AI Governance: The Shift‑Left Playbook

00:00:01 Mark Smith
Welcome to the Copilot Show, where I interview Microsoft staff innovating with AI.
I hope you will find this podcast educational and inspire you to do more with this great technology. Now, let's get on with the show. Welcome back to the Copilot Show. Today's guest works at Microsoft in the United States as a senior product manager. Welcome, Aisha.

00:00:24 Aisha Hasan
Hello, everybody. Thank you so much, Mark, for having me here. And I am super excited to be talking about all things Copilot and governance in this excellent space. And again, it's a pleasure to be here. And thank you for inviting me.

00:00:38 Mark Smith
Thank you, thank you, thank you. Tell me about food, family, and fun. What do that mean for you?

00:00:44 Aisha Hasan
It's just right at time because we just had the Thanksgiving holiday in the United States last Thursday. So obviously lots and lots and lots of food, both more on the cooking side and on the eating side. But yeah, I pretty much try anything pure and, but I'm sucker for innovation. So surprise me and I'm there. Family, of course, pretty big family, very important. And as much as it's like fun or love and care, it's also sometimes you want to run away when you get on the table at Thanksgiving dinner. And fun. Technology is fun. Travel is fun. Photography is fun. Meeting new people and get excited about new ideas, problem solving. So that's me.

00:01:27 Mark Smith
I like it. Do you specialize in some area of photography particularly?

00:01:32 Aisha Hasan
Portraits and landscape in general. I've had done a bit of a travel over the years and not so much lately, but Africa, some parts in Europe and quite a bit just around the US as well. But yeah, can we do like, get back on it? Ireland was a lot of fun and Africa, a little bit of thrill seeking too. So I've done Cage diving with the white sharks. Sharks. Yep, that was pretty interesting. I've done skydiving. So next on the list is bungee jumping. Hopefully I get to do that before I turn way too old and my bones start to crack.

00:02:10 Mark Smith
I love it. Come to New Zealand where bungee jumping, it wasn't invented because I think some tribes invented it, but it was commercialized in New Zealand by a guy called AJ Hackett. And I've done 2 bungees in New Zealand. The highest one was, you know how when you get pulled up on a bungee and then you drop again? On the pull-up, it was still higher than the next highest bungee at that point.

00:02:33 Aisha Hasan
Oh my God. Lovely.

00:02:35 Mark Smith
And yeah, so my first experience was the largest jump you can possibly do. It's called Nevis in New Zealand. And I thought when I jumped, there was just silence. But I had a GoPro on my arm. And I was just this massive drawn out ****. I went through it and then bounced back up. It was amazing. Amazing.

00:03:01 Aisha Hasan
Well, I'll consider that an invitation and definitely add it to the list. But I understand when I jumped from the plane, It was not the long drawn out that, but it was just very immediate. That's like really high.But then the parachute comes up and you're just gliding and there's just nothing like it. The experience is just amazing.

00:03:23 Mark Smith
Yeah, I did the same. I did parachuting 1st and apparently When you first jump, for the very first time ever, your brain actually almost like does a reset because it goes, I've never comprehended what just happening. So I did the highest jump you could do from parachute, which is I think 15,000 rather than 10,000. And just, yeah, once again, it's an experience that will stick with me forever. You also mentioned travel. I love travel. And If you had only one place that you could revisit before you died, where would it be?

00:03:59 Aisha Hasan
Oh, it would be Africa, definitely. And in Africa too, when I did the Africa circuit, it was started at Victoria Falls in Zambia. So I did that Zambia, Zimbabwe, Botswana Loop. And believe it or not, I was with the friends who had never actually taken a proper train ride. So they decided that we're going to go down to, so we ended up in South Africa and they decided that, if we're going to go, from Zambia or Zimbabwe, we should go take a train. So I was born in Pakistan and local like transportation is train. So I'm like, I grew up riding trains for 24 hours and stuff. And I'm like, trust me, it's not all that what's going out to be. They're like, no, it'll be exciting. So we actually ended up taking the train from Victoria Station at Victoria Falls Station from Zimbabwe to Botswana. And that train is still called Rhodesian Airways. So you can imagine how it is. Yes. And it's all sorts of fun smells and people, locks don't work, bathrooms don't work. And it was a 14-hour train ride just to get to Zimbabwe so we can get on the plane to go down to South Africa. It was an experience for sure. I'm sure they enjoyed it a lot more than I did. But I thought it was just like a little piece of history. Then yeah, but I'd go back in a heartbeat. I think that it's just so amazing. And this whole part, we did a sort of like non-traditional, off the beat, route. We didn't do the safari at Kruger or anywhere else, like those, one of those big games, but instead we did a small type of local, less known safari, which is in the Zambezi River. And it actually touches Zimbabwe, Nairobi area, Kenya, and actually Botswana. So it was amazing. And I also went to a preservation area for Big Five. So I actually played with lions and cheetahs and stuff. They come up next to you and it's just like big cats. But that would be my immediate go back to in a heartbeat. And if you ask me if I were to move somewhere, I would say I'd move to Prague in a heartbeat too. Old town Prague. It has my heart forever. But yeah.

00:06:22 Mark Smith
Do you read it all?

00:06:23 Aisha Hasan
I do.

00:06:24 Mark Smith
So I've just read Dan Brown's latest book, which is, I think it's called The Strangest Secret. I think, no, that might not be it. But it's entirely set in Prague.

00:06:35 Aisha Hasan
Oh, I'd have to read it. I read all three of his last ones and, well, I read three of them might be more, but Angels and Demons and Da Vinci Codes and the other one. And I think it was Da Vinci Code where I read it in two days straight in just like one sitting. I was like so captivated by it. So, you know, I'll have to check it out.

00:06:53 Mark Smith 
I like with all his books, his previous one was on AI. And this was like 3 years before, AI became a big deal. But it's called The Secret of Secrets. That's what it's called. I love reading books of where I've been. And so that one, the AI one, of course, was set in Spain, all across Madrid, Barcelona, the whole lot.

00:07:17 Mark Smith
But this one is the whole thing's in Prague. I love that. from going across the river in Prague to knowing a bit of the districts and stuff, you're kind of, I know where he's talking about it. Yeah, it's very epic. I only read that maybe 3 weeks ago and I just couldn't put it down just once again.

00:07:35 Aisha Hasan
I'm going to have to add it to my list for sure then.

00:07:38 Mark Smith
Very intriguing. First of all, what part of Microsoft are you in? What are you working on? What's your focus area?

00:07:45 Aisha Hasan
Yep, absolutely. So I'm part of what's traditionally you would think of as Microsoft IT. So Microsoft's internal IT organization that focuses on everything for internal employees like as we do for as Microsoft does for external customers. I am part of Microsoft Digital, which is sort of think of that as the employee experience for Microsoft IT. And then we work closely with the other aspect of Microsoft IT, which is our sister organization, security. So traditionally, you know, the very first thing people think of IT comes in as like, your internal systems or devices or these kind of things and all that. But that is not the part of IT that I'm in. We're very focused on evangelizing Microsoft's products both internally and externally. And it's something specific to us, what we call ourselves our customer 0, because we actually wear dual hats. So we... work for Microsoft, they also build things. And the aspect of it is that we are the first and foremost consumers and the biggest consumers of Microsoft's own products. So we consider ourselves as the reference customer to set the framework for how we expect other enterprises to be able to deploy, use, adopt product, and be able to evolve the products into the next generations. So our customers really, you know, be it enterprises, small and medium business, that's what they look to us, the number one question that we get is that every time a new capability is released, or Microsoft has a huge initiative, which we are very focused on AI and agentic platforms right now. And even before that, our number one question from our customers is always, it's like, how does Microsoft do this internally? How does Microsoft manage? How does Microsoft govern? What are some of the best practices? So that's where we come in as the reference customers.

00:09:38 Mark Smith
Which is an interesting discussion point because a lot of people, they look at Microsoft providing software and they don't think of, often they don't think of how big Microsoft, or they don't even understand Microsoft's portfolio. You know, for years that I've been involved in selling, I would have customers that thought that Microsoft only did Windows. That was it, you know, over 20 years in the space. And There was no perception, for example, in business applications that we had a CRM system that Microsoft had built for themselves, And even in the contact center, there's often no kind of understanding of how many contact centers Microsoft have. I remember Brad Smith once saying that if Microsoft was a law firm, based on the number of lawyers it has, it has a higher headcount of lawyers than any other firm in the world.

00:10:28 Aisha Hasan
I believe it.

00:10:29 Mark Smith
Sometimes people don't get the scale of what customer zero is for Microsoft, and therefore, of course, you're wanting to innovate internally. Tell me, particularly, because I know you specialize around governance, what has been your observation in the last particularly since AI has come out from a governance perspective. What are you seeing?

00:10:50 Aisha Hasan
Yeah, absolutely. So, to just echo your point, right, like it's sometimes very hard to fathom the scale because the awareness and also the exposure. So a lot of people, you know, use certain points and, oh, Microsoft only associate with Windows. But there's this entire suite of productivity tools, which is not just Office, right? So I focus primarily on the individual and citizen developer productivity side of Power Platform. And now with the introduction of AI, it's all things Copilot Studio. But it doesn't even just like stop there because with agents and AI, the lines are blurred, which is that now you almost have an abstraction of the tool that you're using to build an agent, but it's more about that single pane of glass, that homogeneous view, that no matter where I am, it's almost irrelevant as to where that agent was built. But if I'm consuming it, needs to be almost like that seamless handoff, whether I'm in Copilot chat, whether I'm actually interacting with an agent at some other UI or some other canvas. So that actually factors into the governance a lot as well. Because if you look at traditionally, even before the big portion on AI and building agents with Power Platform, just the surface where things could be built by anyone would continue to increase. We started out with Power Apps and we added automation using flows. And then on top of that, we introduced Power Pages. So it's just that every sort of entry point, the governance landscape continues to increase and change as well. But I think the best part and the beauty of this all is that regardless of whatever you're governing, even when you look at M365 suite or other tools, that the governance itself is rooted into basic principles. So those principles do not change regardless of the portfolio, the type of portfolio, and within that portfolio, what tools you're using. So from an enterprise perspective, right, I mean, data is safe. sacred. So be able to protect data, right? Labeling is in place. And from an experience perspective, empowering employees to be able to build via self-service, which is reducing that friction of IT approvals and those processes. So those principles, they are pretty much universal. And that's the key thing that we focused on, that our principles have not changed, let's say that they have evolved to put more focus on certain things as compared to others.

So with AI, with the introduction of AI, of course, you have this whole deterministic flow where you're relying a lot more on the technology itself to be able to make decisions and not necessarily completely eliminate the human in the loop, but reduce the burden. So the fundamental question that comes in is that when you have those determinations and those decisions, the aspects or the consideration or the criteria that a human has to go through to make a discrimination, how much do you trust technology to be able to do that? So from that perspective, the governance is evolving and it needs to evolve. And the key thing, I think, where the shift that I'm seeing is that, or the shift that needs to happen is proactive versus reactive more than ever before. Because Even with non-AI workflows or non-AI assets, you still want to be able to protect instead of react later and sort of reduce the damage. But with the introduction of AI, the need for proactive governance, I think, is far greater than ever before.

00:14:29 Mark Smith
It's so interesting, the phrase you use there of reduce the burden. So human in the loop, but let's reduce the burden for people. And I just think there's often a level of complexity in any kind of business process as well as governance, that the more that AI can reduce that burden, it allows not just the complexity, but also the repetitive mundane and a lot of work is not that brain stimulating. So if AI can do it, great, we can get on to other stuff. And so are you seeing a move to the tools that you're working with having like governance first. In other words, they are forming part of the governance role, not just, being better at governance, but actually being part of the governance equation.

00:15:18 Aisha Hasan 
Oh, absolutely. Because when we talk about sort of efficiency and reducing, you know, the burden, the idea is really to like, you know, shift left in a way, right? So if today a human in the loop has to do all parts of any process, including governance, governance, which is to 1st define the vision and then, design it, implement it, and then, continue to evolve that vision, whether it's governance or anything else, I would very much like half of that work to at least be automated and then also use intelligence on top of that. So part of becoming the frontier firm is that aspect of being able to evolve the business process and workflows, regardless of the function. And governance is a very big part of it, right? Like ideally, regardless of if I'm building it something in Copilot Studio or if it's in Foundry, as an enterprise, I should be able to define a standard set of policies and rules based on my governance principles and then have everyone follow that. If we talk in specifics of Power Platform, it falls under environments, it falls under connectors, it falls under actions, right? Which is that I would allow a set of connectors and actions which are available by default for everyone, no pre-approval required.

And I need to be able to do that to empower innovation and have AI as part of that governance workflow where either at design time or runtime, you know, we assess, which is what's risky and what's not, instead of either doing proactive reviews and allow block or reactive where you're looking at if something riskier caused any kind of undesired behavior. So AI, you know, to govern AI, AI needs to be part of the governance.

00:17:13 Mark Smith
Yeah. You mentioned frontier firms. A lot of folks probably don't know what a frontier firm is. It's a, you know, something that Microsoft coined. Was it earlier this year? I'm pretty sure.

00:17:22 Aisha Hasan
Yes, it was earlier this year.

00:17:24 Mark Smith
Chaldea. Tell me, how do you explain Frontier Firms to people and what is the thought behind it?

00:17:31 Aisha Hasan
No, absolutely. I would encourage everybody to go and read the white paper that Microsoft did on it. It's available at Microsoft.com and I think it's an excellent, excellent resource to just like sort of get, you know, familiarity with it. But in a nutshell, like, you know, it's a phased approach of evolution of how actually enterprises become synonymous with improving business processes and operations with EI as side by side, not as sort of like a reactive or an afterthought, but it is pretty much ingrained in the DNA of how enterprises modernizes their, how any enterprise modernizes their operations. So I think of it, right, as a phased approach as defined phase one, two, and three, and phase one starting with, of course, like, human with agents and, human-led agent-operated. And then ultimately, the fact of is that, human is still in the loop from a decision-making perspective, but then you have entire operations, business flows that are optimized with leveraging AI. So the key thing in it is just like to be able to use that brain trust, that power of those humans to work more on strategic aspects of it, right? So think of that as to what business problems that need to be solved. What are use cases or scenarios where an agent is a perfect candidate? So that sort of strategic shift where only a human, an expert, subject matter expert can bring in, and then let technology take on and implement your vision. So that's really what the idea of Frontier Firm is, that with the introduction of AI, we expect and we hope that the evolution gets to a point where any enterprise is able to take those critical flows, optimize them, and have the brain trust of their employees and their experts to focus more on strategic thinking and how to continue to evolve their processes.

00:19:20 Mark Smith
Yeah. So the concept of hybrid work, I'm wondering if it's going to be more human and AI working together, as in that we'll have AI colleagues in the future that we will need to maybe orchestrate.

00:19:35 Aisha Hasan
Yeah, I would assume so. I mean, I think that it's going to be very interesting to see that shift because I think technologically, of course, it would be a great and really just a pivotal point where if humans and AI are sort of working together each with their defined role. But of course, we have a little bit ways to go. But I believe with any technological change, it's more about the mindset and then the shifting of that mindset than actually in terms of technology, because technology can continue to improve because it's as good as we make it to be. But it's more about like shifting that mindset in terms of that what AI is here to do. And that's more about how do we actually get AI to work for the benefit of improving the lives of others and also, you know, optimizing key workflows where efficiencies can be gained.

00:20:23 Mark Smith
 So if we look at Copilot Studio, What's happening from that perspective, or from a governance perspective, is in, it started back in the day as Power Virtual Agents, part of the Power Plat team, PVA. In fact, I've got a blog post the first day PVA came out, which was in 2020.

00:20:44 Aisha Hasan
Yep. Of me, I build an agent, put it on my WordPress website. and showed how it can integrate through to Dataverse and whatnot. But what I find interesting, M365 is now much more in the mix. There seems to be quite a blur between what it was, biz apps, and now what was modern work, and M365. What are you seeing from a governance perspective across this kind of shift and change that is happening at a platform level?

00:21:12 Aisha Hasan
Yeah, absolutely. As I mentioned, right, that even with builder tools, the lines are being blurred. And With governance, it's the same challenge. And it's an interesting challenge because I think it also provides an opportunity on how do you consolidate and still be able to maintain the separation of church and state, if you will, that most of the enterprises has in terms of governance. So I knew that, you know, looking to like down to the future, something which was announced at Ignite is the concept of Agent 365, which is that holistic ecosystem view, which is available to IT admin to be able to see all agents in their tenant, regardless of where they're built, being able to see the usage, and then be able to make some decisions based on governance. So I think that that's definitely something which is going to help simplify the story. But today, yeah, it's a little bit of a swivel chair experience, because with the lines being blurred, where the agents are created, there are separate set of governance policies, and then a separate set is applied when the agents are actually being used. So lifecycle does become a bit of a challenge. But I think that with Agent 365, hopefully that's going to continue to simplify the story, especially for scaling the management of governance. Because we're talking about for an enterprise, you could have millions and billions of assets. So sprawl definitely is a concern, but it's a good problem to have because that means that much of an acceptance and adoption of AI is there. It's just a matter of determining what is value add and what is it that it's okay for experimentation. So achieving that balance is going to continue to be something which all of the enterprises will have to evaluate, just like we at Microsoft are evaluating on an ongoing basis. So yeah, so today, in terms of building agents, a separate set of sort of policies. within Copilot Studio that pretty much inherits Power Platform Admin Center and the Power Platform governance policies. But then when you publish an agent, whether it becomes part of M365 ecosystem or it's published elsewhere, then there's a separate set of governance policies that apply there as well. So hoping that we can continue to work on Agent 365 and streamline those experiences for enterprises.

00:23:37 Mark Smith
One of the concerns I've seen from organizations is around I'd say agent sprawl, depending on which folks in the org can start making their own agents. In fact, I've even spoken with folks inside Microsoft where they built their own agents and then IT came and switched them off because of their consumption levels and whatnot that was happening. How do you manage? Is the answer to agent sprawl now agent 365 that was announced in Microsoft?

00:24:06 Aisha Hasan
Yes and no. I think for mostly it's going to be a continuous evolution, right? So agent 365 is a starting point and it's a very good starting point in terms of the effort of consolidating that view for an IT admin. But I think that as it evolves, the vision evolves, we'll see that it actually will offer a lot more value than just a simple inventory. and view. But will it just be the be-all or end-all? Time will tell, because I think that at the rate which technology is evolving, we have more models coming, we have more tools that are coming up, and the idea of the governance as still sort of a single pane of glass, that's going to have to shift more and more towards an inherent AI-based experience itself. So if we're going to leverage AI to govern AI, then Agent 365 is a starting point, but I would expect it to evolve and continue to evolve.

00:25:09 Mark Smith
The final thing I wanted to cover is where do you see people need to invest more or where they, as in what people, people inside organizations, et cetera? As part of their governance strategy, where do they need to invest more? Where do they need to upskill, particularly as agents become more prolific inside an organization? What strategies should they be employing?

00:25:32 Aisha Hasan
Yeah, that's actually a great question. Really, any organization's governance strategy, one thing is that it's not set in stone and it's not one and done sort of thing. Where you start and where you want to be, whatever your North Star is, it's going to depend a lot on where you are in terms of the maturity curve of adoption of the product itself, the tool, and then how you're looking into governance. So a few things from a strategy perspective that I think it can really help. One is to tap that understanding that change is the only constant. So you're going to have to revise your governance strategy pretty frequently. The second thing is to identify what are those basic core principles. Like we've actually a lot of blog articles, something called Inside Track for Microsoft that we've actually put in our best practices out there are real scenarios from Microsoft and how we are governing. So have those principles, Andy, in terms of what falls above or below the line of your risk tolerance, what that risk tolerance is, because that's also going to help you establish that ever-changing balance of innovation versus guardrails. The third thing is always have an understanding of that every time there's something in the product, it may or may not be readily available or usable out-of-the-box. So continue to evolving your strategy along with having a good understanding of what tools you might need to build to actually have an end-to-end governance picture, that's going to be key. And then the fourth thing I would mention is that it takes a healthy balance of three pillars. One is what is available out-of-the-box and product. Of course, Nirvana, everybody's ideal scenario is that it's kind of a plug and play situation, that the product is self-governing. Until we get to the state, the second pillar comes in, which is as an IT organization is an IT enterprise. How are you empowering your admins to be able to fill in those gaps that are there in the product, but you need them now to secure and govern your enterprise? And then the third pillar is user education. which is that even with the other two things, the user education is quite important. Because if the product isn't self-governing, which means that you have gaps that the IT organization needs to fill, but there are some gaps maybe even the IT organization can't fill. And that requires constant education on the user part.

00:27:58 Aisha Hasan
So we can think of that in terms of data policies, you know, just usage guidelines when you're building on certain type of user scenarios that might come under sensitive use cases. most of the enterprises have global presence and rules and laws. They differ from country to country. And those go way beyond just GDPR. So I think having that sort of a three-pillar approach is where you expect what from the product, where do you empower your IT admins to be able to help you govern, and then how you continue to educate your users through a center of excellence or sort of a hub, and also use that hub to upskill on how how to not just only build agents, but build meaningful, impactful agents and adopt good hygiene practices, right? Just not have any ownerless agents or have, if you do end up having, have policies to do cleanup, have good data labeling practices in place and things like that. So it really does take all these different personas to be able to govern effectively.

00:29:04 Mark Smith
Excellent. I think that's very detailed options for people. My final question is more of a personal one. Where are you using AI personally outside of your job? Do you use it in any particular way and parts of your life that you're like, this is the way I use it? Or maybe a tool, a third-party tool or something that you use?

00:29:26 Aisha Hasan
Yeah, I actually love my job so much that it's like I'm always working, but it's not that I work too much because it is, it's just that I just really do love what I do. So some good examples, of course, for me is summarization and really I just, I do not like typing and I do not like having to think a lot on a lot of different things. So I think just quick options in terms of ranking, ratings, food, these type of things. It's just normal, everyday, mundane type of thing where I do not have the patience to go read Yelp reviews and all of that. So for me, it's mundane things that actually really do help. But at work, I actually use quite a few agents. I've actually built agents myself that actually helps our employees build agents by following compliance requirements and also sort of getting an idea what to build where that I'm very proud of that my team built it. Microsoft Intelligent Compliance Assistant, which that really does help folks answer some of these. complex questions about what they can and can't do. And then my favorite agent to date is Microsoft's researcher agent. I think it's one of the most powerful assets that are out there. I love it. Like for me, it's using it on a daily basis is just incredible. And I love the The depth of that, it's almost as a bit scary at time setup. Is it really reading my mind when it comes up with the follow-up prompts? But yeah, it's absolutely brilliant. And it's happy to, I'm very happy to see actually what's happening in the world with the change with respect to when he has been introduced, because you might have heard of it.

00:31:11 Aisha Hasan
Friday after Thanksgiving in the US is the major, major shopping day. So I think in Europe and others is day after Christmas, which is the college Boxing Day. And in the US here, that Friday is called Black Friday. So Monday, today, all of the stats and everything come out. And it was interesting in the news that shopping was up by 9.1% as compared to last year. But there was like a 35% of the people that they've actually looked at the stats used ChatGPT to get a recommendation of, you know, I want to buy this, what would ChatGPT recommend? And those people actually went on to buy it from the site that was recommended by ChatGPT. So I think that that's one of those things, which is, buy some thing and they have 5, 6, 7, 8 different places that are competing and offering it. And that just took away 5, 10 minutes of my browsing time. I said, okay, that's the best deal. So let's go get it. So yeah. And you know, I, I have actually family and friends and they all are, love it. They use it for different things. And one of the things was, I think it was a very highlight for me this past Thanksgiving weekend. We had some family and one of Microsoft's enterprise customers, which I did not know, and they were mentioning how cool Copilot is and they were actually talking about agents, Copilot Studio, either Copilot Studio Lite Experience and Agent Builder. It was just very, you know, heartening and It's humbling to see that, hey, I worked on that stuff. So yeah, it's definitely like incredible, not just only for my personal use, but looking at others who were actually realizing the benefit and the mindset which is shifting to is like, hey, AI is here to help and then continuing on with it to make it a collective success.

00:33:08 Mark Smith
I love it. This is so good, and it is always cool to see when your family and friends start using the tech you work with. That is definitely a buzz, without a doubt. Isha, thank you so much for coming on the show and sharing.

00:33:20 Aisha Hasan
Thank you so much, Mark, for inviting me and giving me this opportunity. I had a great time, and I look forward to chatting with you again sometime more on agents, governance, and all things Microsoft.

00:33:32 Mark Smith
Hey, thanks for listening. I'm your host, Mark Smith, otherwise known as the NZ365 guy. Is there a guest you'd like to see on the show from Microsoft? Please message me on LinkedIn and I'll see what I can do. Final question for you, how will you create with Copilot today? Kakite.