Skip to content

Control 1.14: Data Minimization and Agent Scope Control

Control ID: 1.14 Pillar: Security Regulatory Reference: GLBA 501(b), SEC Reg S-P, FINRA 4511, CCPA §1798.100 Last UI Verified: January 2026 Governance Levels: Baseline / Recommended / Regulated Last Verified: 2026-02-03

Objective

Ensure Copilot Studio agents access only the minimum data necessary for their functions by implementing least-privilege principles, documented data access justifications, scope creep prevention controls, and regular access reviews.

Why This Matters for FSI

  • GLBA 501(b): Limits agent access to customer NPI to minimum necessary for the function
  • SEC Reg S-P: Documents data access justification for privacy compliance
  • FINRA 4511: Provides audit trail for data access decisions
  • CCPA §1798.100: Supports data collection minimization requirements

Control Description

This control establishes data minimization through:

  1. Agent Data Access Inventory - Map all data sources accessed by each agent (SharePoint, Dataverse, APIs, knowledge sources)
  2. Data Access Justification Framework - Require documented business need for each data source with zone-based approval workflows
  3. Connector Scope Restrictions - Limit OAuth scopes and connector permissions to minimum required
  4. Knowledge Source Minimization - Scope knowledge sources to specific folders rather than entire sites
  5. Automated Scope Alerts - Alert when agents access new data sources or expand scope
  6. Quarterly Access Reviews - Review and remove unnecessary permissions regularly

Key Configuration Points

  • Inventory all agent-to-data-source mappings with data classification levels
  • Establish zone-based approval workflow (Zone 1: self-service, Zone 2: manager, Zone 3: CISO)
  • Configure DLP connector restrictions to block unnecessary connectors
  • Create dedicated "Agent Access" SharePoint groups with minimal permissions
  • Narrow knowledge sources to specific document libraries, not entire sites
  • Configure Purview audit alerts for agent scope expansion events
  • Document data access justification for each agent-data source pair

Automation Available

See Scope Drift Monitor in FSI-AgentGov-Solutions for automated detection of agent data access beyond declared operational scope with approval workflows for scope expansion.

File Upload Security Automation

See File Upload Security Configurator in FSI-AgentGov-Solutions for automated per-agent file upload validation against zone governance policies with drift detection, Teams alerting, and SHA-256 compliance evidence export.

Zone-Specific Requirements

Zone Requirement Rationale
Zone 1 (Personal) Annual data access review; standard DLP; self-service scope changes Low risk, minimal data access
Zone 2 (Team) Quarterly review; enhanced DLP; manager approval for scope changes Team data requires accountability
Zone 3 (Enterprise) Monthly review; strict allowlist; CISO approval; real-time monitoring Customer-facing requires strict minimization

Roles & Responsibilities

Role Responsibility
Power Platform Admin Review agent configurations, manage environment settings
SharePoint Admin Manage site permissions, create agent access groups
Purview Compliance Admin Review data access patterns, configure alerts
AI Governance Lead Define approval workflows, conduct access reviews
Control Relationship
1.2 - Agent Registry Agent inventory for data mapping
1.3 - SharePoint Governance Content access restrictions
1.4 - Advanced Connector Policies Connector restrictions
1.18 - RBAC Role-based permissions

Implementation Playbooks

Step-by-Step Implementation

This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

Verification Criteria

Confirm control effectiveness by verifying:

  1. All agents have documented data access justification on file
  2. Connector audit shows no unused or unjustified connectors
  3. Knowledge sources are scoped to specific folders (not entire sites)
  4. Scope creep alerts fire when agent accesses new data sources
  5. Quarterly access review process completes with documented decisions

Additional Resources

Updated: January 2026 | Version: v1.2 | UI Verification Status: Current