More Information

Agents propose. Policy decides. People govern.

Governance in the path of every call

In Exosphere Agentic, approval is a policy, not a button: every action an agent proposes passes through Exosphere, the judgment layer, before it can reach a system of record. Exosphere Agentic runs on Azure and integrates with the Microsoft AI platform, deployed into the customer's own tenant — so context, data and governance stay where they belong.

Updated 11 October 2026

Approval is a policy, not a boolean

Exosphere checks every proposed action against your operator policy and returns one of three outcomes:

Outcome	What happens
Execute	The action is inside policy and proceeds.
Route	The action needs authority. It goes to the role that holds it, not necessarily the person in the conversation.
Block	A hard rule forbids it. No approval overrides it, and the reason is recorded.

Thresholds per loop and per commercial exposure, not per model.
The same rules bind people. Cumulative exposure counts agents and people together.
Rules enforce. The corpus grounds. Every recommendation cites the clause of your own policy it relies on.
Control sits in the path of the call, not in the prompt. Only Exosphere holds write scopes, so an outage stops writes rather than passing them through.

How a governed loop runs

flowchart TB
    S["Signal<br/>bill, order, usage<br/>or network event"] --> F["Agent gathers facts<br/>from systems of record"]
    F --> P["Agent proposes<br/>action plus evidence"]
    P --> C{"Policy check"}
    C -->|"blocked"| X["Stop and explain<br/>what blocks it"]
    C -->|"within policy"| A["Act once<br/>via governed tool"]
    C -->|"needs authority"| T["Person with authority<br/>Microsoft Teams or<br/>Sherpa Approvals"]
    T -->|"decline"| R["Decision recorded<br/>nothing changes"]
    T -->|"approve"| V{"Facts re-checked<br/>at moment of action"}
    V -->|"facts changed"| D["Stop<br/>approval lapses"]
    V -->|"unchanged"| A
    A --> E["Real outcome<br/>applied, refused<br/>or unconfirmed"]
    E --> K["Case record<br/>evidence, decision, outcome"]
    X --> K
    R --> K
    D --> K
    classDef human stroke:#009688,stroke-width:3px
    classDef stop stroke:#E68A00,stroke-width:2px
    classDef exos stroke:#0077B6,stroke-width:2px
    class T human
    class X,R,D stop
    class C,K exos

Every path, including a block, a decline or changed facts, ends in the same case record.

Single-use approvals, checked twice

Approve where you already work. The approver gets an Adaptive Card in Microsoft Teams or a request in Sherpa Approvals. The first decision wins.
Signed, single-use and expiring. An approval cannot be replayed or stretched to cover a changed action.
Checked again at the moment of action. Policy and data are re-validated before anything is written. If the facts have changed, the approval lapses.
Written once. Orchestration with sagas, idempotency and state means each proposal executes exactly once.
Honest outcomes. Every result is reported as applied, refused or unconfirmed. An unconfirmed write is never shown as a success.

Autonomy is earned, one action type at a time

Autonomy is set per action type, not per agent or model: always approve, approve above a threshold, execute with sampled review, or autonomous within policy. Evidence moves the rungs. Nothing promotes itself; the operator makes every move.

One record from intent to outcome

Every governed action leaves a case record a risk team can inspect, written by the layer the call passes through.

Section	What it holds
Intent	What the agent or person set out to do
Actor and authority	Who proposed it, which rule applied and which policy clause was cited
Evidence	The facts retrieved, with missing data stated as missing
Decision	Execute, route or block, and who approved or declined
API operation	The governed call made, once per proposal
Record	What changed in the system of record, and the real outcome

Blocked and declined actions are recorded too. The transcript can expire; the record still says who decided what. Reversal is itself a governed action: history is extended, never edited.

Works with the Microsoft AI platform

One agent, two MCP surfaces, each doing what it does best:

Context from Microsoft Fabric and Fabric IQ, where business meaning is bound to your data in OneLake.
Governed action through Exosphere, over TM Forum Open APIs, carried by Azure API Management.

Sherpa agents, such as the Billing Sherpa, Order Sherpa and Product Sherpa, are built in Copilot Studio or Microsoft Foundry inside your tenant, and they never write on their own authority. TM Forum's own direction puts MCP in front of the Open APIs, so the same governed surface serves any MCP-capable agent.

Microsoft product names are used descriptively.

One agent, two MCP surfaces

flowchart LR
    U["Customer or<br/>care agent"]
    subgraph MS["MICROSOFT AI PLATFORM"]
        CS["Sherpa agent<br/>Copilot Studio or<br/>Microsoft Foundry"]
        FIQ["Fabric IQ ontology<br/>business context"]
        OL["OneLake data"]
    end
    subgraph EX["EXOSPHERE AGENTIC"]
        POL["Exosphere policy<br/>authorise · observe · audit"]
        ACT["Governed actions<br/>TM Forum Open APIs"]
    end
    SOR["Existing BSS and OSS<br/>unchanged"]
    U -->|"asks"| CS
    CS -->|"context - read"| FIQ
    FIQ -->|"bound to"| OL
    CS -->|"action - request"| POL
    POL -->|"within policy"| ACT
    ACT -->|"via Azure API Management"| SOR
    SOR -.->|"analytics mirror"| OL
    ACT -.->|"outcome and audit ref"| CS
    classDef ms stroke:#4A5F7A,stroke-width:2px
    classDef exos stroke:#0077B6,stroke-width:2px
    classDef sor stroke:#7A8DA5,stroke-width:1px
    class CS,FIQ,OL ms
    class POL,ACT exos
    class SOR,U sor

Fabric IQ supplies business context; Exosphere is the only path to a write.

Seen in a demonstration

In a governed billing-credit demonstration, the loop:

found the one new line behind a sudden invoice jump;
stated the supporting usage data it could not find, instead of guessing;
offered the credit only after every policy check had passed, and a person approved it with a single-use approval;
executed the credit exactly once;
confirmed on the next invoice that the charge had not returned;
left a larger but expected increase alone, and said why.

Restraint is part of governance: a loop that credits every spike costs money.

Demonstrations run on synthetic accounts; any figures shown illustrate the mechanism and are not a performance claim.

See a governed loop run

Book a demo, ask for the ontology briefing, read the white paper, or open the library.