Your agent works in demo. Now what?
Your team builds an AI agent. Maybe in Copilot Studio. Maybe in Foundry. Maybe vibe-coded from a suspicious concoction of Python, LangChain, coffee and hope. The demo is impressive. It pulls the right data, reasons through a workflow, produces a useful result. Heads nod. Someone says "let's get this into production."
Then the questions start. Who owns this agent? What's it allowed to access? If it does something wrong at 2am, who gets woken up? What did it actually do last Tuesday? The room goes quiet. Not because the agent isn't good - but because nobody can answer any of them.
This governance gap is mostly what's actually stalling enterprise AI agents right now. Not capability, not model quality, not frameworks or orchestration patterns, but the unglamorous operational plumbing between demo and production. Identity, observability and accountability. The things everybody dances around, then trips over when they ship.
And in Australia, that trip could land you somewhere uncomfortable. Privacy Act reforms are tightening accountability for automated decisions. Responsible AI policy is hardening. The OAIC is paying closer attention. They all point the same way: if your agents make decisions, you need to know what they did, who owns them, and why they did it.
Microsoft clearly thinks so too. Agent 365 - their governance and identity layer for agents - launched in May 2026.
Agents don't fit your identity model
Ask an IT team how they'd give an AI agent access to SharePoint, email, or a line-of-business API, and you'll hear the same answer everywhere: "We'd create a service account." For a single-purpose bot with a narrow scope, that might be fine. But for agents that reason across systems and tasks, it's the wrong answer - and the only one most identity frameworks offer. Agents aren't users: they don't sign in interactively, they don't have managers, they don't sit in an org chart. But they aren't service accounts either. Service accounts run predictable, scoped tasks. Agents reason. They make decisions. They act. They operate across system boundaries, and the scope of what they do can shift based on context.
Jamming an agent into a service account forces a choice. Permissions end up too broad - because the agent might need a range of resources depending on the task - or too brittle, locked down to specific actions that don't cover next week's use case. Worse, there's no agent-specific audit trail. When something goes wrong, you're forensically reconstructing what an autonomous reasoning system did from inscrutable service logs.
This isn't a configuration problem. It's a category problem. The identity model doesn't have a box for "autonomous software that makes decisions on behalf of humans."
Agent 365 addresses this by introducing agents as a first-class identity type in Microsoft Entra, starting with delegated agents at GA, with fully autonomous agents to follow. Each agent gets its own Entra Agent ID, not a repurposed service principal, but a new identity category. It comes with its own access policies, lifecycle governance, and risk-based protection. Microsoft's own framing is telling: agents should be managed "in a similar way to how organisations manage and secure their users." Not a new feature - a new category of thing to govern.
You can't watch something you can't predict
The next problem is observability.
Traditional monitoring assumes software is predictable. Given the same input, it does the same thing, so observability is a matter of logging the right events. Agents break that contract. The same prompt can produce different reasoning paths, different data access, different outputs. That's the whole point of an agent. But it means "what did it do?" is no longer a question you can answer by reading the logs.
This is why so many agents stay in supervised pilot mode. Not because they don't work, but because nobody can explain what they did after the fact. And in a regulated enterprise, shrugging and saying "it probably did the right thing" isn't an acceptable answer.
A demo agent with let's-just-get-it-working permissions, freely accessing sensitive data. A shadow agent, spun up during a hackathon and never decommissioned. Neither is hypothetical, and both are hard to catch without monitoring designed specifically for how agents behave.
Agent 365's observability layer tackles this directly. The agent registry will give organisations a single view of every agent in the environment, including shadow agents that were never formally onboarded, and track behaviour and data access patterns over time. It's observability built for systems that don't behave the same way twice - which is what makes it different from bolting on an APM tool and crossing your fingers.
The layer that was missing
The conversation at every conference, every vendor pitch, every AI YouTuber, every barbecue, every Uber ride - exhaustingly - is about how to build agents. Frameworks. Orchestration engines. Model selection. Everyone has opinions.
But building was never the hard part. The hard part is what comes after.
Most enterprise agents don't fail because the agent doesn't work. They fail because there's no operational layer. Copilot Studio and Foundry can create agents. Microsoft 365 and Teams can run them. But until now, nothing sat in between to answer the questions that production demands: Is this agent authorised? Is it behaving correctly? Who's responsible for it? What happens when it stops being useful?
Agent 365 fills that gap. It is that layer between the build tools and the runtime, what Microsoft calls 'the control plane for agents.' It makes agents auditable, accountable, and - crucially - someone's problem. Someone who can actually help when things go sideways.
That's reflected in how it's built. Rather than building from scratch, Agent 365 extends the tools enterprises already use to manage users: Entra for identity, Defender for threat protection, Purview for data compliance. The same conditional access, the same data loss prevention, the same audit trails. Just now applied to agents, too.
Agent 365 doesn't make the difficult questions go away. But it means you can finally answer them instead of hoping nobody asks. The teams that get agents into production won't be the ones with the best model or the most sophisticated orchestration. They'll be the ones who got the boring bits right.
So the next time someone asks "who owns this agent?" - you don't have to guess.
You already know.
nexwave
discover@nexwave.com.au