StructureClerk

Governing Microsoft Copilot Studio agents: authority and audit

Copilot Studio lets anyone build agents without code across the productivity ecosystem. The easier the agent is to create, the more urgent the question: who checked that what the agent shares is allowed to be shared?

mcprestLire en français

Copilot Studio lets teams build conversational and autonomous agents without writing code, wired into workspace data: documents, email, team sites, automation flows. Its strength is ease — any team can assemble an agent that answers, summarizes, shares and triggers actions.

That ease moves the risk. The ecosystem's access controls decide which documents the agent can read; they do not decide whether the sharing itself is permitted: an HR assistant attaching an employee file to a reply, a team agent posting an excerpt of a medical document to a wider channel — the access was legitimate, the action not necessarily.

The integration scenario

Copilot Studio can call tools and HTTP connectors, and the ecosystem has adopted the Model Context Protocol: both paths lead to the same place. Either the agent calls our MCP tool authority_decide before acting, or the automation flow that performs the action makes an HTTP call to the decision endpoint. Either way, nothing to install in your tenant.

  1. 1

    Generate your organization's profile

    The free assessment (start here) produces your policy profile — jurisdictions, sector, data categories. That profile personalizes the decisions your agents receive.

  2. 2

    Wire in the decision tool

    Via MCP: add our server (Streamable HTTP transport) and expose authority_decide to the agent. Via HTTP: add an action calling the decision endpoint in the flow that precedes the share or send.

    curl -X POST https://structureclerk.ca/api/v1/authority/decide \
  -H 'Authorization: Bearer $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"agent":{"id":"copilot-hr-assistant","autonomy_level":2},"action":{"type":"share.document","data_categories":["personal"]},"context":{"jurisdictions":["CA_QC"],"sector":"health"}}'
  3. 3

    Describe the action as metadata

    Action type (share.document, send.customer_email, export.customer_record), data categories, jurisdictions. Never the document content: the engine decides on metadata, which is both faster and more respectful of your data.

  4. 4

    Wire the four verbs

    ALLOW continues the flow. APPROVE inserts a human approval step. DENY stops the action and logs the reason. ESCALATE notifies compliance. The evidence identifier is recorded with the flow run.

The decision contract

POST https://structureclerk.ca/api/v1/authority/decide
{
  "agent": { "id": "copilot-hr-assistant", "autonomy_level": 2 },
  "action": {
    "type": "share.document",
    "data_categories": ["personal"]
  },
  "context": { "jurisdictions": ["CA_QC"], "sector": "health" }
}
// →
{
  "decision": "APPROVE",
  "reason": "sensitive_data_regulated_sector",
  "confidence": 0.94,
  "evidence_id": "ev_51dd…a2f8"
}
An HR document share in a regulated sector: human validation required, evidence attached.

The decision is advisory — StructureClerk decides, your infrastructure enforces. A low-autonomy agent and a fully autonomous one do not receive the same answers: the autonomy level is part of the contract.

DecisionEffect in your flows
ALLOWThe flow continues, evidence is recorded
APPROVEA human approval step is inserted before the action
DENYThe action stops, the reason is logged
ESCALATECompliance is notified, the action waits

An audit trail your auditors can verify

Every decision leaves Ed25519-signed evidence, chained to the previous one. When internal audit or a customer asks how your productivity agents are governed, you produce evidence verifiable on our verification page — publicly, without an account.

And the engine is jurisdictional: the same document share can pass in one jurisdiction and require validation in another, because the law applying to the recipient differs. That is the dimension no internal access control carries.

+How do I audit Copilot Studio agent actions?

By inserting an authority decision before each sensitive action: every call produces Ed25519-signed, timestamped, chained evidence carrying the rule applied and the reason. The evidence verifies publicly, without an account — an audit trail a third party can rely on.

+Does Copilot Studio support MCP?

The Microsoft ecosystem has adopted the Model Context Protocol, now the agent-integration standard under Linux Foundation governance. Our MCP server exposes the authority_decide tool over Streamable HTTP — and if your setup prefers a direct HTTP call, the REST endpoint renders the same decision.

+Aren't sensitivity labels enough?

They classify the document — and that is necessary. But they know nothing about your regulatory obligations: a correctly labelled document can still be shared to a recipient or jurisdiction where that sharing requires an assessment. Classification and authority are two complementary layers.

+Does the engine see our document content?

Never. The decision is rendered on the action's metadata: type, data categories, jurisdictions, sector, agent autonomy level. That is a design choice — the authority layer should not need an access you would then have to govern.

Start with the profile

The assessment is what personalizes the decisions your agents receive. It is free, and only needs your website address.

Other integrations