Platforms ship primitives,
not governance.

Every surface here can scope access. None of them proves it was right. Least privilege as a control means a periodic access recertification, a named owner who attests, and a duty-separation map of which agent may touch which system. That review cadence, and the evidence of it, is yours to build.

The platforms give you the seams — accounts, roles, sponsors, permission tiers. They don't draw your incompatible-duties map or stop one person holding maker, approver and monitor rights at once. Defining which duties conflict for agents, enforcing it in role design, and evidencing that no single person can build-approve-run an agent unchecked — that's a control you design.

You get raw logs and a usage dashboard — not an audit file. An examiner doesn't want CloudTrail JSON or a console export; they want evidence that a specific decision was made within policy, by an authorized identity, on the inputs it actually saw. Turning native logs into a retained, tamper-evident, examiner-ready evidence pack — each field mapped to the obligation it satisfies — is the work.

A confirmation prompt or a deny-rule is not oversight. Oversight means a named human with the authority and the information to intervene, a defined list of which actions need sign-off, and proof the human reviewed rather than rubber-stamped. Setting the consequentiality threshold, deciding which actions get auto-approved, and capturing the sign-off as evidence — yours.

The off-switch exists; the runbook doesn't. Who is authorized to pull it, on what trigger, how fast, who gets notified, and how you resume safely — that's a tested operational procedure. An untested kill switch is a button nobody knows when to press. You write it and you rehearse it.

For a Luxembourg PSF the live question isn't "is there DLP" — it's where the inference runs, who the processor is, and whether that satisfies professional secrecy and EU data-residency rules. That's a data-flow map, a processor assessment and a residency decision per use case — a governance judgement no ACL or toggle can make for you.

Vendors give probabilistic filters with vendor-set thresholds. Your risk appetite sets the thresholds, your red-team finds the injection paths specific to your data and tools, and your test evidence shows the controls hold. Filters are a capability; a tested robustness posture mapped to Art. 15 is a control. You run the attack-and-defend and keep the proof.

The platforms give you the mechanics of versioning and staged rollout. Change governance — a change-advisory step for a model swap, an impact assessment when a prompt changes, the rule that a tool can't reach prod without sign-off, the link from each change to who approved it — is process you impose on top. A model silently updated underneath you is a change you have to detect and attest.

Platforms score (or surface) quality and usage; they don't define acceptable. What's your minimum pass bar, which breach triggers which response, who owns the alert, and how findings feed back into the risk assessment — that's a monitoring control, not a dashboard. You set the thresholds and own the loop that closes when they're crossed.

A platform registry lists agents; it doesn't classify them. Deciding each agent's EU AI Act risk tier, recording purpose, owner, legal basis and the controls that apply, and keeping that register current as the Act phases in — high-risk duties land Dec 2027 / Aug 2028 — is an AI-system register you maintain. The inventory is the input; the classification is the control.