AI Governance Intelligence Notes | Sougata Roy

Skip to main content

Sougata RoyIndependent researchAI governance read from the primary sources. Not from vendor summaries.

Research areas

Navigate the main governance themes behind enterprise AI deployment.

Accountability & AgentsWho is responsible when an AI agent makes a wrong decision at scale. The organizational design layer most enterprises have not built.
Regulatory ComplianceWhat the EU AI Act, NIST AI RMF, and sector-specific requirements mean for organizations running AI on Microsoft 365.
Data ProtectionClassifying, labeling, and monitoring sensitive data before AI can reach it. What your organization needs in place before agents go live.
AI FoundationsGovernance architecture and access controls before agents proliferate across your Microsoft environment.
The Microsoft Control PlaneHow Microsoft is becoming the control plane for enterprise AI governance.
The Examiner ScenarioWhat an examiner will ask when your AI governance posture is tested under scrutiny.
Governance Readiness SnapshotA concise view of whether controls, ownership, and oversight are keeping pace with deployment.
The Authorization LayerThe citable framework library for enterprise AI agent authorization records.
Who Owns the Agent? The Intent Architecture StackThe May 2026 white paper that introduced the three-layer Context, Intent, and Governance framework for agent accountability.
Research HomeAll research areas, frameworks, and current governance writing in one place.

Start with the research map, then follow the current intelligence feed as new issues move.

Open the library

Intelligence notes

Filter primary-source field notes by the governance signal you need to track.

AccountabilityAgent intent, review triggers, ownership, and authorization decisions.
AgentsAutonomous deployment, sprawl, identity, and traceability risks.
Agent SecurityNamed CVEs, attack patterns, and which governance control would have stopped each one.
SecuritySecurity research, resilience, detection, and threat-defense developments.
Multi-Agent RiskWhen no single agent owns the outcome, whose authorization record covers it.
Identity & DataAccess, labels, DLP, and the data an agent can actually reach.
ComplianceOversight, examination readiness, and operating governance evidence.
MicrosoftPrimary-source analysis of Microsoft AI, Copilot, Foundry, and Purview.
Regulated IndustriesFinancial services, healthcare, and government accountability patterns.

Primary-source intelligence on AI governance developments, filtered for what matters in regulated environments. Written from the primary sources, not from vendor summaries.

Governance system map

Follow the governance sequence from risk language to authorization, operation, and evidence.

core concepts: 5; core concepts
operating frameworks: 9; operating frameworks
governance document: 1; governance document

View all frameworks

00

Foundation

Start with the layer the operational stack assumes.

The Authorization LayerThe layer beneath inventory, data, assurance, oversight, compliance, and audit.

01

Name the risk

The concepts that make the governance failure visible.

The Accountability AssumptionThe implicit belief that accountability lives with the vendor or platform.
Intent ArchitectureThe organizational design layer before any agent goes live.
Governance DebtAccountability design work deferred while deploying at speed.
Intent GapThe divergence between what the system was intended to do and what it does.
Agent SprawlAI proliferation without corresponding governance architecture.

02

Diagnose

Measure what already exists before you design anything new.

The Governance Readiness MatrixAgent count versus authorization coverage.
The Tenant Agent Reconciliation FrameworkReconcile what your tenant contains against what your organization approved.
Agent Substrate Readiness ModelA two-tier diagnostic for systems of record becoming agent infrastructure.

03

Authorize

The decisions and records required before an agent goes live.

The Intent Architecture StackThe three organizational layers every enterprise must design before any agent goes live.
The Organizational Agent ControlsFive governance decisions every enterprise must make before any agent goes live.
The Deployment Accountability MapThree tiers. One deployment. A map of who owns what.
Chain Authorization GapFour questions every enterprise must answer before an agent orchestration goes live.

04

Operate

The control points for drift, detection, and coverage after an agent goes live.

The Disposition ProtocolSix requirements that convert detection signals into formal governance decisions.
The Authorization Coverage LifecycleThree phases as authorization coverage changes.

05

Keep the record

The artifact that turns authorization into evidence.

Agent Authorization DocumentThe record that proves who authorized the agent and what it may do.

FrameworksCore concepts, operating frameworks, and governance documents.
NewsletterWeekly field notes on enterprise AI governance.
AboutThe perspective behind the research.

NewsletterAbout

IntelligenceJuly 1, 2026|JADEPUFFER Ransomware Shows Autonomous Agent Executing Full Intrusion Chain A...→

Governance record

Authorization is the artifact.

AI governance is the written record of who authorized the system to act, what it was allowed to do, and who answers when it does the wrong thing.

Sougata Roy is a technology manager with 26 years building enterprise systems, including 13 years on federal engagements at agencies such as the SEC, CFTC, and NIH. He writes The Governance Gap, a weekly newsletter on enterprise AI governance and the accountability question that agent deployment forces every regulated organization to confront.

26

Years

Enterprise systems experience

13

Years

Federal engagements as a contractor

Primary-source research. Independent technical validation. Practitioner judgment.

Research

Frameworks and field notes on enterprise AI governance.

View Intelligence

Companion Annex Agent Authorization Document The Authorization Layer The Microsoft Control Plane The Examiner Scenario Governance Readiness Snapshot

Explore

About Rights Frameworks Intelligence Newsletter Essays Contact

Contact

LinkedIn(opens in new tab)research@sougataroy.com

© 2026 Sougata Roy. Independent research, essays, and frameworks, produced on my own time and with my own resources from publicly available sources. Where appropriate, platform behavior is independently validated in controlled, non-client environments. Nothing published here derives from confidential employer, client, or agency information. Views expressed are my own and do not represent any employer, client, or agency.

© Sougata Roy. Frameworks and terminology published here, including the Intent Architecture Stack, the Consequence Owner role, and the three-tier risk model, are introduced in Sougata Roy's work.

Supporting vocabulary including Governance Debt, Agent Sprawl, and Intent Gap builds on established and concurrent industry usage; Sougata's specific applications and frameworks are documented at sougataroy.com.

Frameworks and terminology published here are available under CC BY 4.0. Free to reproduce, adapt, and use commercially with attribution. Full terms at sougataroy.com/rights