Shadow AI at the first gate
Hartwell Trust Bank checks an outside AI use case with fictional data.
Coming
See every demonstrationGOVERNED AI BRIEFING
One hour to choose the first governed AI question.
AI governance decisions are scattered across security, legal and the business, and the first technical engagement starts with three different expectations. In one hour we review the concern you bring and walk through the Microsoft options at a high level. You leave with one named decision owner and one scoped question for the first pilot. No access to your systems, no software, no fee.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- You supply a non-sensitive description of the concern and name who takes part in the decision.
- In the hour we review the concern, discuss the Microsoft governance options at a high level and choose a single follow-up question.
- Before the hour closes, a named owner and the follow-up question are verified with you.
- You receive one written pilot-fit recommendation naming the owner, the prerequisites and the first pilot question.
THE PROBLEM
Why do AI governance engagements start badly?
Because the sponsor wants a policy, security wants an inventory, legal wants a defensible position and the business wants the tool switched on. Without the hour, the first technical week is spent discovering that. A scoped question and a named owner, agreed before any access is requested, is what the hour produces.
The briefing is the entry conversation to the Governed AI pilots: Shadow AI, Client Data and AI, and Confidential Sites. It names which one fits, or that none does yet, and who decides.
THE MICROSOFT INSIGHT
Where do the controls you will choose between live?
Inside the Microsoft 365 you already run. Microsoft Agent 365 is the one place that observes, governs and secures agents, through the Microsoft 365 admin center, Microsoft Entra, Microsoft Purview and Microsoft Defender. So the question is which control to test first, not which platform to buy.
Microsoft Agent 365 is the control plane that observes, governs and secures agents built on Microsoft platforms or acquired from third parties, through the Microsoft 365 admin center, Microsoft Entra, Microsoft Purview and Microsoft Defender. (Microsoft Learn, checked Oct 31, 2026)
Choose the first question in an hour and the pilot starts with one owner. Skip it and the pilot starts with a meeting about who the owner is.
THE METHOD
What happens in the hour?
A review, a high-level walk through the options, one chosen question and one written recommendation.
- Before: you send a non-sensitive description of the concern and the names of the decision participants.
- In the hour: we review the concern and discuss the Microsoft governance options without opening anything in your Microsoft 365 (your tenant).
- Before close: a named decision owner and one follow-up assessment question are verified with you.
- After: you receive one written pilot-fit recommendation naming the owner, the prerequisites and the first pilot question.
THE FIRST RUNG
Which pilot comes next?
One of three four-week pilots, each read-only until a decision is signed. Shadow AI: which tools are in use, and a tested block. Client Data and AI: a traced data path and a tested Purview control. Confidential Sites: site access and file protection decided with the owners.
Each pilot has its own page on this site with the weeks, the deliverables and what it is not. The briefing's recommendation names the one that fits the question you chose, and the prerequisites it needs.
WHAT IT IS NOT
Does the briefing prove compliance?
No. It reviews nothing in your tenant, implements nothing, gives no legal advice and makes no claim about compliance. It is a free entry conversation; a later technical assessment needs its own scoped approval.
In an acquisition the same hour names the integration decision owner before any tenant access is requested.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold one written pilot-fit recommendation with a named decision owner.
- The first pilot question is scoped in one sentence everyone in the room agreed to.
- The prerequisites for that pilot are listed, including the licenses it depends on.
- No tenant access was requested and nothing in your environment changed.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not look inside your tenant. Microsoft Purview Data Security Posture Management for AI runs a weekly data risk assessment of the 100 most used SharePoint sites without activation and reports AI interactions that touch sensitive data. (Microsoft Learn, checked Oct 31, 2026) The first read-only look is the pilot's: for example Purview Data Security Posture Management for AI runs a weekly data risk assessment of the most used SharePoint sites without activation, and that report is where a Confidential Sites pilot starts.
It does not review your tenant or test a control; that is the pilot the recommendation names.
It does not produce a quote; the pilot is scoped and quoted after the briefing.
THE ONE THING TO REMEMBER
Choose the first governed AI question before anyone asks for access.
Said another way: one owner, one question, one pilot.
Said a third way: an hour spent agreeing the question saves the first week of the engagement.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
Is the briefing free?
Yes. It is an entry conversation with no tenant changes and no software purchase. It is booked through this site; its Microsoft Marketplace listing is pending.
Who should attend?
The executive sponsor and the people who take part in the decision, usually security and legal. You supply a non-sensitive description of the concern before the hour.
What do we get afterward?
One written pilot-fit recommendation naming the decision owner, the prerequisites and the first pilot question, reviewed before the hour closes.
What if none of the pilots fits?
The recommendation says so and names what would have to be true first. That is a useful hour too.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.