The model that consistently works in regulated environments is: AI and agents execute while humans decide. In practice this means tiered guardrails (deterministic rules at agent level, generative agents restricted to advisory roles in money-moving flows), a visible production line defining which code requires engineering or senior review regardless of who wrote it, compliance evals embedded in CI/CD rather than run quarterly, and a documented contingency plan for model access and cost risk. The governance model should be public within the engineering organization so everyone understands the boundary between autonomous AI execution and mandatory human approval.