AI Governance Intelligence Notes | Sougata Roy

Skip to main content

Sougata RoyResearch on enterprise AI

Research areas

Navigate the main governance themes behind enterprise AI deployment.

Accountability & AgentsWho is responsible when an AI agent makes a wrong decision at scale. The organizational design layer most enterprises have not built.
Regulatory ComplianceWhat the EU AI Act, NIST AI RMF, and sector-specific requirements mean for organizations running AI on Microsoft 365.
Data ProtectionClassifying, labeling, and monitoring sensitive data before AI can reach it. What your organization needs in place before agents go live.
AI FoundationsGovernance architecture and access controls before agents proliferate across your Microsoft environment.
The Microsoft Control PlaneHow Microsoft is becoming the control plane for enterprise AI governance.
The Examiner ScenarioWhat an examiner will ask when your AI governance posture is tested under scrutiny.
Governance Readiness SnapshotA concise view of whether controls, ownership, and oversight are keeping pace with deployment.
Who Owns the Agent?The board-level accountability question every agent deployment has to answer before it goes live.
Research HomeAll research areas, frameworks, and current governance writing in one place.

Start with the research map, then follow the current intelligence feed as new issues move.

Read the white paper

Intelligence notes

Filter primary-source field notes by the governance signal you need to track.

AccountabilityAgent intent, review triggers, ownership, and authorization decisions.
AgentsAutonomous deployment, sprawl, identity, and traceability risks.
Agent SecurityNamed CVEs, attack patterns, and which governance control would have stopped each one.
SecuritySecurity research, resilience, detection, and threat-defense developments.
Multi-Agent RiskWhen no single agent owns the outcome, whose authorization record covers it.
Identity & DataAccess, labels, DLP, and the data an agent can actually reach.
ComplianceOversight, examination readiness, and operating governance evidence.
MicrosoftPrimary-source analysis of Microsoft AI, Copilot, Foundry, and Purview.
Regulated IndustriesFinancial services, healthcare, and government accountability patterns.

Dated analysis across agents, security, Microsoft AI, compliance, and accountability.

Original frameworks

Pick the governance question you need to answer.

The Intent Architecture StackThe three organizational layers every enterprise must design before any agent goes live.
The Governance Readiness MatrixAgent count versus authorization coverage.
The Deployment Accountability MapThree tiers. One deployment. A map of who owns what.
The Tenant Agent Reconciliation FrameworkReconcile what your tenant contains against what your organization approved.
The Organizational Agent ControlsFive governance decisions every enterprise must make before any agent goes live.
The Authorization Coverage LifecycleThree phases as authorization coverage changes.
Agent Substrate Readiness ModelA two-tier diagnostic for systems of record becoming agent infrastructure.
Chain Authorization GapFour questions every enterprise must answer before an agent orchestration goes live.

Document

Agent Authorization Document

The record that proves who authorized the agent and what it may do.

Core Concepts

The Accountability Assumption
Intent Architecture
Governance Debt
Intent Gap
Agent Sprawl

Newsletter About

Intelligence | May 12, 2026 | Microsoft Publishes Five-Level DDoS Resilience Maturity Framework for Consume... →

Governance record

Authorization is the artifact.

AI governance is the written record of who authorized the system to act, what it was allowed to do, and who answers when it does the wrong thing.

Sougata Roy is an enterprise architect with 26 years in complex systems across regulated financial services, healthcare, and government environments. He writes The Governance Gap on the accountability question autonomous AI makes impossible to defer.

26

Years

Enterprise systems experience

12

Years

Inside SEC, CFTC, and NIH environments

Research built from primary sources. No product agenda.

Research

Frameworks and field notes on enterprise AI governance.

View Intelligence

Agent Authorization Document The Microsoft Control Plane The Examiner Scenario Governance Readiness Snapshot

Explore

About Frameworks Intelligence Newsletter Essays Contact

Contact

LinkedIn(opens in new tab)research@sougataroy.com

© 2026 Sougata Roy. Independent research, essays, and frameworks. Views expressed are my own and do not represent my employer.

© Sougata Roy. Frameworks and terminology published here, including Intent Architecture, Governance Debt, The Accountability Assumption, Agent Sprawl, and Intent Gap, are original work. Free to use with attribution. Not for commercial reproduction or rebranding.