Skip to content

Start Here

FSI-AgentGov explains how to govern Microsoft 365 AI agents in regulated financial services environments — especially when your questions are about:

  • Who can build agents
  • Where they can run
  • What data and connectors they can use
  • How they move into production
  • What evidence should be retained

Disclaimer

This framework is provided for informational purposes only and does not constitute legal, regulatory, or compliance advice. See full disclaimer.

Is this the right framework for you?

Use this framework if you are:

  • an AI governance lead, Power Platform Admin, compliance lead, security architect, auditor, or business sponsor responsible for Microsoft 365 AI agents
  • deploying Microsoft Copilot Studio, Agent Builder, or related custom agent capabilities at a bank, insurer, broker-dealer, or similar US financial institution
  • trying to decide what governance controls should exist before agents move from experimentation into broader use
  • looking for a structured path from governance strategy to technical implementation

Start somewhere else if you are:

  • governing Microsoft 365 Copilot in Word, Excel, PowerPoint, Outlook, Teams, Copilot Chat, or Copilot Pages — see FSI-CopilotGov
  • looking for prompt engineering guidance or end-user productivity tips
  • working outside regulated US financial services
  • trying to learn basic product capabilities before thinking about governance — start with Microsoft Learn

Your first 15 minutes

Run the Readiness Assessment — evaluates your organization's current state across all 79 controls and generates a personalized remediation roadmap. Runs entirely in your browser; nothing uploaded. Or read on to orient yourself first.

What you will need before you start

A structured rollout requires both licensing and the right people in place.

Licensing: Most controls rely on a mix of Copilot Studio, Power Platform, and Microsoft 365 security/compliance SKUs. See the License Requirements Matrix for the full per-control breakdown.

Common license requirements — expand for details
  • Copilot Studio is the baseline for agent development across the framework.
  • Power Platform Premium is commonly needed for managed environments, environment governance, and related PPAC controls.
  • Microsoft 365 E5 or Microsoft Purview Suite is commonly needed for Purview-heavy controls such as audit logging, data retention, eDiscovery, and Communication Compliance.
  • Microsoft 365 E5 Security or full Microsoft 365 E5 may be needed when controls depend on Microsoft Defender for Cloud Apps or Microsoft Sentinel.
  • SharePoint Advanced Management is commonly needed for SharePoint governance controls in Pillar 4.

People and sponsorship:

  • Confirm who holds Power Platform Admin, Purview Compliance Admin, Entra Global Admin, SharePoint Admin, and Exchange Online Admin roles — see Role Catalog and Operating Model.
  • Designate an AI Governance Lead and secure executive sponsorship before starting structured implementation.

Why FSI-AgentGov exists

Microsoft product documentation explains how to create and configure agents. It does not provide a complete financial-services-focused operating model for:

  • governing who can create, publish, and share agents
  • controlling environments, connectors, file handling, and data movement
  • scaling controls as agents move from personal experiments to team and enterprise use
  • collecting the evidence needed for oversight, audit, examination preparation, and recurring review

FSI-AgentGov packages those decisions into 79 controls, 316 implementation playbooks, and a three-zone governance model so teams can move from ad hoc experimentation to a more structured rollout.

What this framework helps you accomplish

If you are new to the framework, it helps you:

  • determine whether an agent belongs in Zone 1, Zone 2, or Zone 3
  • identify which foundational controls to implement first
  • route to the right framework, control, or playbook page based on your role and scenario
  • support risk, compliance, and operational discussions with a common governance reference point

Scenario guide — where should I go?

Your Situation Where to Start
"We need to decide whether a new agent belongs in personal, team, or enterprise governance." Zones and Tiers + Agent Lifecycle
"We need to control who can create, publish, or move agents into production." Control 1.1 - Restrict Agent Publishing + Control 2.1 - Managed Environments + Control 2.15 - Environment Routing
"We need to govern connectors, file handling, and data boundaries." Control 1.4 - Advanced Connector Policies + Control 1.5 - DLP and Sensitivity Labels + Control 1.26 - File Upload Restrictions
"We need step-by-step implementation guidance, not just policy statements." Quick Start Guide + Playbooks Overview + Phase 0: Governance Setup
"We need evidence for governance, audit, or compliance review." Regulatory Framework + Evidence Standards + Audit Readiness Checklist
"We are not sure whether AgentGov or CopilotGov is the right starting point." Relationship to FSI-CopilotGov

Your first 15 minutes

Orient (10 minutes)

  1. Read the Executive Summary to understand the governance problem and the operating model.
  2. Confirm scope with Relationship to FSI-CopilotGov if your organization also uses Microsoft 365 Copilot.
  3. Review Zones and Tiers to understand the three-zone classification model.

Act (5 minutes)

  1. Run the Readiness Assessment to see where your organization currently stands — or classify one agent into a zone using the Zone Decision Matrix as your first concrete action.

Find what you need

Layer What it answers Who uses it
Framework Why governance matters, how zones work, what regulations apply, and how accountability is structured Executives, compliance, governance leads
Controls What technical and procedural controls should be in place Architects, admins, control owners
Playbooks How to implement, verify, and troubleshoot the controls Hands-on implementers and operations teams

Next step

If you want the shortest path from orientation to action, continue to the Quick Start Guide. If you first need to confirm whether this framework or the Copilot framework applies to your scenario, read Relationship to FSI-CopilotGov.