Nearly 90% of security pros use unapproved AI tools at work. The people most aware of the risks are the ones taking them. Not because they're reckless. Because the approved stack can't keep up. Queries go to third-party models, responses get pasted into docs, and the company's infrastructure never sees it. No log. No access record. No trail. When compliance asks "what did employees feed into these models," there's no answer. Not because someone hid it. Because nobody built the system to capture it. Policy won't fix an infrastructure gap. @sofia_numbers has been saying this for a while: governance needs a provenance layer. A record of what tools are in use and what they're touching, before the audit question lands. Better policy won't solve it. Better infrastructure will.