Platform · Protect
One agent alone is rarely the risk. The path through it is.
Protection is about reach. An agent that can read a mailbox is ordinary. An agent that can read a mailbox, ingest untrusted content and send data outside the tenant is an exfiltration route waiting for a prompt. Govern360 maps those paths from configuration - before anything goes wrong - then closes them with outbound and inbound DLP, non-human identity scoping and SHA-256-pinned MCP tool manifests, compiled into the enforcement planes you already run.
Where a path completes
Demonstration tenantA path needs three legs. The interesting ones complete across two agents that each pass an individual review.
Protection answers one question: what can our AI reach, and where could data actually go? Not whether a policy exists, but whether a path exists - including the harder case where the path completes across two agents that each pass an individual review.
Today’s reality
The risk is rarely one agent. It is what one agent can reach.
Reviewed on its own, most agents look reasonable. It reads a mailbox. It writes to a file store. It calls an approved API. Each permission passes individually, which is exactly why per-agent review keeps clearing them.
Exposure appears when those permissions compose: an identity, a connector and a data source lining up into a path that runs from an AI system to an action taken outside your tenant. That path is a property of the estate rather than of any single agent, so no per-agent review will find it.
What protect covers
Eight things, named as the modules that do the work rather than the outcomes they promise.
Exposure paths
The full route from untrusted input to private data to an action outside the tenant. The lethal trifecta in one agent - and the cross-agent version, where the three legs sit in two agents that each look fine alone.
Per-agent review cannot see a path that completes between agents.Data Shield
Outbound prevention before content reaches a provider: secrets, source code, customer PII and regulated data, compiled into the DLP plane you already run.
Block, redact or warn - per policy, per tool, per data class.Response Scan
The inbound direction - what comes back from a model and where it lands. Less discussed than prompt DLP and increasingly where the interesting failures are.
Native module in development; the compiled path through Purview is live.Non-human identity security
Which agents hold their own machine identity and which run as their creator, credential expiry and rotation posture, and the identities linked to each agent.
An agent with no identity cannot be scoped or revoked independently.MCP Gateway
Tool manifests pinned by SHA-256, so an approved agent cannot silently acquire a changed tool. Governs MCP tool calls alongside direct model calls as one unit.
A tool that changes under an approved agent is a supply-chain event.Data posture
Where sensitive data actually sits relative to what AI can reach, using Microsoft Purview classification signal where you run it.
Sensitivity plus reach, rather than sensitivity alone.Behavioral risk
Conduct that does not match the declared purpose - scope creep, unusual volumes, new destinations - surfaced as findings against the register.
Measured against a signed purpose, which is what makes divergence meaningful.Incidents & near misses
A register of what happened and what nearly did, so a near miss becomes evidence rather than a story somebody remembers.
Streams to your SIEM alongside every other governance event.See the relationship, not just the object
Most inventories stop at agent detected. The exposure lives in the chain that runs through it.
Each link is readable from configuration, so the whole chain is knowable before an incident rather than reconstructed after one.
Open full size
The same agent a per-agent review would clear. Untrusted content reaches it, and three connector paths leave it - one of them outside the organisation. The legend is the point: colour shows risk, line shows how the relationship is known. Counted off the badges: one edge is declared, four are configured, and not one is verified - the agent itself reports no runtime telemetry connected. Govern360 shows that rather than colouring the gap green.
How it works
Four stages. The order matters more than the speed.
For every agent: what it can read, what it can write, what it can delete, and whether it has any route out of the tenant. All of this is configuration, so it is knowable before an incident rather than after.
Join those capabilities into routes. A path needs three legs - untrusted input, private data, external egress - and the interesting ones are assembled from agents that individually pass review.
An agent that can only read and summarise needs a different control load from one holding a write path or a deletion permission. Tiering by risk score instead produces heavy review on harmless assistants and light review on agents that can destroy something.
Controls compile into Microsoft Purview, Intune, your SASE and your AI gateway. Where the platform exposes a read-back path the applied state is read back and marked Verified; where it does not, it is reported as Compiled rather than shown green.
Find the path before someone else does.Exposure paths are computed from configuration, so they are knowable before an incident rather than reconstructed after one.
Get my AI Exposure ScoreWhy a per-agent review misses the real path
The most common protection failure is not a missing control. It is a review process that evaluates agents one at a time.
- Agent A summarises inbound email. Untrusted input, no sensitive data, no egress. It passes review.
- Agent B reads the summary queue and files records to a CRM with an external sync. Trusted input, sensitive data, egress. It passes review too.
- Together they form a complete path from content an attacker controls to data leaving the tenant, and no individual review would ever have shown it. Finding this requires looking at the graph rather than the rows - which is why exposure paths are computed across the estate rather than per agent.
Know what you know — and what you do not
A governance product that produces false confidence is worse than none, because it moves risk from visible to invisible. Where a platform is not connected or a dimension cannot be measured, Govern360 reports not measured rather than assuming there is nothing there — so you can always tell the difference between measured and safe and simply not measured.
Protection carries equal weight with Discovery because reach is where exposure becomes consequence. The dimension measures exposure paths found and closed, identity posture, data reach, prevention coverage and how much of that is verified rather than merely compiled. A control that was written but never applied counts as unmeasured, not as protection.
Open full size
Forty-eight agents write into the same shared connector, each carrying one untrusted source. A different agent on the far side can send data outside the organisation. Reviewed one at a time every one of them passes, because the untrusted input and the egress never sit in the same agent - the path exists only in the join. Every link here is configured, so it is readable before anything happens rather than reconstructed afterwards. Note what the centre node admits: the connector is not identifiable, so the join is at connector level, not at the level of an individual object.
Where this sits in the platform
Five stages, in order. Each depends on the one before it, which is why an unconnected source weakens everything downstream rather than only its own dimension.
What this page does not claim. Protection is computed from configuration and management APIs. It shows that a path exists and that an agent can act - it does not observe run-time behaviour, so memory poisoning, trajectory drift and MCP run-time integrity sit outside what it can see and the published coverage matrix states that. Response Scan as a native module is in development; the compiled path through your DLP plane is live. Figures cited here come from a connected demonstration tenant.
Questions, answered
What is the lethal trifecta?
Access to untrusted input, access to private data, and the ability to send data outside the organisation, all in one place. Any leg alone is ordinary; together they mean attacker-controlled content can reach your data and has a route out.
Can Govern360 block a prompt in real time?
Not by itself - it holds no position in the request path. It compiles prevention into the planes that do hold that position: Purview, Intune, your SASE and your AI gateway. That is the architecture rather than a gap, and it is why nothing here becomes a latency budget.
How is this different from DLP we already have?
Existing DLP knows about data. It does not know that an agent exists, what connectors it holds, what autonomy tier it runs at, or that a path completes across two of them. Govern360 supplies that context and compiles policy into the DLP you already run.
Does it stop prompt injection?
It reduces the conditions that make injection consequential - by finding where untrusted input, private data and egress meet, and closing one of the legs. Detection at the moment of interaction belongs to your gateway or browser control, and the coverage matrix says so.
What about agents that hold no machine identity?
They are reported explicitly, because conventional identity tooling cannot see them - there is no credential to find. An agent running as its creator has nothing to scope, rotate or revoke short of disabling that person's account.
Are prompts and responses stored?
No. End-user prompt content and model responses are never retained. Governance decisions, configuration readings and evidence are.
What does Verified actually mean?
That the applied state was read back from the platform that enforces it. Compiled means the control was written; Marked applied means a person asserted it; Verified means the platform confirmed it. A single green tick that means any of the three is a claim rather than evidence.
Can you protect what you have not discovered?
No, and that ordering is the whole design. Protection depends on the inventory, which is why Discovery carries the largest score weight and why an unconnected source reads not measured rather than clean.
Go deeper
The detail behind this page, in the form it is usually asked for.
Agent exposure paths: the lethal trifecta across a shared substrate, computed from configuration.
GuideZero Trust AI ExposureZero Trust decides who gets access. This measures what your agents do next.
MatrixOWASP Agentic Top 10Where coverage is full, where it is partial, and the three risks it cannot address.
GuideNon-human identity sprawlWhere machine and agent credentials come from, how to measure sprawl, and a ninety-day plan.
Find the path before someone else does.
Connect read-only and see every exposure path across your estate, ranked by what closing it would prevent - including the paths that complete between two agents. Thirty minutes to connect, first findings within twenty-four hours.