Governance & Trust
How do we stay in control as AI scales?
Control that slows every project gets bypassed. Governance works when it is built into the platform and sized to risk.
Maturity
1Exploring
Policies on paper. Shadow AI unmeasured.
2EstablishingExample
An AI council and risk review for high-impact use cases.
3Scaling
Controls automated in the platform. Every agent inventoried.
4Compounding
Risk-based guardrails by default. Audit-ready at any time.
Key decisions
- Central approval or guardrails by defaultOversight versus speed
- Risk tiersWhich uses need human oversight under the EU AI Act and your own policy
- Accountability for agentsWho answers for what an agent does
Anti-patterns
- One review board for every use case
- Unknown agents with broad data access
- Governance added after the first incident
Measure progress
- Share of agents inventoried with an owner
- Time to approve a standard-risk use case
- Use cases classified under the EU AI Act
Builds on
Enables
- Data products need clear ownership rules.Needed for AI-Ready Data Estate at Scaling
- A fast, unified estate needs controls built into the platform.Needed for AI-Ready Data Estate at Compounding
- Definitions need a forum that can sign them off.Needed for Enterprise Context Layer at Scaling
- Agents in production must be inventoried and controlled.Needed for AI in the Process at Scaling
Plays
Microsoft-specific guidance, as of September 2026.
Ratings are illustrative and pending author review.
Capabilities
| Capability | Role in this pillar | Rating |
|---|---|---|
| Microsoft Purview | Data security and compliance for AI interactions | Adopt |
| Microsoft Entra Agent ID | Identities and access for agents | Trial |
| Agent 365 | Inventory and control of agents across the enterprise | Assess |
| Microsoft Defender for Cloud | Threat protection for AI workloads | Trial |
Adopt
Proven. Use it by default for this purpose.
Trial
Production-ready. Use it with a clear scope.
Assess
Promising. Explore with a small team.
Hold
Not recommended for new work.
Known gaps
Agents built on other platforms need extra integration to appear in the same inventory and controls.