I was back in Copenhagen for EPPC 2026 to co-present "Agent Code Red: Governance in Practice with Agent 365" with Michael Heath. The whole session came down to one question a lot of teams are wrestling with right now: once you start building AI agents, how do you actually keep track of them and keep them under control?

We skipped the theory and demoed it. I walked the room through a demo agent called Nova, built on the Microsoft Agent Framework, and showed how to take it from plain code to a proper, governed identity. Using the a365 CLI, we published Nova and registered it in Agent 365 with its own Entra identity — so it gets real permissions and an audit trail, the same way a person on your team would.

Architecture diagram created by David Lorenzo.

From there we walked through the rest of the picture: the Agent 365 control plane, the observability service that traces what the agent is doing, the tooling gateway that decides which tools it can actually touch, and how all of that shows up in the M365 admin center. We also showed where Defender and Purview fit in for threat detection and data protection, so security teams aren't stuck guessing.

Then we got into the messy stuff — unregistered agents, agents with way too many permissions, and hitting the kill switch when something needs to stop now.

Full room, good questions, and a solid reminder that governance is turning into the real conversation in enterprise AI.