Sales built a Copilot Studio agent that answers customer questions and hooked it up to the proposals folder. Finance tried another one that reads invoices from email. Nobody in IT knows how many agents are running, what they can access, or who answers for it when one hands out data it shouldn't.
Deploying AI agents in the enterprise with security in mind depends less on the tool than on a few rules agreed before the first pilot: which agents exist, what data they can touch, who approves them and how they're watched once they're in production. Below is our take on minimum AI governance for a mid-sized Chilean company that already runs Microsoft 365 and is starting to try agents. Think of it as the short list we'd want in place before letting an agent loose on real data, not a complete framework.
Why an agent needs more governance than a chat
A chat assistant answers questions. An agent acts: it queries systems, reads documents, sends emails or updates records, often without a person checking each step. That changes the risk.
A user who makes a mistake affects their own inbox. A misconfigured agent with access to all of SharePoint repeats the mistake hundreds of times a day. And when something goes wrong, the first audit question (who did this?) has no answer if the agent runs under a user's account or a shared key.
Microsoft says it plainly in its Cloud Adoption Framework guidance on agent governance: every agent should operate under its own identity so its actions can be attributed and controlled, and policies should apply the same way no matter where the agent was built. For the technical side of plugging agents into your systems, see our guide for IT leaders.
Rule 1: an inventory of agents and uses
Start by knowing how many agents you have. A living list works, with at least this for each agent:
- name and purpose in one sentence;
- business owner and technical lead;
- platform it runs on (Copilot Studio, Microsoft Foundry, a third-party tool);
- systems and data sources it can reach;
- whether it only reads or can also take actions;
- approval date and next review date.
In the Microsoft ecosystem you no longer have to build that list by hand. Microsoft Agent 365, generally available since May 1, 2026, acts as a central agent registry in the Microsoft 365 admin center. According to the Foundry integration documentation, the registry covers agents built in Foundry and Copilot Studio, agents registered by admins, and undeclared agents it discovers in the tenant. Viewing the inventory only takes the AI Reader role; applying security controls to agents requires Microsoft Entra Agent ID licensing, as Microsoft explains in its registry FAQ.
If you don't use these tools, a shared spreadsheet works. A list nobody has touched since the pilot doesn't.
Rule 2: what data each agent can use
Which model the agent uses matters less than what information it can reach. We recommend sorting data into three or four levels and deciding, for each one, whether agents can use it:
| Data type | Examples | Suggested rule for agents |
|---|---|---|
| Public | Catalog, FAQs, website | Allowed |
| Internal | Procedures, minutes, policies | Allowed, with access based on the user |
| Confidential | Proposals, contracts, margins | Approved agents only, with narrow permissions |
| Sensitive personal data | Health, payroll, biometrics | Not allowed without a prior assessment and explicit sign-off |
Then the table has to become configuration. Microsoft Purview sensitivity labels, which agents inherit and honor, and data loss prevention policies can block an agent from accessing or sharing sensitive content, according to the Agent 365 security documentation. Before connecting an agent to SharePoint, review site permissions. The agent sees whatever the user or its own identity can see, and in many companies that is a lot more than anyone would knowingly approve. If you plan to connect models to sensitive information, our article on Azure OpenAI and sensitive data covers what the platform protects and what it doesn't.
Rule 3: approval proportional to risk
Sending every agent to a committee is the fastest way to get people to stop asking permission. An agent that answers questions about internal policies doesn't carry the same risk as one that approves expense claims. We suggest three levels:
- Low risk: reads public or internal information and takes no actions. Business owner approval and an inventory entry are enough.
- Medium risk: reaches confidential data or takes reversible actions (drafting a document, opening a ticket). Also needs an IT and security review.
- High risk: uses sensitive personal data, makes decisions that affect people or takes actions that are hard to undo. Needs an impact assessment, legal review and defined human oversight.
At the high level there's a legal obligation too. Chile's Law 21.719 requires a data protection impact assessment before starting any processing likely to pose a high risk to data subjects. It also grants the right not to be subject to decisions based solely on automated processing, including profiling, when they have legal effects or significantly affect the person. Even under the exceptions the law allows, the controller must provide an explanation and human intervention. An agent that screens job candidates or assesses credit applications falls into this case.
Rule 4: identity, least privilege and someone accountable
Every production agent should have its own identity, not its creator's account or an API key pasted into a config file. With Microsoft Entra Agent ID, agents get identities you can apply Conditional Access, access reviews and lifecycle workflows to, the same as a user.
From day one, we recommend:
- Assign a sponsor or owner to each agent. Entra Agent ID includes that role so there is always a person responsible throughout the agent's lifecycle.
- Put expiry dates on access. A pilot that ended in March shouldn't still be reading the finance folder in October.
Rule 5: monitoring and a kill switch
Approval is the start. Someone still has to watch what the agent does in production. The current version of Microsoft Purview Data Security Posture Management includes an AI observability view that lists agents active in the last 30 days and flags risky activity such as data oversharing or exfiltration.
With or without those tools, decide three things:
- which logs you keep (prompts, responses, actions taken) and for how long;
- who reviews those logs and how often;
- how to switch an agent off within minutes if it starts misbehaving, and who has the authority to do it.
What Chilean regulation says today
Chile doesn't have an AI law yet. The bill regulating AI systems (Bulletin 16821-19) passed the Chamber of Deputies and is in its second stage in the Senate, with a risk-tier approach modeled on the EU regulation. The text could change a lot before it passes, so it's too early to build processes around it.
What does apply to agents that process personal data is Law 21.719, which is set to take effect on December 1, 2026. The government introduced a bill to postpone it to December 1, 2027, and that bill is still in Congress. Until an amending law is published, the 2026 date stands, and the substance of the obligations doesn't change with the calendar.
Frequently asked questions
Do I need Microsoft Agent 365 to govern my agents?
No. You can apply the rules in this article with a spreadsheet and clear processes. Agent 365 makes the inventory and controls easier as the number of agents grows.
Who should approve a new agent?
It depends on the risk. For read-only agents, the business owner is enough. If sensitive data or decisions about people are involved, IT, security and legal should all weigh in.
Does an agent that only reads documents need governance too?
Yes, a lighter version. It should be in the inventory, have an owner and only reach documents the user can already see.
How we work at Disrupsoft
We start by identifying which processes are worth solving with AI and what data they really need. Then we design the solution, implement it on Azure and keep tuning it in production. If your team needs training on the governance side, our AI Governance and Ethics course covers responsible AI, auditing and a 0, 6 and 12-month compliance plan. And if you're about to deploy your first agent, take a look at our Azure AI service and let's talk before it touches real data.
