The AI Code Governance Stack: Four Layers, and the One Most Enterprises Haven't Built
Most enterprises run generation, security and policy layers but lack governance. See the four-layer stack and what to do this quarter. Start free.
Every enterprise has a tool that writes AI code, a scanner that checks it, and a policy that describes it. Almost none has the layer that decides, and that's the layer the board asks about.
This post is part of our AI Code Governance series. Start with the pillar: AI Code Governance: A 2026 Field Guide.
Picture a CISO at a whiteboard the night before a board meeting. She draws her AI-code stack. Copilot and Claude Code on top. Under them, GitHub Advanced Security, Dependabot, Snyk and Wiz. Beside them, a one-page AI usage policy, signed in the spring.
Then the question comes: "Of the code we shipped last quarter, which part did AI write, and who approved it?" She looks back at the board. Every box is a tool or a document. None of them is an answer.
That is not a hypothetical gap. In a real 52-repo engineering org, the first Provenance connection surfaced 25 AI-authored pull requests merged with zero recorded human review. Every layer on the whiteboard was already in place. The gap sat between them.
What are the four layers?
Most enterprise AI-code programs are built from three layers and a hope. Here is the full stack:
• Generation. The assistants and agents that write the code: Copilot, Claude Code, Cursor, Devin, Codex. They produce volume, not records. • Security. The scanners that inspect what the code says: GitHub Advanced Security, Dependabot, Snyk, Wiz, GitGuardian. They are sensors, not judges. • Policy. The written rules: the acceptable-use policy, the control matrix, the annual questionnaire. Declared, not observed. • Governance. The layer that joins the other three, decides, and keeps the record. This is the one most enterprises haven't built, because no tool they own ever named it.
Three of the four are boxes you can buy. The fourth is a record you have to derive.
Why three layers don't add up to governance
Each layer answers its own question. Generation answers "how fast?" Security answers "what's in the code?" Policy answers "what should happen?"
None of them answers the question the board asked: what did happen, who allowed it, and can you prove it?
Five askers now press on that gap: sector regulators, external auditors, enterprise customers sending security questionnaires, cyber insurers, and your own board. None of them accepts a tool inventory as an answer. They ask for the record.
A scanner reads what code says. It can't read who wrote the change or whether a human looked at it. A policy states a rule. It can't show the rule was followed. Adding a fourth tool to a layer that already exists doesn't fill the layer that doesn't.
The governance layer has four jobs
The empty layer isn't a mystery. It does four things, in order, for every AI-touched change. We call it the Accountability Loop:
• Attribute. Which changes did AI write, and in which repositories? • Classify. Which of those repositories matter, and how sensitive are they? • Decide. Against your controls, what is proven, what is a gap, what is a violation? • Prove. Produce a record you can hand to a board, an auditor, or a customer's due-diligence team.
Attribute → Classify → Decide → Prove. If a program can't do all four, the missing step is where the exposure lives.
Notice what the loop is not. It is not a gate in your pipeline, and it is not a leaderboard of developers. It governs code, not people, and it works retroactively from history already sitting in your repositories, so no engineer changes how they work.
A control is a fact, not an opinion
The tempting shortcut is to point a language model at a repo and ask whether it looks fine. It will answer. That answer is an opinion, and it can't be sealed or reproduced.
Say an agent writes a change and merges it alone, and your scanner flags nothing. The scanner is right: nothing is wrong with the code. What's missing is the custody, and only the governance layer can see that.
A governance layer has to run on evidence. A control turns green because a fact was observed: a merge with no reviewer, a bypass flag read from an agent's config. What can't be observed is marked as a gap for a human to attest. The record is sealed, so the one you show is provably the one that was generated.
That is also how the layer maps to the frameworks you already answer to. Provenance grades evidence readiness against the EU AI Act and the NIST AI RMF. It is evidence readiness, not a legal determination. Your counsel makes the legal call.
What to do this quarter
Four steps, none of which needs a purchase order. Run them as a one-hour workshop with your CISO, AppSec lead and VP Eng in the room. The VP Eng matters most: the exercise is read-only and asks nothing of the teams writing code.
Draw your stack. For each of the four layers, write down the tool or document that fills it. Mark every empty box in red.
Ask the four questions. Which of our code did AI write? Was a human in the loop when it merged? Which findings matter this week, and who owns each decision? Can we show the record to a regulator, auditor, or insurer? Time how long each answer takes. If any takes a meeting, that layer is empty.
Keep every sensor. Your scanners are the evidence source for the governance layer, not its competition. Nothing gets ripped out, and nothing new gets installed in the pipeline.
Derive, don't declare. Replace the survey with signals read from your estate's own history. Start with one organization, read-only.
Where Provenance fits
Diwo Provenance is the fourth layer: AI code governance, above the scanners you already run. It consumes what your scanners already find, derives who or what wrote each change and whether a human reviewed it, and turns that into decisions (fix, waive, accept) with a named owner and a sealed record. It is not a scanner, never will be, and it reads code signals, never your source. A coach, not a blocker.
Seeing your own estate through the four-layer view takes about 15 minutes, free and read-only: Connect your estate free at https://provenance.diwo.ai/provenance/signup
Your tools generate, scan and describe. Someone still has to decide.
Related reading
• AI Code Governance: A 2026 Field Guide: the pillar and the full operating model. • How to Govern AI-Written Code Without Buying Another Scanner • Who's Accountable When AI Writes the Code? • What is AI code governance?
Frequently Asked Questions
Is the governance layer just another scanner?
No. A scanner inspects what code says. The governance layer sits above your scanners, reads their findings plus signals your estate already emits, and records who decided what. Provenance is not a scanner.
Do I need to give a governance tool access to my source code?
No. Provenance reads signals such as authorship, review records and agent configuration, never your source. Your code stays in your estate.
Does this make us ready for the EU AI Act?
No tool can promise that. Provenance maps your evidence to the EU AI Act and NIST AI RMF and shows where it is ready and where there are gaps. Your counsel makes the legal determination.
See it in action Your scanners detect. Provenance decides. Book a working demo →