Microsoft recently outlined an AI governance architecture whose core change is to move governance emphasis from policies in documents to runtime execution, continuous evaluation, observability, and audit evidence. Its stated rationale is straightforward: organizations cannot scale what they cannot control. Policies establish requirements and risk classification; controls turn requirements into access and runtime rules; observability captures system behavior; evaluation tests quality and safety; and audit turns this operational data into evidence for compliance and incident investigations.
The framework covers nine governance domains: policy, data governance, model governance, observability, evaluation, security, identity and access, audit and compliance, and agent governance. The last is especially notable: as enterprises begin putting agents into production environments, the governance object expands from static systems to intelligent agents that can make autonomous decisions, call tools, and access enterprise systems.
Implementation relies on Microsoft's existing cloud foundation. Foundry AI Gateway provides runtime boundaries for authentication, token limits, quotas, and policy enforcement, while Purview, Entra ID, Defender, and Azure API Management handle data, identity, security, and interface governance respectively. Governance does not require a rip-and-replace approach; it layers on top of an organization's existing cloud governance capabilities.
More critical to the agent ecosystem is how MCP is managed. Microsoft documents how to use the AI Gateway to centrally manage MCP tools: without modifying MCP servers or agent code, it can provide centralized authentication, rate limiting, IP restrictions, and audit logs. This means the more third-party agent tools an enterprise connects, the more it needs an intermediary layer for unified identity and policy control—rather than letting each agent operate independently.
Evaluation is also being brought into runtime. Teams can use built-in or custom evaluators before deployment to test the quality and safety of applications and agents, and they can continuously monitor behavior in production. Higher-impact operations can require human approval, while agent identity, access, activity, and workflow checkpoints are all brought under control. Policy defines the rules