Four layers. Model, Harness, Control Plane, Connective Tissue. Most enterprise AI governance programs in 2026 govern the Model layer (vendor due diligence, model approval, EU AI Act high-risk classification, third-party-eval intake) and leave the other three layers ungoverned. The cycle's incidents tell the story — the Claude Code GitHub Action CVE on June 1 landed at the Harness layer; the OpenRouter Series B and the Five Eyes joint guidance on May 1 landed at the Control Plane layer; the Writer 2026 survey, the Colorado AI Act delay, the EU AI Act August 2 GPAI activation, and the Bartz v Anthropic settlement distribution all land at the Connective Tissue layer. This episode walks each layer from the CISO seat — naming the default-bad pattern most programs run today, the actual control surface, the framework families that apply, and what good looks like. Closes with three sequencing patterns by program maturity for the practitioner walking in Monday.