An expense claim is not consent.

Adoption of a new generative-AI coding tool was becoming a fait accompli through expense claims. No one had explicitly approved it, yet it was beginning to be used. This is one of the most common governance gaps in the AI era. Before allowing the new tool to touch confidential data, the work was stopped.

Review of live code and live repositories was directed to an existing approved AI bot, while the new tool was limited to writing assistance that contained no confidential information. After designing that division of roles, the practice of treating adoption through an expense claim as “consent” was explicitly rejected.

Data scope, security, and contract terms: until the tool passed all three gates in writing, it could not touch live data. What AI may decide and what people must continue to decide: this is precisely where the boundary is drawn.