PALO FrameworkSeparate reviewer path
An authenticated reviewer examines the proposed price and expected version. Approval would permit the agent to resume that precise action; approval itself does not write the catalogue.
Development report / 27 October 2026 / Fabrizio Degni
From a connected agent
to a governed request.
PALO's private MCP connector pilot connects Microsoft Copilot Studio to an Azure-hosted governance runtime. Identity, delegated authority and the exact proposed action meet at a testable boundary.
Real read, policy denial and expired-request recovery verified.
Full approval, execution and replay remain the next qualification milestone. Synthetic data; independent private preview; no Marketplace listing or Microsoft certification.
Full approval, execution and replay remain the next qualification milestone. Synthetic data; independent private preview; no Marketplace listing or Microsoft certification.
Executive brief / five Ws
A bounded enterprise integration case
- What
- A custom MCP connector, Entra admission, a PALO runtime, a reviewer interface and a persistent synthetic catalogue.
- Why
- Bound delegated actions, make decisions traceable and separate a proposal from an independently verified effect.
- Who
- Built by Fabrizio Degni for enterprise platform, security and governance teams. The two pilot identities are operated by one person.
- Where
- Copilot Studio and Power Platform, Microsoft Entra and an HTTPS runtime on Azure.
- When
- Work completed on 24–27 October 2026. Evidence snapshot through 27 October, 03:52:38 UTC.
What changed
From interface clarity to real tool-call evidence
Make demo and operational states explicit
The selected local prototype separates My work, AI systems, Activity, Connections and Library. Preparation, archived local evidence and live authority have different meanings. A saved connection is not treated as proof of usable authorization.
Prepare the target, tests and measurement plan
A synthetic catalogue, local acceptance harness, evidence collection and native-control comparison candidate establish a reproducible development baseline. Cloud qualification remains separate.
Connect identity, the reviewer and Copilot Studio
Separate Entra applications, delegated API scopes, federated connector authentication without a client secret, HTTPS hosting and the reviewer flow were configured. The connector and then the actual Copilot test agent completed catalogue reads.
Observe denial, expiry and a verified correction
Price 151 was denied. Price 120 required review and expired without execution. A defect in expired-request withdrawal was reproduced and corrected; the same 89-test suite passed locally and on Azure. The reviewer then withdrew the old request, with zero target writes confirmed.
Publish the evidence and its limits
This report brings together the architecture, configuration record, operational lessons, measurement plan, real captures and English film. Gemini and GLM provided textual challenge; their reviews do not replace runtime qualification.
The redesigned local workspace prototype and the previously published illustrative Governance Hub are separate surfaces. This publication updates the account of the work; it does not promote a new operational Hub.
How the pilot works
Identity is the start of the decision.
- Copilot StudioPrivate test agent and explicitly enabled tools
- PALO connectorMCP over HTTPS, delegated Entra authentication
- PALO runtimeScope, mandate and exact request checks
- Azure catalogueSynthetic item, price and resource version
Federation without a client secret
The connector uses an exact federated trust configuration. Its client identity is not cryptographic attestation of the originating agent; the observed Copilot trace establishes orchestration in this test.
Current boundary: two identities operated by one person establish technical role separation. Independent human review and the full mutative cycle are not yet qualified.
Inspect the implemented configuration and operational lessons
Observed results
Report the effect, including no effect.
Returned by the real Copilot read and retained after the recorded cases.
The same suite passed locally and on Azure Linux. Two environments, one suite.
Zero executions and zero target writes in the observed cloud cases.
| Case | Recorded outcome | Meaning |
|---|---|---|
| Read catalogue | 100, version 1 | An actual consuming-agent tool call worked at that time. |
| Propose 151 | Denied; no execution | The configured upper boundary rejected this request. |
| Propose 120 | Review required, then expired | No completed approval-to-execution cycle is claimed. |
| Recover expired request | One reviewer withdrawal confirmed | The corrected recovery flow closed the old request without modifying the catalogue. |
Raw operator records remain private. The public evidence summary provides dated outcomes and source-artifact digests. A digest is an integrity reference, not independent certification.
English report / 120 seconds
Who decides what an agent can change?
Narration supplied by Fabrizio Degni using his own recorded voice. Actual pilot captures, original diagrams and music. English captions are included in the picture; an optional text track is also available. No Microsoft endorsement is implied.
Read the complete English transcript
An AI agent can connect to your business. But who decides what it is allowed to change?
I’m Fabrizio Degni. Our PALO pilot connects Microsoft Copilot Studio to a controlled catalogue on Azure. Designed for enterprise teams, it is an independent, private technical preview.
The purpose: turn permission into a decision that can be checked, constrained, and traced before an action reaches business data.
Copilot calls the PALO connector through MCP. Microsoft Entra supplies identity. PALO checks the delegated scope, the mandate, and the exact requested action.
We configured federated authentication without a client secret. Agent and reviewer use separate identities, operated by the same person in this pilot.
Then, the real test. Copilot read the catalogue: price one hundred, version one. An actual tool call, beyond a connected status.
A proposed price of one hundred and fifty-one was denied. The catalogue did not change.
A proposal for one hundred and twenty required human review. It expired without execution, exposing a defect in the recovery path.
We fixed the defect, passed the same eighty-nine-test suite locally and on Azure, and verified the reviewer’s withdrawal of the expired request.
The intended benefits: bounded delegation, traceable decisions, human control, and evidence separating an intention from an actual effect.
Zero target writes occurred in this synthetic-data pilot. Full approval, execution, and replay verification remain the next milestone, before production-readiness claims.
The private preview is open for technical discussion. If you build enterprise agents, let’s challenge it together. Explore PALO Framework, and help shape the next operational case.
Benefits and measurement
Turn the design goals into testable questions.
Bounded delegation
Constrain the caller, target, action and validity window. Measure legitimate blocks and unintended effects, including cases that never reach execution.
Traceable decisions
Link the policy outcome and reviewer decision to a precise request. Measure completeness and freshness of the evidence, not just log volume.
Human control and recovery
Keep review, expiry and resubmission explicit. Measure reviewer effort, abandonment and the cost of recovering a blocked workflow.
Verified effects
Distinguish an intention, an execution and an independently observed outcome. The real single-effect and replay tests are still to be completed.
These are intended benefits. Incremental value over native identity, workflow and logging controls is not yet measured. No production-readiness, compliance certification, time-saving or ROI result is claimed.
Read the KPI definitions and native-control comparison boundary
Next qualification gate
Complete the exact approved action, once.
- Confirm fresh caller and reviewer access, valid mandates and the current target version.
- Submit one linked successor to the withdrawn request and obtain a new human decision.
- Execute that exact request within its validity window.
- Independently verify the expected price/version and one target effect.
- Replay the request and confirm that no second target effect occurred.
The complete operational configuration guide follows this qualification. This public development record does not grant permissions, renew mandates or activate services.
Documentation and preview access
Inspect the work. Challenge the boundary.
- Complete development record: configuration, chronology, lessons and KPI plan
- Development record as Markdown
- Machine-readable public evidence summary
- Framework changelog
- Documentation Library
The documentation and media are public. The connector remains a private pilot, with no self-service production endpoint or Marketplace package announced here. Contact info@paloframework.org to discuss the design or a future controlled evaluation.
How does this differ from the ChatGPT plugin candidate?
This pilot concerns governed catalogue actions through Copilot Studio. The separately documented PALO Governance for ChatGPT candidate concerns governance-document preparation and a read-only Knowledge Reader connection. Their identities, release states and acceptance evidence are separate.
Does this make the public Governance Hub operational?
No. The public Hub remains an illustrative local preview. The October workspace redesign is a local prototype, while the Azure pilot is a separately configured and qualified integration. A page label or workspace selection cannot activate live authority.
What does “verified” mean here?
It refers to the dated observations identified in the evidence table and development record. It does not imply that a session remains valid, that all cases have been tested, or that a third party has certified the system.
Which platform references support the configuration?
See Microsoft's remote MCP and Copilot Studio connector guide and access-token claims reference. They describe platform mechanisms; the PALO results are separate pilot evidence.