Skip to content

Troubleshooting: Control 3.12 - Agent Governance Exception and Override Management

Last Updated: February 2026 Support Contacts: Power Platform Admin team, Dataverse support

Overview

This playbook provides solutions to common issues encountered when implementing and operating the agent governance exception management system.

Issue 1: Exception Request Form Fails to Load

Symptoms

  • Power Apps form shows "Something went wrong" error
  • Form loads but fields are blank/missing
  • Cannot open form app from Power Apps portal

Possible Causes

  • Dataverse connection string incorrect
  • Missing permissions on Governance Exceptions table
  • Table schema changes not synchronized with app

Resolution Steps

  1. Verify Dataverse Connection
  2. Open Power Apps → Apps → Agent Exception Request Form → Edit
  3. Check Data sources panel

  4. If Governance Exceptions shows with red error icon:

    • Remove the data source
    • Click + Add data and re-add Governance Exceptions table
    • Click Refresh to sync latest schema

  5. Check User Permissions

  6. Navigate to Power Apps → Tables → Governance Exceptions → Settings → Security roles
  7. Verify user's security role has:
    • Create: Organization (to submit requests)
    • Read: Organization (to view form)

  8. If missing, grant appropriate permissions

  9. Verify Environment Selection

  10. Ensure form is opened in the same environment where Governance Exceptions table exists

  11. Check environment selector in top-right corner of Power Apps portal

  12. Test with Simplified Form

  13. Create new test form with only 3 fields (Agent Name, Requestor, Exception Type)
  14. If test form works, issue is with field configuration or validation formulas
  15. Review OnChange and validation formulas for syntax errors

Prevention

  • Always test form after adding/modifying Dataverse columns
  • Document environment-table mappings for troubleshooting
  • Use version control for form exports

Issue 2: Approval Workflow Not Triggering

Symptoms

  • Exception request submitted successfully but no approval email received
  • Power Automate flow shows no recent runs
  • Dataverse record remains in "Pending" status indefinitely

Possible Causes

  • Flow is turned off
  • Trigger condition filtering out the record
  • Connection to Dataverse expired/invalid
  • Flow reached run quota limit

Resolution Steps

  1. Verify Flow Is Enabled
  2. Navigate to Power Automate → My flows → Agent Exception Approval Workflow
  3. Check status in top-right corner

  4. If "Off", click Turn on

  5. Check Flow Run History

  6. Click on the flow name
  7. Review 28-day run history
  8. If no runs appear after submission:
    • Issue is with trigger configuration

  9. If runs appear but fail:

    • Open failed run and identify failing action

  10. Verify Trigger Configuration

  11. Edit the flow
  12. Open When a row is added, modified or deleted trigger
  13. Verify:
    • Change type: Added
    • Table name: Governance Exceptions
    • Scope: Organization (not User or Business Unit)

  14. Test by manually creating a Dataverse record

  15. Check Dataverse Connection

  16. In flow editor, hover over Dataverse actions
  17. If yellow warning icon appears: "This connection is not valid"

  18. Delete connection and recreate with valid credentials

  19. Verify Flow Permissions

  20. Flow owner must have:
    • Dataverse System Administrator role (or custom role with full CRUD on Governance Exceptions)
    • Power Automate Premium license

  21. If permissions missing, re-share flow with correct owner

  22. Check Run Quota

  23. Power Automate has daily run limits based on license
  24. Navigate to Admin center → Analytics → Flows
  25. If quota exceeded, flow will not trigger until quota resets

Prevention

  • Set up flow error notifications (Configure → Run only users → Notify when flow fails)
  • Monitor flow analytics weekly
  • Use service account with Premium license for production flows

Issue 3: Wrong Approver Receives Email

Symptoms

  • Zone 3 exception sends approval to wrong person
  • Approver email goes to generic mailbox instead of individual
  • Approval email contains "Unknown user" for approver name

Possible Causes

  • Approver email hardcoded incorrectly in flow
  • Approver lookup field not properly configured
  • Zone classification mismatch in flow routing logic

Resolution Steps

  1. Verify Zone-Based Routing Logic
  2. Edit flow
  3. Find Condition action that checks Governance Zone

  4. Verify zone values match Dataverse choice labels exactly:

    • "Zone 1 - Personal" (not "Zone 1" or "Personal")
    • "Zone 2 - Team"
    • "Zone 3 - Enterprise"

  5. Check Approver Email Configuration

  6. In Start and wait for an approval action

  7. Verify Assigned to field uses:

    • Dynamic content from Dataverse (recommended): Approver 1 lookup field
    • OR hardcoded email: Must be valid Entra ID user

  8. Update Approver Mapping

  9. If using hardcoded emails, create Dataverse configuration table:
    • Table: fsi_approverconfig
    • Columns: Zone (choice), ApproverLevel (choice), ApproverEmail (text)

  10. Update flow to query configuration table based on zone

  11. Test with All Zones

  12. Submit test exception for Zone 1, 2, and 3
  13. Verify each goes to correct approver(s)
  14. Check email headers to confirm recipient matches expected approver

Prevention

  • Use Dataverse lookup fields for approvers instead of hardcoded emails
  • Document approver assignments by zone in governance policy
  • Test zone routing logic after any flow modifications

Issue 4: Expiration Monitor Not Sending Alerts

Symptoms

  • Exceptions are expiring without warning emails
  • Teams channel shows no expiration alerts
  • PowerShell script runs successfully but no output

Possible Causes

  • Flow schedule disabled or incorrect time zone
  • Filter query not matching expiring exceptions
  • Email action failing silently
  • Teams connector authentication expired

Resolution Steps

  1. Check Flow Schedule
  2. Open Exception Expiration Monitor flow
  3. Verify Recurrence trigger:
    • Interval: 1
    • Frequency: Day
    • Time zone: Correct for your organization
    • At these hours/minutes: 8:00 AM (or desired time)

  4. Click Test → Manually to run immediately

  5. Verify Filter Query Syntax

  6. Edit flow
  7. Open List rows action
  8. Check Filter rows expression: 
    fsi_approvalstatus eq 'Fully Approved' and 
fsi_expirationdate le @{addDays(utcNow(), 7)} and
fsi_expirationdate ge @{utcNow()}

  9. Ensure date format matches Dataverse column format (ISO 8601: yyyy-MM-dd)

  10. Test Filter Query Manually

  11. Create test exception with expiration date = 5 days from today
  12. Manually run flow
  13. Check flow run history → List rows action output

  14. If output count = 0, filter query is incorrect

  15. Check Email Action Configuration

  16. In Send an email action
  17. Verify To field contains valid email address (dynamic content from loop item)

  18. Test by replacing dynamic content with static test email

  19. Verify Teams Connection

  20. If Teams notifications not appearing:

    • Edit Post adaptive card action
    • Delete Teams connection and re-authenticate
    • Verify Team and Channel selections are correct

  21. Check for Action Failures in Run History

  22. Open recent flow run
  23. Expand each action
  24. Look for red X indicating failure
  25. Review error message for specific issue (authentication, permissions, syntax)

Prevention

  • Schedule flow to run multiple times per day for critical notifications
  • Set up flow failure alerts to notify admin team
  • Test expiration monitor weekly with manually created test data

Issue 5: PowerShell Script Connection Failures

Symptoms

  • Connect-CrmOnline fails with authentication error
  • "Unable to connect to Dataverse" message
  • Scripts timeout when querying large datasets

Possible Causes

  • Missing PowerShell modules
  • Expired authentication token
  • Firewall blocking connection to Dataverse URL
  • Insufficient permissions on Dataverse environment

Resolution Steps

  1. Verify Module Installation 
    Get-Module -ListAvailable -Name Microsoft.Xrm.Data.PowerShell

  2. If not found: 

    Install-Module -Name Microsoft.Xrm.Data.PowerShell -Scope CurrentUser -Force

  3. Test Connection Manually 

    $conn = Connect-CrmOnline -ServerUrl "https://contoso.crm.dynamics.com"
$conn.IsReady

  4. If returns False, authentication failed

  5. Re-run Connect-CrmOnline with -InteractiveLogin parameter to force new login

  6. Check Dataverse URL Format

  7. Ensure URL format is correct:

    • ✅ Correct: https://orgname.crm.dynamics.com
    • ❌ Incorrect: https://make.powerapps.com (this is Power Apps portal, not Dataverse)

  8. Verify User Permissions

  9. User running script must have:

    • Dataverse System Administrator role OR
    • Custom security role with Read access to Governance Exceptions table

  10. Use Service Principal for Automation

  11. For scheduled scripts, use service principal instead of user credentials: 

    $conn = Connect-CrmOnline `
    -ServerUrl "https://contoso.crm.dynamics.com" `
    -ClientId "app-registration-id" `
    -ClientSecret "secret"

  12. Handle Timeouts for Large Datasets

  13. If script times out on large exception registers:
  14. Add paging to FetchXML query: 
    <fetch page="1" count="500">
  <!-- query definition -->
</fetch>
  15. Implement loop to retrieve multiple pages

Prevention

  • Document service principal setup for automation
  • Test scripts in non-production environment first
  • Implement retry logic for transient connection failures

Issue 6: Dataverse Table Missing or Not Found

Symptoms

  • Power Apps shows "Table not found: fsi_governanceexception"
  • PowerShell script error: "Entity 'fsi_governanceexception' not found"
  • Flow trigger cannot find Governance Exceptions table

Possible Causes

  • Table created in different environment
  • Table name/schema name mismatch
  • Table was deleted or renamed
  • User viewing wrong environment

Resolution Steps

  1. Verify Table Exists
  2. Navigate to Power Apps → Tables
  3. Ensure correct environment selected (top-right dropdown)
  4. Search for "Governance Exceptions"

  5. If not found, table does not exist in this environment

  6. Check Table Schema Name

  7. If table exists but shows different name:
  8. Click on table → Settings → Properties
  9. Verify Name (schema name): Should be fsi_governanceexception

  10. If different, update all references in flows and scripts

  11. Recreate Table if Deleted

  12. Follow Portal Walkthrough steps to recreate table

  13. Re-import any backed-up data

  14. Verify Environment Consistency

  15. Ensure all components (table, form, flows) are in same environment:
    • Dataverse table: Environment X
    • Power Apps form: Environment X
    • Power Automate flows: Environment X
  16. If mismatched, export/import components to correct environment

Prevention

  • Use solution packages to deploy related components together
  • Document environment architecture (dev, test, prod)
  • Implement change control for table modifications

Issue 7: Approval Status Not Updating

Symptoms

  • Approver clicks "Approve" but Dataverse record stays "Pending"
  • Multiple approvals but status does not progress (e.g., stuck at "Level 1 Approved")
  • Dataverse shows update error in flow run history

Possible Causes

  • Flow does not have write permissions to Dataverse
  • Update action targeting wrong record
  • Choice label mismatch between flow and Dataverse
  • Concurrent update conflict

Resolution Steps

  1. Check Flow Run History
  2. Open flow run where approval occurred
  3. Expand Update a row action

  4. Review output:

    • If green checkmark: Update succeeded (issue is elsewhere)
    • If red X: Read error message

  5. Verify Row ID Parameter

  6. In Update a row action

  7. Row ID must be: fsi_governanceexceptionid from trigger (not static GUID)

  8. Check Choice Label Values

  9. In Dataverse, go to Tables → Governance Exceptions → Columns → Approval Status
  10. Click on column → Edit
  11. Verify choice labels match exactly what flow is setting:
    • "Pending"
    • "Level 1 Approved"
    • "Level 2 Approved"
    • "Fully Approved"

  12. If labels differ, update flow or Dataverse to match

  13. Test Update Action Manually

  14. Add Compose action after Update a row
  15. Set inputs to: outputs('Update_a_row')

  16. Run flow and review Compose output for detailed response

  17. Handle Concurrent Updates

  18. If multiple flows modify same record simultaneously:
  19. Add Delay action before update (e.g., 2 seconds)
  20. Or implement optimistic concurrency check

Prevention

  • Use dynamic content for all Dataverse references (no hardcoded values)
  • Test flows in isolated test environment before production deployment
  • Document exact choice label values

Issue 8: Teams Notifications Not Appearing

Symptoms

  • Approval completes successfully but no Teams adaptive card posted
  • Teams channel exists but bot posts are not visible
  • Flow shows Teams action succeeded but message not found

Possible Causes

  • Incorrect Team or Channel selection
  • Flow bot not added to Teams channel
  • Adaptive card JSON syntax error
  • User permissions to view channel

Resolution Steps

  1. Verify Team and Channel Selection
  2. Edit flow
  3. Open Post adaptive card action
  4. Click on Team dropdown:
    • If "Custom value" selected, Teams ID may be incorrect
    • Select team from dropdown list instead

  5. Click on Channel dropdown and select from list

  6. Add Flow Bot to Channel

  7. Open Microsoft Teams
  8. Navigate to target team and channel
  9. Click ... → Manage channel → Settings → Apps
  10. Verify "Flow" or "Power Automate" app is installed

  11. If missing, add app to team

  12. Test Adaptive Card JSON

  13. Copy adaptive card JSON from flow
  14. Paste into Adaptive Card Designer
  15. Verify card renders without errors

  16. Fix any syntax issues (missing commas, invalid schema version)

  17. Check Channel Permissions

  18. Verify user has access to view the channel
  19. Some organizations restrict bot posts

  20. Contact Teams admin to verify bot posting is allowed

  21. Alternative: Use Simple Teams Message

  22. If adaptive cards not working, replace with simpler action:
  23. Use Post message in a chat or channel (not adaptive card)
  24. Send plain text notification to test connectivity

Prevention

  • Test Teams notifications in non-production channel first
  • Save working adaptive card JSON as template
  • Monitor Teams admin policies for bot posting restrictions

Issue 9: SHA-256 Hash Verification Fails

Symptoms

  • Hash from certutil does not match SHA256_HASH.txt
  • Evidence export script completes but hash file is empty
  • Hash changes between generations of same data

Possible Causes

  • File modified after hash generation
  • Character encoding differences (UTF-8 vs. UTF-8 with BOM)
  • Line ending differences (CRLF vs. LF)
  • PowerShell script error during hash calculation

Resolution Steps

  1. Verify File Not Modified
  2. Check file modification timestamp
  3. If modified after hash generation, hash will not match

  4. Regenerate hash after any file changes

  5. Check Character Encoding

  6. In PowerShell export script: 
    Export-Csv -Path $outputFile -NoTypeInformation -Encoding UTF8
  7. Ensure -Encoding UTF8 parameter is specified

  8. Some editors add BOM (Byte Order Mark) which changes hash

  9. Test Hash Calculation 

    $hash = Get-FileHash -Path "ExceptionRegister.csv" -Algorithm SHA256
$hash.Hash.ToLower()

  10. Compare to script-generated hash

  11. If different, script has bug in hash calculation

  12. Verify certutil Output Format

  13. Run: certutil -hashfile ExceptionRegister.csv SHA256
  14. Output format: 
    SHA256 hash of ExceptionRegister.csv:
a1b2c3d4...
CertUtil: -hashfile command completed successfully.

  15. Copy only the hex hash line (not header or footer)

  16. Use PowerShell for Verification Instead 

    $scriptHash = Get-Content "SHA256_HASH.txt" | Select-Object -First 1 | ForEach-Object { $_.Split()[0] }
$fileHash = (Get-FileHash -Path "ExceptionRegister.csv" -Algorithm SHA256).Hash.ToLower()
if ($scriptHash -eq $fileHash) { Write-Host "✓ Hash verified" -ForegroundColor Green }

Prevention

  • Document hash verification procedure in audit guide
  • Test evidence export process quarterly
  • Store evidence files as read-only to prevent accidental modification

Issue 10: High Renewal Counts Not Flagged

Symptoms

  • Exception has 4 renewals but compliance report shows "Compliant"
  • Renewal count not incrementing when exceptions are extended
  • Compliance script does not detect renewal limit violations

Possible Causes

  • Renewal count column not updated when extending exception
  • Compliance script checking wrong threshold
  • Manual record edits bypassing renewal workflow

Resolution Steps

  1. Implement Renewal Workflow
  2. Create separate Power Automate flow: "Exception Renewal Workflow"
  3. Trigger: When Expiration Date is modified and status = "Fully Approved"
  4. Action: Increment Renewal Count by 1

  5. Action: Check if Renewal Count > 2, if yes set status to "Expired - Max Renewals"

  6. Audit Existing Renewal Counts 

    # Query all exceptions with renewal count > 2
$fetchXml = @"
<fetch>
  <entity name="fsi_governanceexception">
    <attribute name="fsi_name" />
    <attribute name="fsi_renewalcount" />
    <filter>
      <condition attribute="fsi_renewalcount" operator="gt" value="2" />
    </filter>
  </entity>
</fetch>
"@

  7. Review and remediate violations

  8. Update Compliance Script Threshold

  9. In Get-ExceptionComplianceReport.ps1
  10. Verify line: 
    if ($record.fsi_renewalcount -gt 2) {
    $issues += "Renewal count exceeds limit..."
}

  11. Ensure threshold matches policy (2 renewals = 3 total approval periods)

  12. Document Renewal Process

  13. Create governance procedure: "Exception Renewal Request"
  14. Require:
    • Updated justification
    • New risk assessment
    • Approval from original approvers
    • Automatic increment of renewal count

Prevention

  • Automate renewal count updates via Power Automate
  • Restrict direct Dataverse editing to prevent bypass
  • Include renewal count in all reporting dashboards

General Troubleshooting Tips

Enable Detailed Logging

For Power Automate flows: 1. Add Compose actions after each major step 2. Set inputs to output of previous action 3. Review run history to see intermediate values

For PowerShell scripts: 

# Add at start of script
$VerbosePreference = "Continue"
$DebugPreference = "Continue"

# Add throughout script
Write-Verbose "Connecting to Dataverse at $(Get-Date)"
Write-Debug "Query returned $($results.Count) records"

Common Error Messages

Error Message Likely Cause Solution
"Principal user is missing prvReadUser privilege" Insufficient Dataverse permissions Grant Read user privilege in security role
"The requested operation requires a connection" Flow connection expired Re-authenticate connection in flow
"Invalid FetchXML" FetchXML syntax error Validate XML structure, check attribute names
"Approval action timed out" Approver did not respond within timeout period Increase timeout or remind approver to respond
"Adaptive card schema version not supported" Teams doesn't support card version Change to version 1.4 or lower

Escalation Paths

If issues cannot be resolved using this guide:

  1. Power Apps/Dataverse Issues
  2. Contact: Microsoft Support via Admin Center → Support → New service request

  3. Required info: Environment ID, table name, error messages, screenshots

  4. Power Automate Issues

  5. Contact: Microsoft Support

  6. Required info: Flow name, run ID, error details, flow export (.zip)

  7. Governance Policy Questions

  8. Contact: AI Governance Lead or Compliance Officer

  9. Review: Exception management policy document

  10. Technical Assistance

  11. Contact: Internal Power Platform Admin team
  12. Escalate to Microsoft FastTrack if available

Additional Resources

Back to Control 3.12

Updated: February 2026 | Version: v1.0