Skip to content

Framework Overview

The FSI Agent Governance Framework provides comprehensive governance guidance for Microsoft 365 AI agents (Copilot Studio, Agent Builder) in US financial services organizations.

Purpose

This Framework layer establishes the foundational governance principles, organizational structure, and regulatory context for AI agent deployment. Content here is designed for:

  • Executives and Board Members — Strategic oversight and risk appetite decisions
  • Compliance Officers — Regulatory alignment and examination readiness
  • AI Governance Committees — Policy decisions and approval workflows
  • Auditors — Framework structure and control objectives

Three-Layer Documentation Architecture

The FSI Agent Governance Framework uses a three-layer documentation model to separate stable governance principles from frequently-updated implementation procedures:

Layer Content Update Frequency Files
1. Framework (this layer) Governance principles, zones, lifecycle, regulatory context 1-2x per year 12 documents
2. Control Catalog 71 technical control specifications across 4 pillars Quarterly 71 control files
3. Playbooks Step-by-step implementation procedures Continuous (as Microsoft portals change) 284 playbook files (4 per control)

This separation ensures governance stability while allowing rapid updates to implementation guidance as Microsoft 365 and Power Platform evolve.

Framework Components

Document Purpose Audience
Executive Summary Board-level overview of AI agent risks and governance C-suite, Board
Governance Fundamentals Core framework concepts and structure All stakeholders
Zones and Tiers Three-zone governance model Governance committees
Agent Lifecycle Lifecycle phases and governance requirements Compliance, Operations
Relationship to FSI-CopilotGov Scope boundary with the companion Copilot framework New users, program leads
Regulatory Framework US regulatory requirements and control mappings Compliance, Legal
Operating Model RACI, roles, governance structure All stakeholders
Governance Cadence Review schedules and audit readiness Compliance, Audit
Adoption Roadmap Phased implementation guidance Implementation teams
Agent 365 Architecture Platform architecture, Agent 365 control plane, and Entra Agent ID governance Platform architects
Agent Identity Architecture Agent identity, authentication, and authorization patterns Security architects
Solutions Integration Companion solution catalog and automation coverage Implementation teams

Framework Principles

1. Risk-Based Governance

Controls scale with risk. Zone 1 (personal productivity) requires minimal oversight while Zone 3 (enterprise/customer-facing) requires comprehensive governance including committee approval, model risk management, and 10-year retention.

2. Regulatory Alignment

The framework maps controls to US financial regulations including FINRA 4511/3110, SEC 17a-3/4, SOX 302/404, GLBA 501(b), OCC 2011-12, and Fed SR 11-7. Organizations should validate mappings against their specific regulatory obligations.

3. Microsoft Platform Foundation

All controls leverage native Microsoft 365 and Power Platform capabilities. This framework does not require third-party governance tools, though organizations may integrate additional solutions.

4. Separation of Concerns

The framework separates:

  • Framework (this layer) — Stable governance principles updated 1-2x per year
  • Control Catalog — Control objectives and requirements updated quarterly
  • Playbooks — Implementation procedures updated continuously as Microsoft portals change

Quick Navigation

For Executives:

  1. Start with Executive Summary
  2. Review Zones and Tiers for risk classification
  3. Understand Operating Model for accountability

For New Users Comparing Frameworks:

  1. Read Relationship to FSI-CopilotGov to confirm scope
  2. Review Zones and Tiers for the AgentGov operating model
  3. Continue to Executive Summary for governance context

For Compliance Officers:

  1. Review Regulatory Framework
  2. Understand Governance Cadence for examination readiness
  3. Reference Control Catalog for specific requirements

For Implementation Teams:

  1. Run the Governance Readiness Assessment to identify gaps and priorities
  2. Follow Adoption Roadmap
  3. Reference Playbooks for step-by-step procedures
  4. Use Control Catalog for control objectives

Version Information

  • Framework Version: 1.2.53 (March 2026)
  • Last Updated: March 2026
  • Update Frequency: 1-2 times per year (major regulatory or platform changes)

FSI Agent Governance Framework v1.2.51 - February 2026