When enterprises rely on LLMs for compliance decision support because they are under sustained regulatory scrutiny, retrieval-augmented generation without control allows access-sensitive regulatory, contractual, and audit content to be surfaced indiscriminately, and it does not tailor its response to the risk level of the query. This paper combines the latest research in retrieval-augmented generation, access control, adversarial threats, and AI risk management and introduces GovernedRAG, an architecture for enterprise compliance decision support that adapts to risk. The architecture integrates a four-stage risk classifier, a retrieval gate that limits the scope of candidate evidence retrieved to the scope of the requesting user before they are ranked, a grounded generation stage with an evaluation loop based on the reference-free assessment frameworks, and a continuous evaluation loop. A formalization is provided for the risk-weighted relevance, access gating, and faithfulness scoring, and the proposal is compared to five related retrieval-augmented paradigms, and the proposal is juxtaposed with them. It shows that governance and risk adaptivity are still not considered as first-class architectural concerns in previous retrieval-augmented systems, that access control is still mostly outside of retrieval ranking and not embedded in the ranking function, and that reference-free evaluation protocols are practical foundations for ongoing, compliance-driven monitoring. The proposed framework is organized into four risk tiers, four architectural stages and six comparative synthesis tables. Consequences for auditing, regulation and empirical confirmation are considered.