An AI agent can connect to your business. But who decides what it is allowed to change?

I’m Fabrizio Degni. Our PALO pilot connects Microsoft Copilot Studio to a controlled catalogue on Azure. Designed for enterprise teams, it is an independent, private technical preview.

The purpose: turn permission into a decision that can be checked, constrained, and traced before an action reaches business data.

Copilot calls the PALO connector through MCP. Microsoft Entra supplies identity. PALO checks the delegated scope, the mandate, and the exact requested action.

We configured federated authentication without a client secret. Agent and reviewer use separate identities, operated by the same person in this pilot.

Then, the real test. Copilot read the catalogue: price one hundred, version one. An actual tool call, beyond a connected status.

A proposed price of one hundred and fifty-one was denied. The catalogue did not change.

A proposal for one hundred and twenty required human review. It expired without execution, exposing a defect in the recovery path.

We fixed the defect, passed the same eighty-nine-test suite locally and on Azure, and verified the reviewer’s withdrawal of the expired request.

The intended benefits: bounded delegation, traceable decisions, human control, and evidence separating an intention from an actual effect.

Zero target writes occurred in this synthetic-data pilot. Full approval, execution, and replay verification remain the next milestone, before production-readiness claims.

The private preview is open for technical discussion. If you build enterprise agents, let’s challenge it together. Explore PALO Framework, and help shape the next operational case.