79 FINANCIAL SERVICES better path is to scale in stages with the fourcolumn compliance concept in mind: get the contractual and documentary side right, put the in-cloud controls in place, establish operating guardrails and keep the broader resilience and compliance topics visible from day one.” For instance, rather than leaving AI agents scattered across individual teams or toolchains, Bahnemann recommends setting up an agent control plane such as Microsoft Agent 365, which provides a central registry, policybased controls, observability and role-specific oversight. Robust data governance policy and AI-specific security controls are also essential in the agentic era. By bringing layers together in familiar tools, Microsoft empowers companies to build in these measures without hampering productivity and innovation. “Productivity and protection do not have to be opposites if the platform is designed properly,” says Bahnemann. “Microsoft helps safeguard confidentiality and integrity by combining permission-aware grounding, strong identity controls, policy-driven data protection, auditability and threat protection – while still letting employees and customer-facing teams use enterprise data in productive and valuegenerating ways. “In Microsoft 365 Copilot, for instance, the architecture is built around the Microsoft 365 service boundary, Microsoft Graph grounding and permission-aware access. The system only grounds on data the user is allowed to see, and Microsoft makes sure customer prompts, responses and grounding data are not used to train foundation models. That matters a lot in financial services, because confidentiality starts with identity, authorisation and trust boundaries – not with a generic promise that AI is secure.” Further layers include Microsoft Entra with its conditional access, identity governance and agent identity concepts, and Purview, which extends data security and compliance controls into AI usage. Meanwhile Microsoft Defender adds posture management, detection, investigation and response capabilities for AI and agent environments. “Purview can extend auditing, classification, labels, data loss prevention, insider risk, e-discovery and compliance controls to AI interactions, including prompts and responses,” explains Bahnemann. “That is exactly the type of Photo: iStock/Laurence Dutton
RkJQdWJsaXNoZXIy NzQ1NTk=