Before an agent goes live, it is clear who is in control of it.
When we talk to companies, the first question is rarely what the agent can do. More often it is what the agent is allowed to do, and who is keeping watch. Quite right too. We answer with roles, policies and controls: managed identities with least-privilege access, classification with Microsoft Purview, an inventory of every agent, a log of every action, and a kill switch that actually works.
What really matters
Every agent gets an ID
Each agent has its own managed identity, issued and logged centrally and revocable at any time. No shared accounts, no shadow access, and no forgotten agents whose owner nobody can name a year from now.
Protection before anything is touched
We classify data and enforce protection policies before an agent ever sees it. All of this is documented and traceable, including for your data protection officer and works council. We are happy to bring both to the table early on.
Order that still holds next year
We set up the inventory, logging, kill switch and regular reviews using the tools of your own platform. So twelve months from now you will still know which agents are running, what they are allowed to do and who is accountable for them.
How we approach it together
Target design, inventory, security baseline
We record which agents exist or are planned and which data stores they touch. And we clarify the requirements for data protection, IT security and employee co-determination.
Policies as code, one control plane
Structure and policies are defined as code, along with the inventory, identities, classification, keys and secrets. Everything sits in your environment and under your control.
Your team runs the controls itself
Operating standards and regular reviews keep good practice alive. We equip your team to handle this on its own, and if you wish, we continue to support the reviews.
Eight questions that show where your use of AI is exposed
Who is allowed to build agents? What can they see? And how do you stop them? Tick what you already have in place, and we will send you a traffic-light rating for each area plus the three steps that will make the biggest difference. Free of charge.
What you get
Where the scope is clear from the outset, we work to a fixed price; ongoing operations are billed as a monthly flat fee. We discuss figures in person after the assessment, when both sides know what is involved.
Governance Check
Getting started · Fixed price
- which agents exist and which are planned
- which data stores they touch
- data protection and works council requirements
- target design and sequence
Governance Baseline, small
Delivery · Fixed price
- one environment, up to five agents
- policies as code
- inventory and control plane
- identities and classification
Governance Baseline, large
Delivery · Fixed price
- multiple environments or tenants
- up to twenty agents
- keys and secrets
- operating standards and reviews
Review Support
Operations · Quarterly fee
- inventory checked
- access rights and logs analysed
- policies updated
- report for data protection and internal audit
Some figures
Our toolset: Microsoft Entra, Microsoft Purview, Defender for Cloud, Azure Policy, Key Vault, Log Analytics, Sentinel.
For companies of every size
Governance sounds like something for large corporations. In mid-sized businesses, though, it often matters more, because nobody there looks after it full-time. The small baseline covers one environment and up to five agents. After that, even with 90 people, someone knows exactly what each agent is allowed to do.
Fault-report agent for property managers
Every fault report is matched to its property before anyone reads it. How it works at a property management firm with 9,000 units.
A single maintenance inbox covers 9,000 residential and commercial units, and by morning it holds 120 reports. A radiator is leaking on the third floor; a lift has stopped on the ground floor. Then there are screenshots from the tenant portal and phone calls that reception passes on as notes. Four property managers read every one of them. For each, they look up the unit, the lease and the contractor on the framework agreement for that trade, then place the order by email. Anyone who reports a fault at the weekend hears nothing back until Tuesday.
The targets we set for it:
How the agent handles it, step by step, with approvals and figures:
See the solutionFrequently asked questions
We don't have any agents yet. Do we still need this?
With us, the baseline is the first phase of every move into production, so you don't need to book it separately. As a standalone project, it is aimed at companies that already have agents in-house (often more than they realise) or that want to put things in order first.
What will our works council say?
In our experience, a good deal less if it is involved early. The inventory, logs and kill switch answer precisely the questions that would otherwise be left hanging. And we document everything to a standard that will stand up to an audit.
Can you also secure agents built by others?
Yes, provided a foundation is in place first. We are happy to run agents built by others once a governance baseline is in place.
Which Microsoft tools do you use?
Entra for identities, Purview for classification and protection, Defender and Sentinel for threat detection, and Azure Policy to enforce policies as code. Everything sits in your environment; nothing sits with us.
Shall we talk about your first process?
In a Short Assessment we sit down with your business team and IT and look at one process together. You leave with a clear target design and an effort estimate we stand behind. Free of charge.
