For IT, security and management

AI agent governance: every agent with an owner, rules and a log.

People in the company are already building agents in Copilot Studio. For each agent, we set out who built it, what it reads, who it can be shared with and what it does, with a log.

Discuss agent governanceHow we work
  • SharePoint governance since 2010permissions, metadata and retention: the data agents read
  • AI agent programmefor a utility company, won through a utilities-sector tender
  • User permissionsour agents run with the signed-in user's permissions

What we bring into order with AI agent governance

Every agent has an owner, publishing rules and permitted data sources.

  • Agent inventory

    Which agents exist, who created them, which sources they read and where they are published.

  • Owners and approval

    Every agent has an owner, and published agents go through an approval.

  • Separate environments

    Development, test and production, with sharing limits on each.

  • Connector policies

    Which channels, connectors, knowledge sources and MCP servers an agent is allowed to use.

  • Agent identity

    Every agent with its own identity in Entra, with controlled access.

  • Audit

    What the person asked, what the agent answered and what it used, in the log.

How we govern agents, step by step

We start from an inventory of the agents already in the tenant.

  1. 01

    Inventory

    All the agents in the tenant, with owners and sources.

    • Microsoft 365
    • Copilot Studio
  2. 02

    Rules

    Who builds, what gets published, with which approval.

    • Teams
  3. 03

    Environments and policies

    Separate environments and connector policies.

    • Power Apps
  4. 04

    Identity and access

    Agents with their own identity and controlled access.

    • Entra ID
  5. 05

    Audit and review

    An active log and a periodic review of the agents.

    • Purview

Questions about AI agent governance

What does AI agent governance mean?

The rules by which the company's agents are created, used and retired: who owns each one, which data and connectors it may use, which environment it runs in and what stays in the log.

Can people still build agents on their own?

Yes, in the permitted environments and with the permitted connectors. Agents that follow the environment and connector rules are published to production.

What do we do with agents that have no owner?

We find them in the inventory, give them an owner or switch them off. The decision is yours.

Do we need additional licences?

The inventory and the basic policies are included. Identity and protection controls for agents need additional licences; we tell you exactly which ones before you buy anything.

Where do we start?

With a readiness assessment of the tenant: which agents exist, which content is shared too widely and which controls are active.

Related solutions

Find out which agents are running in your company today.

In 30 minutes we go through the process and agree what to prepare before the project.

Denis Stadler
The first call is with Denis Stadler.Founder · AI Architect & Fractional CTO
Pick a time for a 30-minute call(opens in a new tab)Message us on WhatsApp(opens in a new tab)Call +40 374 616 331