Decide what an org-wide AI use standard enforces

You are the staff engineer in a 40-person platform org. Every team adopted coding agents on its own, with no shared rules. Output is up. But in one quarter, 3 different retry libraries appeared, error handling drifted apart, and an agent committed a hard-coded service token that a scanner caught a day later.

Leadership asks you for the org's first AI use standard.

What goes in it, what do you leave out on purpose, and how do you make it stick without becoming the bottleneck?