A Policy Agent That Runs on Microsoft 365: Stop Answering the Same Question Twice

The agent answers only from the policies you make available to it. It does not draw on the open internet and does not fall back on general knowledge: where your documents do not cover a question, it says so instead of producing something that merely sounds plausible. Every answer names the policy it relies on and links to the relevant passage, so it can be checked in seconds — and the agent explicitly invites that check.

This is also our answer to the reasonable objection that an AI should not be making compliance decisions. In our system it does not: it reads, it finds the relevant passages, and it summarises them. The decision stays with a person. We think that is progress on the status quo — a user who, as a rule, never opens the policy at all.

Permissions

Not every policy applies to everyone. Travel rules differ by country, approval thresholds differ by level, and some guidance is intended for management or for a single entity rather than for the whole workforce. The Policy Agent reflects that: each document in the library carries attributes — country, entity, function, level — and every question is answered only from the documents that apply to the person asking. Someone working in the Austrian entity gets the Austrian travel policy; a team lead gets the approval limits that apply to their role. Documents outside a person's scope are not merely hidden from the answer: they are never searched in the first place.

None of this requires a second permission model to maintain. The attributes come from the directory you already run, so a change of role or location takes effect in the agent without anyone keeping a separate list. Citation links behave the same way: they open in SharePoint with the reader's own permissions, so a link can never expose a document the reader is not entitled to see. In practice, most organisations start with the policies that apply to everyone and add the restricted sets once the first ones are running — which is also the safer sequence, because it keeps the initial review short.

Some questions need a lawyer, and they should reach one quickly. Where an answer does not settle the matter, the person asking says so in the same window and, when prompted, supplies the missing context. An automated flow then files the request in a SharePoint list, together with the original question, the context supplied and the policies already consulted. From there your own process takes over — assigned by topic or by team, prioritised, given a due date, tracked to an answer. Nothing sits unnoticed in a personal inbox, and every request is countable. After a quarter you know which topics generate the most work, and where a clearer policy, a template or a short briefing would remove the question altogether.

We begin with the process you have: how policy questions reach your team today, who answers them, and what happens to the ones that need more than a quick reply. Where the process itself is worth improving, we say so rather than automating it as it stands — but that remains your decision, not a condition.

We then agree a benchmark: a set of real questions together with the policy passages that hold the correct answers. That is how we demonstrate the quality of the Policy Agent specifically on your own documents, and the benchmark is re-run after every change. Implementation itself is relatively quick, because the platform is already in place; most of the time goes into testing against the benchmark and adjusting. For the launch we stay closely involved, since the first few weeks decide whether the solution gets used. After that we hand the solution over to your team, or take on long-term support if you prefer.

What the implementation costs depends on the size and condition of your policy library, and on how far the intake process is integrated into your existing tools. We discuss this openly with you up front, and we give you a firm figure once we have had a first look at your policy library. As a guide:

• Implementation is a one-off project rather than a product licence: you pay for the build, not per employee and not per year
• The only running cost is your own Azure consumption for search and AI services. For a policy library of typical size that starts at a few euros a month and grows with actual use — an amount the time saved outweighs many times over
• Depending on your existing agreement, individual features may require an upgrade to your Microsoft licensing (for example Power Automate Premium or Copilot Studio capacity); what that costs depends on your current model and we establish it with you before the project starts
• Later changes to the policy set or the intake process are billed by effort — or we train your team to make them themselves