Microsoft has released an AI governance architecture that shifts oversight from written policies toward runtime enforcement, continuous evaluation, observability, and audit evidence as companies put AI applications and agents into production. The framework covers nine governance domains and four functions—policy, control, visibility, and proof—responding to the need to verify that governance requirements are both enforced and observable while AI systems are running. The approach treats governance as a continuous operational loop rather than a compliance checklist completed before deployment.
The architecture identifies nine governance domains: policy, data governance, model governance, observability, evaluations, security, identity and access, audit and compliance, and agent governance. Runtime controls can manage interactions among users, agents, models, tools, APIs, MCP servers, and enterprise systems. The framework combines Microsoft Foundry with services including Microsoft Purview, Microsoft Entra ID, Defender, and Azure API Management. Foundry's AI Gateway creates a runtime boundary for authentication, token limits, quotas, and policy enforcement. Microsoft also documents using the gateway to govern MCP tools, offering centralized authentication, rate limiting, IP restrictions, and audit logging without changing MCP servers or agent code. Evaluations are positioned both before deployment and in production, allowing teams to assess quality and safety before release and monitor production behavior afterward.
Manasa T. Ramalinga, Cloud Solution Architect at Microsoft, described the motivation in a LinkedIn post accompanying the architecture, noting that organizations moving AI workloads into production are re-architecting their foundational structures to build safer systems rather than treating governance as an afterthought. Anthony Bartolo, Principal Cloud Advocate at Microsoft, outlined the operational distinction in a LinkedIn post: "Your AI policy is not governance until production can prove it." According to the architecture documentation, the loop works as policy defining rules, runtime controls enforcing them, observability capturing behavior, evaluations testing quality and safety, and audit converting telemetry into evidence.
The approach maps to the NIST AI Risk Management Framework and Generative AI Profile, which provide a vendor-neutral framework for managing AI risks across the lifecycle, including governance, measurement, evaluation, and risk mitigation. Microsoft's architecture translates those governance concerns into concrete platform controls and operational telemetry. Agent governance adds controls around agent identity, access, activity, and workflow checkpoints. Microsoft's open-source Agent Governance Toolkit delivers runtime security capabilities for autonomous agents, including policy enforcement and interception points. The Agent Control Specification creates a mechanism for checkpoints across agent inputs, model calls, tool execution, and outputs, with higher-impact actions able to require human approval before proceeding.
The framework positions governance as operational telemetry that organizations can audit and analyze, turning monitoring data into compliance evidence and incident investigation records. Policies establish requirements and risk classifications, controls translate them into access and runtime rules, observability captures system behavior, and evaluations test quality and safety continuously. The architecture suggests that organizations can't scale what they can't control, positioning runtime enforcement and continuous evaluation as prerequisites for production AI deployment rather than optional enhancements. Companies adopting the framework gain the ability to prove governance is working in real time, rather than relying on policies that may or may not be followed once systems go live. The shift from documentation to enforcement reflects a broader industry recognition that AI systems operating autonomously require fundamentally different oversight mechanisms than traditional software.