Give the model a sanctioned path before you police the unsanctioned ones. 30% of the panel shows an active governance problem — reps buying their own assistants, leaders shipping tooling with no inventory. The answer showing up in the data is architectural: a scoped service identity or a central data mirror so access is revocable in one place.
Maintain an inventory of what is connected to what, and make the approved route genuinely faster than the workaround. Governance that only says no produces shadow tooling; governance that ships a permitted path with real access does not.
Every claim above comes from work LeanScale published. These are the sources.