Microsoft Turns AI Governance Into Runtime Controls Across Nine Domains

Microsoft has set out an AI governance architecture that moves the work from documented policy toward runtime enforcement, continuous evaluation, observability and audit evidence for applications and agents in production. Its structure spans nine governance domains and four functions: policy, control, visibility and proof.

The central mechanism is a continuous loop. Policies establish requirements and risk classifications; controls translate them into access and runtime rules; observability records system behavior; evaluations test quality and safety; and audit processes turn that telemetry into evidence for compliance and incident investigation.

That scope includes policy, data and model governance, observability, evaluations, security, identity and access, audit and compliance, and agent governance. Microsoft says runtime controls can extend across users, agents, models, tools, APIs, MCP servers and enterprise systems.

A gateway becomes the enforcement point

The architecture combines Microsoft Foundry with Purview, Entra ID, Defender and Azure API Management. Foundry’s AI Gateway provides runtime authentication, token limits, quotas and policy enforcement for AI workloads.

Microsoft also documents using that gateway to govern MCP tools through centralized authentication, rate limiting, IP restrictions and audit logging, without modifying MCP servers or agent code. The approach makes the gateway a shared control boundary rather than requiring each tool connection to implement those measures itself.

Agents get checkpoints, not just permissions

• Microsoft’s open-source Agent Governance Toolkit provides runtime security capabilities for autonomous agents, including policy enforcement and interception points.
• The Agent Control Specification describes checkpoints at agent inputs, model calls, tool execution and outputs.
• Higher-impact actions can be configured to require human approval at those checkpoints.

Foundry also supports built-in and custom evaluators before deployment and in production. Teams can assess quality and safety against datasets before release, then monitor production behavior afterward—placing evaluation alongside enforcement and audit rather than treating it as a one-time release gate.

Microsoft’s design is a platform-specific implementation of governance concerns also covered by the vendor-neutral NIST AI Risk Management Framework and its Generative AI Profile. The distinction is material: NIST supplies a lifecycle framework, while Microsoft ties those concerns to its own controls and operational telemetry.