Who answers for the AI agent your team built last week?

Johannesburg, 14 Oct 2026

Doug Morrison, Head of Modern Workplace at Braintree.

A simple AI agent can now be built in an afternoon. Agent Builder in Microsoft 365 Copilot, Microsoft Copilot Studio and Microsoft Foundry have put agent creation within reach of almost anyone in the business, not only developers.

While this is useful, it also means agents are arriving faster than most organisations are deciding how to govern them. The hard questions come after the build: whose permissions the agent uses, what data it can reach, who owns it next year, what the log records and whether it earns its keep.

The first decision is scale. Microsoft's Copilot Studio guidance describes a zoned approach to governance [1]. Personal and team agents built on content the maker can already see stay private and need little ceremony. Agents built for other teams go through an IT-managed review. Mission-critical agents are built by professional developers with the organisation's full lifecycle and security controls. Every agent lands in one of these zones, whether anyone planned it or not, and the zone sets how much of what follows applies.

The decision that catches most organisations out is data. A Copilot Studio agent grounded in SharePoint answers on behalf of the person chatting to it and surfaces only content that person is permitted to open [2]. That is a sensible default, but it means the agent is only as safe as the permissions underneath it. If a site holding salary data is shared with everyone, an agent grounded on that site will answer salary questions for everyone. The agent has done nothing wrong. It has simply made an old oversharing problem easy to find.

Are overshared permissions turning your AI agents into data leaks? Book an AI agent scoping call with Braintree to audit your content permissions and establish secure data boundaries before launch.

Microsoft gives administrators the means to deal with this before launch. An agent searches only the SharePoint location it is pointed at, never parent or sibling sites. SharePoint Advanced Management reports identify sites that may hold overshared or sensitive content, and Restricted Content Discovery keeps a site out of organisation-wide discovery while its access is put right [3]. Sensitivity labels need planning alongside the agent, because an agent cannot read files that a label encrypts.

Agents that act on their own need an identity of their own. Since May 2026, Copilot Studio creates a Microsoft Entra Agent ID for each new agent: a sign-in identity that IT can see, restrict and switch off much like a staff account, with an optional sponsor who is accountable for it [4]. Ownership is where the gaps usually appear. When the person who built a shared agent leaves and their account is deleted, the agent becomes ownerless until an administrator assigns a new owner [5].

Before an agent is shared beyond the person who built it, five decisions should be written down:

Zone. Is this a personal, team or organisation-wide agent, and does its review match that scale?
Identity. Does the agent act as the user or as itself? Which connectors can it call, and who is its named sponsor?
Data. What can it reach, and is that content correctly permissioned and labelled before anyone asks it a question?
Lifecycle. Who owns it? How does it move from development to test to production, and when is it reviewed for retirement?
Audit and value. What does the log capture, how long is it kept, and which business number is the agent expected to move?

Audit deserves attention before it is needed. Copilot Studio logs administrative changes such as publishing, sharing and authentication updates to Microsoft Purview by default, and records user interactions as events with a conversation reference [6]. The conversation text itself is retrieved through a separate tool, some channels are excluded from logging, and retention is a setting the organisation chooses. If an agent gives a wrong answer or exposes something it should not, that record is the evidence, so compliance and legal owners should settle what it captures before launch.

Is your AI agent compliant with South African privacy laws? Book an AI agent scoping call with Braintree to bring your information officer into the loop and align data retention with local regulatory standards.

Value is the last decision and the easiest to fudge. Microsoft's own guidance warns against reporting activity, such as sessions and user counts, as value, and against what it calls "the time-savings trap" [7].

Its Viva Insights formula defaults to an hourly rate of USD 72 taken from United States labour data, which a South African business should replace with its own fully loaded cost before the figure reaches a board pack. A 90-day review against a baseline, with the sponsor present, tells the business whether to scale the agent or retire it.

For South African organisations there is a further reason to decide early. An agent that reads or acts on personal information is processing it, and under POPIA, the organisation remains the responsible party. The sponsor, the data scope and the retention setting are where that accountability is recorded in practice, so the information officer belongs in the conversation. Most of the controls involved already sit in existing Microsoft 365 and Power Platform licences. The work is in making the decisions and writing them down.