Who Owns the Agent?

The platform can verify what the agent did. Only you can verify what it was allowed to do.

An examiner sits down across from your team and asks one question about an AI agent running in your tenant: who authorized it, and what exactly was it authorized to do? You have the audit trail. You have the agent's identity, its logs, its alerts. What you do not have is the answer, because the answer was never written down.

The Microsoft agent stack, walked the way an examiner would walk it. Microsoft 365 Copilot. Copilot Studio. Power Platform. Microsoft Foundry. Agent 365. Microsoft Entra Agent ID. Microsoft Purview. At every layer this book separates three things enterprises routinely confuse: what the platform can prove, what only your organization can prove, and the short written record that stands between them.

The gap nobody has closed. One agent invokes another. That one calls a third. The approval granted on day one still covers all of it, and nobody has revisited it since. This is the Chain Authorization Gap, and the book gives you the instruments to find it in your own environment before someone else does.

Frameworks built for the person who signs, not the person selling. Intent Architecture. The Authorization Coverage Lifecycle. The Disposition Protocol. Tenant Agent Reconciliation. The Accountability Assumption. Each one arrives as the answer to a documented failure rather than as a diagram, and each is built to survive an examination rather than a demo.

Appendix A is one page. The Agent Authorization Record is completed once per deployed agent and retained as evidence, which is what separates having an answer from starting a search. Forty minutes of writing, or four months of remediation. It is the same document either way.

For the people who carry the risk. CISOs, CTOs, VPs of digital transformation, enterprise architects, and compliance and risk officers at banks, insurers, healthcare systems, and government contractors. Agentic and autonomous deployments are mapped against the obligations you already carry under the NIST AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act, and against the shadow AI that arrived without an intake step. No vendor marketing. No futurism. Every Microsoft capability claim is verified against published documentation and dated. Every incident comes from a named primary source.

The question is not whether your agents are governed. It is whether anyone could prove it on demand.