AI agent governance built for Microsoft Agent 365.
A governance service our partner SIs run with you. Every agent gets a risk tier, an operating mode and a named approver, and Entra blocks the ones without a current decision.
What OutTheBox is
OutTheBox decides what each AI agent is allowed to do, records who decided, and turns that decision into labels Entra enforces.
What the service covers
92 governance patterns in 20 areas, from pre-build triage to retirement. The board applies the ones each agent needs.
Employment & Recruitment
Six patterns for CV-screening and shortlisting agents.
Worker Monitoring & Performance Evaluation
For agents that can discipline or terminate a worker.
Education & Assessment
For exam-scoring and academic-integrity agents.
Pre-Build Readiness
Before any agent is built or piloted, any industry.
Pre-Launch Readiness
Before any agent ships to production, any industry.
Vendor & Embedded Agent Governance
For AI embedded in a tool you already pay for.
Pre-Deployment Gates
Rent or own, which model, and where it runs, governed.
Observability & Drift
For as long as an agent stays in production, not just at launch.
Multi-Agent Orchestration
For agents that delegate work to other agents.
Agent Identity & Credential Governance
The identity layer underneath every agent, any industry.
Data & Semantic Governance
The data layer underneath every agent's output, any industry.
Change Management
For the moment an agent changes, any industry.
Oversight & Autonomy Governance
How an agent's operating mode is set, changed, and defended.
Incident & Compliance Operations
Running an agent under ongoing incident-response and regulatory obligations.
Go-Live Readiness
For the specific moment a deployment moves from built to launched.
Agent Lifecycle Transitions
The governed transitions an agent moves through across its whole operating life.
Agent Cost & Budget Governance
Controlling runaway agentic AI spend before it becomes next month's budget crisis.
Agent Sprawl & Shadow AI Discovery
Finding the agents nobody registered, and keeping the registry honest.
Prompt Injection & Untrusted-Input Governance
The architectural discipline that limits and investigates prompt injection risk, not a detector.
AI Coding Agent CI/CD Governance
Seven gates tracing a real CI/CD pipeline, commit through rollback.
Why OutTheBox
Nothing stored
The service keeps nothing you type. Decisions live in files you keep and in your own Entra.
Applied by your own admin
The service never connects to your tenant. Your admin sees every change before applying it.
Logic independently verified
Every decision table is checked against several independent engines before release.
Built on what you license
Microsoft Agent 365 and Entra features you already pay for. No extra platform.
Built on open standards. See how the logic is verified.
Why now
AI laws worldwide are converging on the same idea: agents that make consequential decisions about people need to prove they're governed. The deadlines keep shifting, several have already been delayed since first announced, but the underlying gap doesn't: most organisations still can't say which of their agents can take an action that affects someone, or how fast they could shut one off. We help you close that gap, one agent decision at a time.
See the full picture and sourcing on the free pattern pageStart with the free pattern
Agent Tiering / Inherent Risk Classification, full quality, so you can judge the working standard of the logic behind the service.
Get the free pattern