Evidence class:
Blueprint
AI implementation
Moving an AI pilot into supported production
A pilot that works in a demo rarely survives contact with real permissions, real data, and a real support model. This approach takes a working pilot through identity, data boundary, governance, and handover so that a named team can run it afterwards.
What it covers
- Identity and permission model for the production workload
- Data boundary and classification before the tool is pointed at content
- Monitoring, ownership, and an escalation path
- Handover documentation written for whoever inherits it
How it would be measured
Agreed with the customer before work starts, against a baseline taken at the start rather than a figure quoted in advance.
Evidence class:
Blueprint
AI adoption
Turning licensed capability into changed work
Adoption measured by logins tells you a license was activated. This approach baselines a small number of real tasks, changes those properly with the people who do them, and reports the difference against the baseline.
What it covers
- Baseline of current use before anything changes
- Task selection with the teams that own the work
- Guidance written in the customer's own context
- Internal champion support so the change outlives the engagement
How it would be measured
Change against the pre-engagement baseline for the specific tasks in scope. Outcomes depend on the customer's users and processes, so no figure is promised in advance.
Evidence class:
Blueprint
AI security
Security review before an AI rollout
AI tooling inherits the permissions that already exist. This approach reviews identity, access, and oversharing first, and puts the remediation in a priority order the organization can actually work through.
What it covers
- Entra identity and Conditional Access review
- Permission and oversharing analysis across the collaboration estate
- Defender coverage for the surfaces AI use introduces
- Prioritized remediation plan with dependencies stated
How it would be measured
Findings closed against the prioritized plan, and the exposure removed, rather than a risk score.
Evidence class:
Blueprint
Microsoft Purview and information protection
A labeling scheme with thirty labels is a labeling scheme nobody applies. This approach starts from the handling obligations that actually exist, keeps the scheme small enough to be used, and automates what can be automated.
What it covers
- Obligation mapping before any label is designed
- A label set small enough that people use it correctly
- Automatic labeling and data loss prevention where the signal is reliable
- Review of what the labels are doing once real content is flowing
How it would be measured
Coverage of the content that carries a handling obligation, and the rate at which labels are applied correctly in normal use.
Evidence class:
Blueprint
Microsoft 365 governance
Governance for a Microsoft 365 estate that grew on its own
Most estates were not designed, they accumulated. This approach establishes ownership, lifecycle, and access review for teams, sites, and guest identities, and puts a repeatable process behind each one.
What it covers
- Ownership and lifecycle for teams and sites
- Guest identity review and expiry
- Access review on a defined cycle
- Provisioning that keeps the standard in place going forward
How it would be measured
Workspaces with a named accountable owner, and stale guest access removed on the agreed cycle.
Evidence class:
Blueprint
Agent governance
Governing agents that can act, not only answer
An agent that can take an action needs a registered owner, a defined boundary, and a human seam at the point where it would change something. This approach puts those in place before the agent is available to users.
What it covers
- Agent inventory with a named owner for each entry
- Permitted actions and the data each agent may reach
- Approval seams for actions that change state
- Review of what agents actually did, on a set cycle
How it would be measured
Registered agents with an owner and a documented boundary, and approval seams present on every state changing action in scope.
Evidence class:
Blueprint
Secure Copilot readiness
Copilot readiness without a rushed rollout
Copilot surfaces what a user could already have found, faster. This approach establishes what that means in the specific tenant, fixes the exposure that matters, and only then enables the capability for a defined group.
What it covers
- Oversharing analysis across SharePoint, OneDrive, and Teams
- Sensitivity labeling coverage for the content in reach
- Licensing review against the intended use
- A staged enablement plan with a defined first group
How it would be measured
Exposure found and closed before enablement, and the enablement stages completed as planned.
Evidence class:
Blueprint
Azure optimization and modernization
Azure cost and modernization decisions made on evidence
A read-only assessment establishes the baseline, evidence-backed recommendations are validated by a specialist, the customer approves the exact plan, and the result is verified against the baseline afterwards.
What it covers
- Estate discovery and cost baseline from Microsoft-native sources
- Rightsizing, idle and orphaned resources, and commitment options
- Modernization decisions per workload, with the reasoning recorded
- Controlled remediation and realized-value verification
How it would be measured
Realized value verified against the baseline established at the start. Savings depend entirely on the customer estate, so no figure is quoted in advance.
Read how this is delivered for Azure cost and modernization decisions made on evidence
Evidence class:
Blueprint
AI-enabled managed operations
AI-assisted analysis inside a managed operation
Automated analysis is used to surface candidates and draft explanations. A specialist validates them and the customer approves anything that changes production. The automation does not act on its own.
What it covers
- Signal collection from Microsoft-native sources
- Candidate findings raised with the evidence attached
- Specialist validation before anything reaches the customer
- Customer approval before any production change
How it would be measured
Findings validated and closed, and the time between a signal appearing and a decision being made.
Evidence class:
Blueprint
ICM-informed Microsoft 365 implementation
Selected principles from the Interpretable Context Methodology applied to Microsoft 365 delivery: readable context, recorded provenance, reviewable intermediate work, and an explicit human approval point. The methodology was developed by others and we say so plainly.
What it covers
- Context that a reviewer can read without a walkthrough
- Provenance for the decisions and the material behind them
- Intermediate work kept reviewable rather than discarded
- A human approval point before a change takes effect
How it would be measured
Whether a reviewer who was not present can reconstruct why a decision was made, from the record alone.
Read how this is delivered for ICM-informed Microsoft 365 implementation
