Microsoft Copilot Studio — AGS v2.2 Compliance

Executive Summary

Microsoft Copilot Studio achieves a 26% estimated AGS v2.2 compliance score. The platform demonstrates solid foundational governance through operational boundary enforcement, human oversight mechanisms, and behavioural consistency controls. Microsoft's enterprise infrastructure provides a strong base for identity management and audit capabilities. However, significant gaps remain in multi-agent collusion detection, emergent capability monitoring, and temporal attack defence. The platform's primary governance orientation is toward enterprise workflow automation rather than adversarial AI agent governance, leaving advanced dimension groups largely unaddressed.

A: Mandate

40%

B: Integrity

32%

C: Identity

28%

D: Accountability

36%

E: Compliance

32%

F: Adversarial

8%

G: Boundary

8%

H: Alignment

16%

I: Emergence

0%

J: Infrastructure

32%

Key Strengths

AG-01

Operational Boundary Enforcement

Copilot Studio enforces clear operational boundaries through topic-level controls, DLP policies, and connector restrictions that limit agent scope.

Score: 2 / 3

AG-19

Human Oversight Architecture

Strong human-in-the-loop capabilities with approval workflows, escalation triggers, and configurable handoff to live agents.

Score: 2 / 3

AG-22

Behavioural Consistency Verification

Topic-based conversation design ensures consistent agent behaviour across sessions with deterministic flow control.

Score: 2 / 3

Critical Gaps

AG-28

Collusion Detection

No multi-agent collusion detection framework. No mechanisms to identify coordinated adversarial behaviour across agent instances are evidenced in public documentation.

Score: 0 / 3 — Structurally Absent

AG-41

Emergent Capability Detection

No emergence monitoring. Tracking or flagging of unexpected capability development in deployed agents is not evidenced in public documentation.

Score: 0 / 3 — Structurally Absent

AG-44

Long-Horizon Attack Detection

No temporal attack detection. Identification of slow-moving adversarial strategies executed over extended timeframes is not documented.

Score: 0 / 3 — Structurally Absent

Recommendations

Implement cross-domain pattern recognition (AG-02) to detect combined action sequences across Power Platform connectors and Copilot agent workflows.
Add delegated authority governance (AG-09) for Power Automate agent chains, ensuring permission inheritance is tracked and auditable.
Build governance layer layer for transaction structuring detection (AG-25), critical for enterprise deployments handling financial operations.
Develop an adversarial testing programme for AG-05 verification, incorporating red-team exercises against deployed Copilot agents.
Submit for independent AGS verification to replace estimated scores with certified compliance ratings.

Full Dimension Assessment

Dimension	Name	Category	Score
A — Mandate & Action Governance (AG-01 – AG-05)
AG-01	Operational Boundary Enforcement	Evidenced	2
AG-02	Cross-Domain Activity Governance	Not Documented	0
AG-03	Adversarial Coordination Detection	Not Documented	0
AG-04	Mandate Scope Control	Evidenced	1
AG-05	Action Authorisation Verification	Evidenced	1
B — Integrity & Configuration Governance (AG-06 – AG-10)
AG-06	Record Integrity Verification	Evidenced	1
AG-07	Governance Configuration Control	Evidenced	1
AG-08	Deployment Integrity Verification	Evidenced	1
AG-09	Delegated Authority Governance	Not Documented	0
AG-10	Configuration Drift Detection	Not Documented	0
C — Identity & Access Governance (AG-11 – AG-15)
AG-11	Agent Identity Verification	Not Documented	0
AG-12	Credential Lifecycle Management	Evidenced	1
AG-13	Privilege Escalation Prevention	Evidenced	1
AG-14	Inter-Agent Authentication	Not Documented	0
AG-15	Namespace Isolation	Evidenced	1
D — Accountability & Oversight (AG-16 – AG-20)
AG-16	Decision Audit Trail	Evidenced	1
AG-17	Multi-Party Authorisation	Evidenced	1
AG-18	Outcome Attribution	Evidenced	1
AG-19	Human Oversight Architecture	Evidenced	2
AG-20	Purpose-Bound Operation	Not Documented	0
E — Compliance & Agent Governance (AG-21 – AG-25)
AG-21	Regulatory Compliance Verification	Evidenced	1
AG-22	Behavioural Consistency Verification	Evidenced	2
AG-23	Resource Consumption Governance	Evidenced	1
AG-24	Output Validation	Evidenced	1
AG-25	Financial Transaction Governance	Structurally Absent	0
F — Adversarial Defence (AG-26 – AG-30)
AG-26	Prompt Injection Defence	Not Documented	0
AG-27	Governance Override Resistance	Not Documented	0
AG-28	Collusion Detection	Structurally Absent	0
AG-29	Data Poisoning Defence	Not Documented	0
AG-30	Social Engineering Resistance	Not Documented	0
G — Boundary & Scope Governance (AG-31 – AG-35)
AG-31	Capability Boundary Enforcement	Not Documented	0
AG-32	Scope Creep Detection	Not Documented	0
AG-33	Environmental Boundary Control	Not Documented	0
AG-34	Cross-System Propagation Control	Structurally Absent	0
AG-35	Autonomy Level Governance	Structurally Absent	0
H — Alignment & Reasoning Governance (AG-36 – AG-40)
AG-36	Value Alignment Verification	Not Documented	0
AG-37	Reasoning Transparency	Not Documented	0
AG-38	Human Control Responsiveness	Evidenced	1
AG-39	Deception Detection	Structurally Absent	0
AG-40	Goal Stability Verification	Structurally Absent	0
I — Emergence & Evolution Governance (AG-41 – AG-45)
AG-41	Emergent Capability Detection	Structurally Absent	0
AG-42	Collective Intelligence Governance	Structurally Absent	0
AG-43	Self-Modification Prevention	Structurally Absent	0
AG-44	Long-Horizon Attack Detection	Structurally Absent	0
AG-45	Evolutionary Pressure Monitoring	Structurally Absent	0
J — Infrastructure & Operational Governance (AG-46 – AG-50)
AG-46	Infrastructure Dependency Mapping	Structurally Absent	0
AG-47	Cross-Jurisdiction Compliance	Evidenced	1
AG-48	Model Provenance Tracking	Evidenced	1
AG-49	Operational Continuity	Evidenced	1
AG-50	Physical Impact Governance	Structurally Absent	0

Sources

Sources: Microsoft Copilot Studio documentation, Microsoft Purview documentation, Azure Policy documentation, Power Platform admin centre documentation, Agent 365 product announcements, Microsoft Ignite 2025 sessions. Documentation reviewed April 2026.
Methodology: Scores estimated from publicly available documentation only. No proprietary or non-public information was used. Platforms are invited to submit for independent verification to receive a verified score.