Guardrails and Governance 5. Risk and Complexity Reduction – Governance must both reduce complexity (i.e., simplify) and reduce threat surface area.