Skip to content
Code To Cloud

Agentic AI Governance Assessment

Are your AI agents secure, and can you see what they're doing?

Agents act with real permissions on real data. We find out which agents you have, who owns them and what they can reach, and whether the platform they run on is set up the way Microsoft recommends.

Book a Discovery CallTake the free self-check

Last updated:

Is it for you?

Who it's for, and who it isn't.

A good fit

  • You have AI agents in pilot or production, on Microsoft Foundry, Copilot Studio or your own code.
  • Leadership, security or audit is asking what the agents can access and who is accountable for them.
  • More teams want to build agents, and you want guardrails in place before they do.

Probably not yet

  • You haven't built an agent yet. Start with the free scorecard or the Executive AI Workshop.
  • You need a compliance audit or certification. This is an engineering assessment.

Free self-check · 9 questions · no email

Score yourself in two minutes.

Answer for your own environment. You'll get a security score, a best-practice score and your gaps, each linked to the public framework it comes from.

Part 1 · Is it secure?

1. Does every agent run under its own identity, not a shared key or a person's account?

2. Is each agent limited to the tools and data it actually needs?

3. Does a person approve high-impact actions, such as payments, deletions or external emails, before an agent takes them?

4. Do you treat web pages, emails and documents an agent reads as untrusted input, with guardrails against prompt injection?

5. Could you show what a specific agent did last week, from logs and traces?

Part 2 · Is it set up the right way?

6. Do you have an up-to-date list of every agent, each with a named owner?

7. Are your Foundry and model endpoints reached over private networking rather than the public internet?

8. Do model calls go through one gateway, with quotas and usage attributed to each team?

9. Is each new agent version evaluated against a test set before it's released?

0 of 9 answered

Part 1 · Security

Is it secure?

  • Identity and access

    Whether each agent has its own identity with a named sponsor, least-privilege permissions and Conditional Access, instead of a shared key.

  • Tools, data and actions

    Which tools, MCP servers and data each agent can call, and where a person approves a high-impact action.

  • Visibility and audit

    Whether agent activity is logged, traced and alerted on, so you can answer what an agent did and why.

Part 2 · Best practice

Is it set up the right way?

  • Inventory and ownership

    Which agents exist, who owns each one, and which ones nobody is accountable for.

  • Platform foundations

    How Foundry and the Azure AI landing zone are set up: network isolation, private endpoints, managed identities, key handling and the model gateway.

  • Well-Architected for AI

    The agent platform checked against Microsoft's Well-Architected guidance for AI workloads: reliability, cost and operations as well as security.

Measured against

Public frameworks, not our opinion.

What you get

Findings you can act on.

  • Written findings for security and for best practice, with the evidence behind each one.
  • A prioritized list of what to fix first, in the order to do it.
  • A working session where we walk your team through the findings.

How it runs

From first call to findings.

  1. 01

    Discovery call

    Thirty minutes on what you run and what's worrying you.

  2. 02

    Scope agreed in writing

    We confirm what's in and out, and the fixed fee, before any work starts.

  3. 03

    Assessment

    We review security and best practice against the frameworks on this page.

  4. 04

    Readout and next step

    We walk through the findings. Fixing them with us is your choice.

FAQ

Questions about the Agentic AI Governance Assessment.

What is an Agentic AI Governance Assessment?

A fixed-fee review of the AI agents you run and the platform they run on. On security, it covers agent identity and access, the tools and data each agent can reach, and logging and audit. On best practice, it covers agent inventory and ownership, how Foundry and your Azure AI landing zone are set up, and Microsoft's Well-Architected guidance for AI workloads.

How is it different from the Agent Platform Readiness Review?

This assessment asks whether your agents are secure, visible and set up the right way. The Readiness Review asks whether your agent platform can carry a second team: evaluation gates, the model gateway, cost controls and the landing zone. Many teams need both, and they can run together.

Do we need Microsoft Agent 365 or Entra Agent ID first?

No. We assess the agents you have, wherever they run. Where you already use Microsoft's agent inventory and identity tools, we check how they're set up. Where you don't, we tell you whether they would close a gap you have.

Is this the same as a security audit?

People often call it one. It is a security review of how your environment is configured and built, measured against the public frameworks named on this page. It is not a compliance audit or certification and makes no compliance, certification or data residency finding, though the findings can feed one.

Where do you work?

We're in the Calgary area and work with clients across Canada and the United States. The assessment is delivered remotely, on Mountain Time.

How much does it cost?

The Agentic AI Governance Assessment is a fixed fee, scoped on a discovery call and agreed in writing before work starts. The fee depends on the size of what's in scope.

What access do you need?

We agree the access in the written scope. We ask for read-only access wherever it's enough, and time with the people who run the environment.

Who does the work?

Each engagement has its own lead from our team of employees and specialist contractors in cloud, AI and software engineering, with the team sized to the work. Leads make the day-to-day decisions, so nothing waits on one person. Kevin Evans, the founder and a Microsoft MVP for Azure, sets the technical standards we all build to. Everything is built in your own tenant and repositories, so your team owns and extends it.

What happens after the assessment?

You decide. Some teams fix the findings themselves. Some ask us to fix them with their team, as a project. Either is a normal outcome.

Also available

Other security assessments.

Ready to find out?

Book a discovery call. We'll scope the Agentic AI Governance Assessment with you, or tell you if you don't need it yet.

Book a Discovery CallSee all services