A decision and evidence plane for enterprise AI — not another console to feed.
Govern360 reads your AI estate from the management APIs you already run, decides what is exposed and who is answerable for it, compiles control into the enforcement planes you already own, and reads the applied state back. This page is the architecture: what it connects to, what each capability actually does, where enforcement happens, and what it deliberately cannot see.
Govern360 is an AI Exposure Management platform: a read-only decision and evidence plane that answers what AI exists across an enterprise, who is accountable for each system, what it can reach and do, and what it costs — then compiles that governance into Microsoft Purview, Intune, your SASE and your AI gateway. It is the policy decision point, not the enforcement point.
Four planes, and only one ever touches an endpoint
The architecture is easier to evaluate if you separate the four things a governance product can do, because most products conflate them and the differences decide your deployment risk.
One consent-scoped, revocable application registration against the management APIs, named up front. Roughly thirty minutes to connect. Nothing is installed on a device, nothing enters your traffic path, and no blanket write access is held on your stack.
Scoring, exposure paths, ownership and autonomy tiering happen here, on what was read. This is the plane Govern360 owns, and it produces decisions rather than blocks.
Approved intent compiles into Purview, Intune, Zscaler or Palo Alto SASE, and your AI gateway. Endpoint enforcement is a separate, optional managed browser extension you choose to deploy; it is not part of the assessment and is not required to get a score.
Where a platform exposes a read-back path, the applied state is read back and reported as Verified. Where it does not, the state is reported as Compiled or Marked applied rather than shown green.
What it reads from
Discovery runs across five signal layers plus a direct endpoint collector. Coverage is reported as a fraction of the layers you connect, and an unconnected layer reads as not measured rather than as zero.
- Agents and API. Copilot Studio, Microsoft 365 Agent Builder, Power Platform and Dataverse, service principals, MCP servers and tool manifests. This is where server-side agents live — the ones with no human session, which no browser or endpoint tool can see.
- SaaS and identity. Entra and Okta, OAuth grants, connected applications, machine identities and their credential expiry and rotation posture.
- Network. AI domains, provider APIs and MCP endpoints, via the SASE or proxy you already run.
- Browser and endpoint. A PowerShell collector run from your RMM — nothing installed, no admin rights — which finds native desktop AI applications including Microsoft Store packages that appear in no uninstall key, extensions across every browser and profile with their permission scope, local MCP servers, offline models, and the names of API-key environment variables. Never their values.
- Email and workflow. Account confirmations, invitations and the paper trail of tools adopted without a purchase order.
- Cost and consumption. Provider billing, Microsoft 365 Copilot licensing and Power Platform consumption, normalised into one schema.
The five capabilities
These are the five dimensions of your AI Exposure Score, so how you run the platform is how the score is built. Each names the modules that do the work rather than the outcome they promise.
AI Inventory and AI Discovery across the layers above. Agent Map groups agents by capability family and distinguishes a replica — the same agent promoted through environments — from a genuine duplicate, so a count describes the estate rather than the manifest. Agent Identity covers non-human identity posture, including the agents holding no machine identity at all. AIBOM emits CycloneDX 1.6 per agent with nightly drift snapshots. Vendor AI Risk covers third-party and ISV agent packages.
Purpose Register holds a signed, versioned purpose per agent and checks it daily against what the agent actually does. The Governance Register ranks every agent by how much exposure a decision would close and proposes an accountable person from platform data. Autonomy tiers are derived from platform signals, not self-declared. Access requests route through multi-level approval. Architecture Review maps findings to NIST AI RMF, the OWASP Agentic Top 10 and MITRE ATLAS. An Agent Passport exports one agent on one page.
Data Shield applies outbound DLP before content reaches a provider. Response Scan handles the inbound direction. Exposure Paths find the lethal trifecta — untrusted input, private data, external egress — including the harder case where the three legs sit across two agents that each pass an individual review. MCP Gateway pins tool manifests by SHA-256 so a tool cannot change under an approved agent. Behavioral Risk and Data Posture cover conduct and where sensitive data actually sits.
Token Governance covers quotas, budgets, forecasts and anomaly alerts, with attribution down to team, agent and purpose and a replayable per-record trace. The Executive AI Bill turns that into per-team showback, including agent-to-agent delegation chains. The Agent Action Control Plane sets per-agent budgets and action policy. Budgets alert; they do not block — a hard cutoff at call time needs a token gateway in the path, which this architecture deliberately avoids.
Evidence mapped across the EU AI Act, ISO/IEC 42001, NIST AI RMF, SOC 2, HIPAA and GDPR, plus CIS Controls v8. Evidence packs cover token, governance and posture scores across more than forty measured controls. The audit log is hash-chained and verifiable. Action lineage traces a policy through its compiled artifact to its applied state. Governance events stream to your SIEM. A six-page board pack exports on demand.
The score is a measurement, not a dashboard
A single explainable 0–100 number across those five dimensions. Four rules keep it defensible, and they are the reason it can go down as well as up.
- Evidence is required for “measured”. A policy nobody applied and a detector that never fired both count as unmeasured.
- Weighted geometric aggregation. A strong dimension cannot compensate for a weak one, because in practice risk does not average out.
- The band is capped by the weakest measured dimension. One failed dimension is not offsettable by five good ones.
- Unmeasured dimensions are excluded and named. Never scored zero, never shown green, and the coverage fraction is published beside the number.
The score measures governance state. It is not validated against incident outcomes, because no incident corpus exists to validate it against, and the methodology page says so.
Where it runs, and what it holds
- Deepest on Microsoft, vendor-neutral by architecture. Microsoft 365 Copilot, Copilot Studio, Power Platform, Dataverse, Entra, Purview and Intune today. Bedrock, Vertex and Salesforce Einstein use the same connector model; where a connector is not live the estate reads not measured rather than assuming zero.
- No prompts or responses stored. End-user prompt content is never retained.
- No blanket write access on your stack, and no secrets held for the planes it compiles into.
- SSO, SCIM, RBAC and data residency are standard rather than an enterprise upsell.
- Built to SOC 2 controls, audit in progress. Not certified, and not claimed. Infrastructure providers hold their own SOC 2 Type II; certifications are not inherited.
What the platform does not do. It does not proxy your traffic, so it cannot block a request mid-flight on its own — enforcement happens in the planes it compiles into. It does not observe runtime behaviour, so memory poisoning, trajectory drift and MCP runtime integrity are outside what it can see, and the published coverage matrix states that rather than implying coverage. It is not a 360-degree view of everything: coverage reflects the sources you connect, and a surface that cannot be measured is named, not estimated.
Questions, answered
What does Govern360 actually connect to?
Management APIs: Entra, Copilot Studio, Power Platform and Dataverse, Microsoft 365, your cloud IAM services, your SASE or proxy, and provider billing. One consent-scoped, revocable application registration, scoped to the APIs named up front. Optionally a PowerShell endpoint collector run from your RMM, which installs nothing.
How long does deployment take?
About thirty minutes to connect and a first score within twenty-four hours. There is no agent rollout, no proxy to insert and no change-control conversation, because nothing is placed in the request path.
Does Govern360 sit in front of my model calls?
No. It reads telemetry and configuration and compiles enforcement actions into the gateway or platform you already operate. It never becomes a hop in your network, which means it cannot become a latency budget or a single point of failure either.
If it cannot block, how is anything enforced?
Through the planes you already run — Purview, Intune, SASE, your AI gateway. Govern360 decides and compiles; the plane enforces. That is the architecture rather than a gap, and it is why a control is reported as Compiled, Marked applied or Verified instead of as a single green tick.
What is the difference between this and AI-SPM?
AI security posture management inspects models, pipelines and the infrastructure AI runs on. AI Exposure Management asks what each AI system is allowed to do and who is answerable for it. An agent can sit on a perfectly configured platform, hold a connector to a finance system, run as its creator and have no owner — posture is about the platform, governance is about the actor.
Do I need to replace my existing security tools?
No, and the architecture assumes you will not. Purview, Intune, SASE, your AI gateway, your SIEM and your identity provider stay exactly where they are; Govern360 compiles into them and reads back from them. Displacing an enforcement plane is not the product.
What happens to a source I do not connect?
It reads as not measured, it is excluded from the score rather than scored zero, and the coverage fraction is published beside the number. Showing a gap is more useful than colouring it in.
Is my prompt content stored?
No. End-user prompts and model responses are never retained. Governance decisions, configuration readings and evidence are.
See it on your own estate.
Thirty minutes to connect, read-only, no proxy. Every AI system, who owns it, what it can reach, what it costs, and a ranked list of what to decide first — within twenty-four hours.
Get my AI Exposure Score