What would proper governance of a powerful flock like tool be? It is a public private partnership. Public benefit. Public infrastructure. Private collection. Private software. Private computing. Private access.
Private power.
Private power.
Second, a third-party annual security and data audit, with power to revoke licenses if findings aren't mitigated within a reasonable time frame.
Finally, a civilian oversight committee with real power to sanction bad actors.