CSA analysis: 'AI Governance Isn't a Chore Problem. It's an Architecture Problem.' — runtime vs human-review governance model

On 6 November 2026 (confirmed via visible published-date label), the Cloud Security Alliance published an analysis (originally by LangGuard.ai) arguing the AI-governance workload burden (86% of organizations reporting AI incidents per OneTrust; 42% of frontline AI users saving ~1 day/week per BCG) is a symptom of an architectural failure, not capacity. It contrasts two governance models: 'governance as human review' versus 'governance as runtime architecture,' advocating before-execution deterministic policy enforcement and routing only meaningful exceptions to humans, rather than after-the-fact review, and highlights the unbounded inventory problem from citizen-built agents and unapproved tools.

It is a practitioner-oriented governance-pattern comparison from a recognized body that argues for shifting AI governance controls to the decision point (pre-execution authorization, tool-call enforcement) rather than periodic review — a widely discussed design premise for agentic-AI governance but not yet normative.

Consider the runtime-architecture governance model when designing agentic-AI controls: enforce policy at the tool-call/decision point, maintain agent-and-tool inventory, and reserve human review for exceptions.