake workflow, and cross-vendor policy enforcement. That is why the AI gateway became the de facto enterprise enforcement point, and why governance platforms exist as a category. Whoever you buy models from, plan to own this layer.

See challenge 7 below for the gateway pattern in detail.