Skip to content

FSI Agent Governance Framework - Control Index

Complete Control Reference (48 Controls)

This directory contains comprehensive control documentation for the FSI Agent Governance Framework across four pillars.

Pillar 1: Security Controls (19 Controls)

Control ID Control Name
1.1 Restrict Agent Publishing by Authorization
1.2 Agent Registry and Integrated Apps Management
1.3 SharePoint Content Governance and Permissions
1.4 Advanced Connector Policies (ACP)
1.5 Data Loss Prevention (DLP) and Sensitivity Labels
1.6 Microsoft Purview: DSPM for AI
1.7 Comprehensive Audit Logging and Compliance
1.8 Runtime Protection and External Threat Detection
1.9 Data Retention and Deletion Policies
1.10 Communication Compliance Monitoring
1.11 Conditional Access and Phishing-Resistant MFA
1.12 Insider Risk Detection and Response
1.13 Sensitive Information Types (SITs) and Pattern Recognition
1.14 Data Minimization and Agent Scope Control
1.15 Encryption: Data in Transit and at Rest
1.16 Information Rights Management (IRM) for Documents
1.17 Endpoint Data Loss Prevention (Endpoint DLP)
1.18 Application-Level Authorization and Role-Based Access Control (RBAC)
1.19 eDiscovery for Agent Interactions

Pillar 2: Management Controls (15 Controls)

Control ID Control Name
2.1 Managed Environments
2.2 Environment Groups and Tier Classification
2.3 Change Management and Release Planning
2.4 Business Continuity and Disaster Recovery
2.5 Testing, Validation, and Quality Assurance
2.6 Model Risk Management (Alignment with OCC 2011-12/SR 11-7)
2.7 Vendor and Third-Party Risk Management
2.8 Access Control and Segregation of Duties
2.9 Agent Performance Monitoring and Optimization
2.10 Patch Management and System Updates
2.11 Bias Testing and Fairness Assessment (FINRA Notice 25-07 / SR 11-7 Alignment)
2.12 Supervision and Oversight (FINRA Rule 3110)
2.13 Documentation and Record Keeping
2.14 Training and Awareness Program
2.15 Environment Routing and Auto-Provisioning

Pillar 3: Agent Reporting (9 Controls)

Control ID Control Name
3.1 Agent Inventory and Metadata Management
3.2 Usage Analytics and Activity Monitoring
3.3 Compliance and Regulatory Reporting
3.4 Incident Reporting and Root Cause Analysis
3.5 Cost Allocation and Budget Tracking
3.6 Orphaned Agent Detection and Remediation
3.7 PPAC Security Posture Assessment
3.8 Copilot Hub
3.9 Microsoft Sentinel Integration

Pillar 4: SharePoint Advanced Management (5 Controls)

Control ID Control Name
4.1 SharePoint Information Access Governance (IAG) / Restricted Content Discovery
4.2 Site Access Reviews and Certification
4.3 Site and Document Retention Management
4.4 Guest and External User Access Controls
4.5 SharePoint Security and Compliance Monitoring

How to Use This Framework

  1. Review the Overview - Start with the framework overview to understand the 3 zones and 4 pillars
  2. Assess Current State - For each control, review your current implementation level (Baseline, Recommended, or Regulated)
  3. Implement Controls - Follow the implementation guidance in each control file
  4. Verify & Document - Use the verification steps to confirm implementation and document evidence
  5. Establish Recurring Reviews - Schedule quarterly reviews to ensure controls remain effective

Governance Levels

Each control is documented with three governance levels:

  • Baseline: Minimum required implementation
  • Recommended: Best practice implementation for Zone 2+ agents
  • Regulated/High-Risk: Comprehensive implementation for Zone 3 agents and regulated environments

Pillar Descriptions

Pillar 1: Security Controls (19 Controls)

Focus: Protect data and systems from unauthorized access, misuse, and exploitation. - Authentication and Authorization - Data Loss Prevention - Audit Logging - Encryption - Threat Detection - eDiscovery

Pillar 2: Management Controls (15 Controls)

Focus: Govern the agent lifecycle, access control, change management, and model risk. - Managed Environments - Change Management - Business Continuity - Testing & Validation - Model Risk Management - Vendor Management - Training & Supervision

Pillar 3: Agent Reporting (9 Controls)

Focus: Visibility and monitoring of agent activities, performance, and compliance. - Agent Inventory - Usage Analytics - Compliance Reporting - Incident Management - Cost Tracking - Orphaned Agent Detection - PPAC Security Posture - Copilot Hub - Sentinel Integration

Pillar 4: SharePoint Advanced Management (5 Controls)

Focus: Govern SharePoint content accessed by agents with specific access, retention, and security controls. - Information Access Governance - Access Reviews - Retention Management - Guest Access Controls - Security Monitoring

Regulatory Alignment

The framework covers compliance requirements for:

  • FINRA: Rules 3110, 4511, 4512 + Regulatory Notice 25-07
  • SEC: Rules 17a-3/4, 10b-5, Reg BI, Reg S-P
  • SOX: Sections 302, 404 (internal controls and reporting)
  • GLBA: Sections 501, 504, 505 (safeguards and privacy)
  • OCC: Bulletin 2011-12 and SR 11-7 (model risk management)
  • Federal Reserve: SR 11-7 (model risk, fair lending)

Governance Zones

Controls are documented for implementation in three governance zones:

  • Zone 1: Personal Productivity - Individual development, low risk
  • Zone 2: Team Collaboration - Departmental agents, medium risk
  • Zone 3: Enterprise Managed - Organization-wide, high risk, customer-facing

Questions & Support

For questions about specific controls or implementation guidance:

  • Review the control file for detailed verification steps
  • Contact your AI Governance Lead
  • Escalate to Compliance Officer for regulatory questions
  • Contact your technical implementation team for platform-specific guidance

FSI Agent Governance Framework Beta - December 2025