Module 19: Admin, Security, Privacy, and Governance
Lesson 19.5: Safe Agent Governance
Lesson Promise
Govern built-in, installed, custom, and Copilot Studio agents through lifecycle controls.
Real-World Scenario
Users can discover agents, builders can create agents, and admins need to know what data sources and actions each agent can use.
Core Concept
Agents can extend Copilot with knowledge, search, actions, connectors, and APIs, so they require review beyond ordinary prompt training.
Admin governance includes availability, approval, blocking, deployment, data-source review, actions, terms, privacy statements, and ownership.
Agent governance is lifecycle work: request, review, publish, monitor, update, retire.
Step-By-Step Workflow
- Inventory available, installed, shared, and custom agents.
- Review data sources, actions, permissions, terms, privacy statement, and owner.
- Define approval criteria for organization-published agents.
- Deploy, block, remove, or restrict agents by user or group as needed.
- Monitor usage, feedback, incidents, and updates.
- Retire agents that are stale, ownerless, risky, or unused.
Prompt Lab
Bad Prompt
Let teams use agents.
Better Prompt
Create approval rules for agents based on data sources, actions, permissions, risk, owner, and business purpose.
Expert Prompt
Build a safe agent governance framework. Include agent inventory, request intake, approval criteria, data-source review, action review, permissions, privacy and terms review, deployment rules, owner responsibilities, monitoring, incident handling, update review, and retirement criteria.
Hands-On Exercise
Design an agent approval checklist for internal agents.
Deliverable
An agent governance lifecycle checklist.
Governance Review Checklist
Common Mistakes
- Assuming Copilot can see everything in the tenant instead of respecting user access boundaries.
- Buying licenses before cleaning up high-risk sharing and ownerless content.
- Ignoring sensitivity labels, retention, audit, DLP, and Purview workflows.
- Treating agent approval as a one-time app decision instead of lifecycle governance.
- Training users on prompts without training them on sources, privacy, and review.
Quiz / Checkpoint
Why are agents different from ordinary prompts?
Agents can bring knowledge, data sources, actions, connectors, APIs, sharing, and lifecycle risk.
Official Sources To Verify
Want your AI product explained to a large AI-native audience?
Kingy AI helps AI companies turn complex products into clear, useful YouTube videos that drive awareness, product understanding, demos, clicks, and search visibility.
