What governance framework would you recommend for a large enterprise with several business units on the platform?

Centralised standards with federated delivery. Concretely, a Center of Excellence that owns platform-wide standards, reusable assets and the shared roadmap; an architecture review board that reviews significant designs against those standards; and local delivery teams that keep day-to-day autonomy inside them.

The critical design decision is what triggers review. Governance that reviews every change becomes a bottleneck, review quality falls because volume is high, and teams start splitting work to stay under the threshold. Governance that reviews nothing produces the divergence it was created to prevent. So I define risk tiers with a lightweight path for low-risk change and a real review for anything that crosses a boundary, touches shared components, introduces an integration or affects the security model.

I also want the framework to have something to give, not only something to withhold — reference architectures, a shared component library, a naming standard, an environment template. A body that only says no gets routed around.

And I want membership to include the business, not only IT. Prioritisation conflicts between business units are business decisions, and an architecture board cannot settle them on technical grounds.