Skip to content

Control 1.14: Data Minimization and Agent Scope Control

Control ID: 1.14
Pillar: Security
Regulatory Reference: GLBA 501(b), SEC Reg S-P, FINRA 4511, FINRA 3110, FINRA RN 24-09, CCPA §1798.100
Last UI Verified: May 2026
Last Verified: 2026-10-16 — documentation-only correction of Control 1.13 dependencies; tenant UI not tested.
Governance Levels: Baseline / Recommended / Regulated

Objective

Confirm Microsoft Copilot Studio agents access only the minimum data necessary for their functions by implementing least-privilege principles, documented data access justifications, scope creep prevention controls, and regular access reviews.

Why This Matters for FSI

Regulation How this control supports it
GLBA 501(b) Helps limit agent access to customer NPI to the minimum necessary for the function
SEC Regulation S-P (Safeguards Rule, as amended May 2024) Supports written policies and procedures for the safeguarding and disposal of customer information; helps evidence justification...
FINRA Rule 4511 Helps maintain an audit trail of data access decisions and book-and-record retention obligations for AI-mediated interactions
FINRA Rule 3110 + Regulatory Notice 24-09 (Generative AI / LLM Guidance) Applies existing supervisory obligations to AI agent data access on a technology-neutral basis; supports documented data...
CCPA §1798.100 Supports data minimization for non-GLBA personal information.
Regulatory mapping — click to expand
  • GLBA 501(b): Helps limit agent access to customer NPI to the minimum necessary for the function
  • SEC Regulation S-P (Safeguards Rule, as amended May 2024): Supports written policies and procedures for the safeguarding and disposal of customer information; helps evidence justification for agent access to consumer financial records
  • FINRA Rule 4511: Helps maintain an audit trail of data access decisions and book-and-record retention obligations for AI-mediated interactions
  • FINRA Rule 3110 + Regulatory Notice 24-09 (Generative AI / LLM Guidance): Applies existing supervisory obligations to AI agent data access on a technology-neutral basis; supports documented data minimization policies and near-real-time monitoring (within tenant audit and DSPM for AI latency windows) of AI-to-data interactions for customer-facing agents
  • CCPA §1798.100: Supports data minimization for non-GLBA personal information. Most broker-dealer / bank customer financial information is exempt under the GLBA carve-out at CCPA §1798.145(e); CCPA still applies to HR, marketing, and other non-GLBA personal information processed by agents

Control Description

This control establishes data minimization across the full set of agent grounding surfaces:

  1. Agent Data Access Inventory — Map all data sources and grounding surfaces accessed by each agent: SharePoint / OneDrive sites and libraries, Dataverse tables, Microsoft Graph connectors, per-conversation file uploads, image uploads (vision grounding), public web grounding (Bing-backed), enterprise web / curated URLs, connector references (Power Platform standard, premium, and custom connectors), and Copilot extensions / declarative agents / API plugins. Cross-reference Control 1.2 (Agent Registry) for the source-of-truth inventory.
  2. Data Access Justification Framework — Require documented business need for each agent ↔ grounding surface pair, with zone-based approval workflows (Zone 1 self-service; Zone 2 manager; Zone 3 CISO + AI Governance Lead).
  3. Connector Classification + Permission Minimization — Use Power Platform DLP to classify connectors into Business / Non-Business / Blocked groups (PPAC → Security → Data and privacy → Data policy); block connectors not justified by an inventory entry. For OAuth / Graph permission minimization on connectors that authenticate via Entra (custom connectors, Graph connectors, agent identity), use scoped delegated and application permissions per Control 1.18 — Power Platform DLP itself does not configure OAuth scopes.
  4. Grounding Source Minimization (SharePoint, web, files) — Scope SharePoint knowledge sources to specific document libraries or folders rather than entire sites; coordinate with Control 4.6 (Grounding Scope Governance) which provides the SharePoint enforcement layer (Restricted Content Discovery exclusion lists, Restricted SharePoint Search ≤100-site allowed list, and Data Access Governance reports). Disable public web grounding for Zone 3 agents handling NPI; restrict file upload by sensitivity label and SIT match (see Controls 1.13 and 1.17).
  5. Scope-Drift Monitoring (DSPM for AI + Audit + SIEM) — Use Microsoft Purview DSPM for AI and Activity Explorer to surface sensitive-data interactions with Copilot and agents; query the M365 Copilot audit schema (CopilotInteraction records) and join to the agent registry (Control 1.2) to derive scope-expansion signals. No native AgentScopeExpansion audit event exists — implement via the scope-drift-monitor solution or an equivalent SIEM correlation in Sentinel / Logic Apps.
  6. DLP for M365 Copilot Location — Apply the Microsoft 365 Copilot and Copilot Chat location with separate rules for supported built-in/custom SITs in typed prompts (prompt restriction preview, rollout dependent) and sensitivity labels on grounding files/emails (Control 1.13). Prompt SIT conditions do not inspect grounding files or uploaded-file contents; this does not establish blanket Copilot Studio connector coverage.
  7. Periodic Access Reviews — Run Microsoft Entra ID Governance Access Reviews on agent identities (Entra Agent ID), connector connections, and knowledge-source group memberships at the cadence defined in Zone-Specific Requirements; record decisions for FINRA 3110 supervisory evidence.

Key Configuration Points

  • Inventory all agent-to-grounding-surface mappings (SharePoint, Dataverse, files, images, web, connectors, extensions) with data classification levels — source of truth lives in Control 1.2
  • Establish zone-based approval workflow (Zone 1: self-service; Zone 2: manager; Zone 3: CISO + AI Governance Lead)
  • Configure Power Platform DLP (PPAC → Security → Data and privacy → Data policy) to classify connectors used by agents into Business / Non-Business / Blocked groups; block connectors not justified in inventory (cross-reference Control 1.4)
  • Create dedicated SharePoint groups for agent-readable content with least-privilege permissions; coordinate with Control 4.6 to apply Restricted Content Discovery (RCD) on high-risk sites and Restricted SharePoint Search (RSS) where appropriate (RSS is a short-term overshare-remediation measure, not a long-term Zone 3 boundary — see 4.6). When validating RCD / RSS with PowerShell, keep the tenant-approved SharePoint Online Management Shell release current enough to expose the required cmdlets.
  • Narrow Copilot Studio knowledge sources to specific document libraries / folders rather than entire sites; disable public web grounding for Zone 3 agents handling NPI; restrict file uploads and image uploads per zone
  • Configure Purview DSPM for AI policies and review Activity Explorer (the AI activities tab in unified DSPM) for sensitive-data interactions with agents; derive scope-drift signals via SIEM correlation against the M365 Copilot audit schema (CopilotInteraction records) — no native scope-expansion audit event exists
  • Apply separate Copilot-location rules for typed-prompt SITs and labeled grounding files/emails; validate actual experience and initiating-user scope (Control 1.13)
  • Document data access justification for each agent ↔ grounding surface pair; retain per WSP / FINRA 4511 retention schedules
  • Run Microsoft Entra ID Governance Access Reviews on agent identities and connector connections per zone cadence

Automation Available

Companion solutions in FSI-AgentGov-Solutions:

  • Credential Oversharing Detector — detection of overprivileged connectors, excessive OAuth scopes, unauthorized service accounts, and stale credentials against zone policy
  • Scope Drift Monitor — automated detection of agent data access beyond declared operational scope with approval workflows for scope expansion

File Upload Security Automation

See File Upload Security Configurator in FSI-AgentGov-Solutions for automated per-agent file upload validation against zone governance policies with drift detection, Teams alerting, and SHA-256 compliance evidence export.

License Requirements

  • Microsoft 365 Copilot — required for agent runtime, Copilot audit (CopilotInteraction), and DLP-for-Copilot location coverage
  • Microsoft 365 E5 Compliance (or E5 Information Protection & Governance) — required for Purview DSPM for AI, DLP for M365 Copilot location, and Activity Explorer
  • SharePoint Advanced Management — included with M365 Copilot; provides RCD, Restricted SharePoint Search, and Data Access Governance reports (see Control 4.6)
  • Microsoft Entra ID Governance (Entra ID P2) — required for Access Reviews on agent identities and connector connections
  • Power Platform DLP — included with the Power Platform tenant; no add-on required
  • Copilot Studio Copilot Credits capacity / applicable per-user license — required for Copilot Studio agent runtime

Verify SKU eligibility at deploy time.

Zone-Specific Requirements

Zone cross-reference

Baseline = Zone 1 (Personal Productivity) · Recommended = Zone 2 (Team Collaboration) · Regulated = Zone 3 (Enterprise Managed). Zone requirements below correspond to the Governance Level in the control header.

Zone Requirement Rationale
Zone 1 (Personal) Annual data access review; standard DLP; self-service scope changes Low risk, minimal data access
Zone 2 (Team) Quarterly review; enhanced DLP; manager approval for scope changes Team data requires accountability
Zone 3 (Enterprise) Monthly review; strict allowlist; CISO approval; real-time monitoring Customer-facing requires strict minimization

Roles & Responsibilities

Role Responsibility
Power Platform Admin Review agent configurations, manage environment settings, configure Power Platform DLP
AI Administrator Manage Microsoft 365 Copilot settings, agent feature access, and Copilot connector delegation
SharePoint Admin Manage site permissions, create agent access groups, coordinate RCD/RSS posture (Control 4.6)
Purview Compliance Admin Configure DLP for M365 Copilot location, review compliance posture
Purview Data Security AI Admin Configure Purview DSPM for AI policies and review Activity Explorer signals
Entra Identity Governance Admin Run Access Reviews on agent identities and connector connections
AI Governance Lead Define approval workflows, conduct quarterly access reviews, own scope-drift response
Compliance Officer Review supervisory evidence, sign off on FINRA Rule 3110 / RN 24-09 documentation
CISO Approve Zone 3 scope changes; own residual-risk acceptance
Control Relationship
1.2 - Agent Registry Source-of-truth agent ↔ grounding surface inventory
1.3 - SharePoint Governance Content access restrictions and label propagation
1.4 - Advanced Connector Policies Power Platform DLP connector classification
1.10 - Communication Compliance Monitoring Supervisory monitoring of agent-mediated communications
1.13 - Sensitive Information Types SIT signal feeding DLP-for-Copilot and scope-drift detection
1.18 - RBAC Role-based and OAuth scope minimization for agent identities
1.19 - eDiscovery for Agent Interactions Evidence retrieval over CopilotInteraction records
4.6 - Grounding Scope Governance SharePoint enforcement layer (RCD, RSS ≤100-site allowed list, DAG reports) — required for §4 minimization to be operational

Implementation Playbooks

Step-by-Step Implementation

This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

Verification Criteria

Confirm control effectiveness by verifying:

  1. Every agent in the Control 1.2 registry has a documented justification for each grounding surface (SharePoint scope, Dataverse tables, file upload allowed, image upload allowed, public web on/off, enterprise web URLs, connector references, extensions/plugins) on file
  2. Power Platform DLP policy classifies every connector used by an agent into Business / Non-Business / Blocked; no agent uses a connector that is not in the Business group of its environment's policy (cross-check against Control 1.4)
  3. SharePoint knowledge sources are scoped to specific libraries / folders, not entire sites; sample 10% of agents and confirm
  4. Public web grounding is disabled on all Zone 3 agents handling NPI (verify in Copilot Studio agent settings)
  5. File upload and image upload posture matches zone policy (Zone 3: restricted to labeled / SIT-validated content) — see Control 1.17 endpoint DLP and the File Upload Security Configurator
  6. Purview DSPM for AI policies cover all environments hosting agents that ground on customer data; Activity Explorer / AI activities shows no unexplained sensitive-data interactions in the past 30 days for Zone 3
  7. Test the Copilot-location typed-prompt SIT condition using prevalidated synthetic text, and the separate label condition using a labeled grounding file/email. Uploaded-file contents are not scanned by the prompt SIT condition; test actual agent/connector upload controls independently (Control 1.13)
  8. SIEM correlation against CopilotInteraction audit records produces a scope-drift report at zone cadence (Zone 3: weekly); incidents triaged within SLA
  9. Control 4.6 RCD exclusion list and RSS allowed-list (if used) reconcile against the agent grounding inventory — no high-risk site is grounded by a Zone 3 agent and missing from the RCD list
  10. Microsoft Entra ID Governance Access Reviews completed at zone cadence on agent identities and connector connections; decisions retained per FINRA 4511
  11. Quarterly (Zone 1: annual; Zone 2: quarterly; Zone 3: monthly) access review documented with reviewer, date, scope changes, and approval evidence
  12. Sample audit pulls (CopilotInteraction, DSPM for AI activity, DLP-for-Copilot rule matches) for the past 90 days are exportable and tied back to the WSP — supports FINRA 3110 supervisory evidence and SEC Reg S-P safeguards documentation

Additional Resources

Updated: October 2026 | Version: v1.6.2 | UI Verification Status: Needs Review — Control 1.13 dependencies documentation-verified; tenant UI not tested