docs: enterprise review pass on Copilot Agent Standards - #41
Merged
craigthackerx merged 1 commit intoAug 24, 2026
Merged
Conversation
Two defects and four content gaps found reviewing the first edition against what an enterprise assurance review actually asks for. Defects: - The declarative agent name limit row had a mangled sentence, missing the word it turned on, so the row did not say what it meant. - The worked example section was hard wrapped at 100 characters while the rest of the document uses unwrapped paragraphs. Unwrapped it. Gaps, all of which a bank would raise before a first agent ships: - Nothing on data protection. Adds a section covering sensitivity labels on grounding data, DLP with the Microsoft 365 Copilot location, oversharing policy, retention, label inheritance into conversations, Insider Risk, Communication Compliance and eDiscovery, following Purview's own four-step order. - Nothing on tenant controls. Adds the Copilot Control System settings, the admin roles that reach them, and the point that per-agent hygiene is worthless if anyone can publish anything. - Nothing on agents you did not write. Third-party agent data handling sits outside Microsoft's agreements, which makes the publisher setting a vendor decision rather than a default. - Nothing on cost. Adds the licensing table: instructions and public grounding are free, shared tenant data meters in Copilot Credits for unlicensed users, and governance carries its own licence floor. Also adds a "when an agent misbehaves" table, since blocking, disabling the identity, revoking access and reverting the artefact are four levers with four different latencies and that is not the moment to work it out. Anti-patterns, adoption checklist, verification table, known gaps and See Also updated to match. All five new sources verified live with their own page dates recorded.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
craigthackerx
deleted the
docs/copilot-agent-standards-enterprise-review
branch
August 24, 2026 13:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review pass on the first edition, against what an enterprise assurance review actually asks for.
Defects fixed
namerow read "an agent between the two packages fine and cannot be built in the form as named", which is missing the word it turns on and does not parse.Gaps closed
The first edition covered how to build an agent well and said nothing about the four things a regulated organisation asks before one ships.
Also adds a when an agent misbehaves table. Blocking, disabling the identity, revoking the access package and reverting the artefact are four levers with four different latencies, and an incident is not the moment to work that out.
Anti-patterns (+4), adoption checklist (10 → 14 items), verification table, known gaps and See Also all updated to match.
Verification
ms.date.npm run lint,npx tsc --noEmit,npm run buildclean.Not done
No diagram. Three of the eight standards docs carry one and five do not, so it is not a house requirement, and the diagrams-as-code pipeline regenerates every SVG in CI. Happy to add one if you want the shipping pipeline drawn.