Most teams stall on the same problem when they try to put an AI agent to work. The agent is capable enough. The real question is whether it can safely reach the systems it needs, like the CRM, the file store, or the ticketing tool. Security has to know what the agent can do in there, and how anyone would find out later.
The usual answers are to say no, or to hand the agent a shared key and hope for the best. Over recent weeks we worked on a better answer, where an agent can reach more of your enterprise because every step is governed.
Reach only helps if it is governed
Adding integrations to an AI tool is easy. The harder part is making each new connection run through the same control plane instead of becoming its own exception. That is the idea behind what shipped this cycle.
The Microsoft 365 Graph connector reached general availability, so agents can now search and read across SharePoint and OneDrive, where a lot of real work lives, without asking for consent again every time. It has since grown to cover Teams as well, so chats and channels are reachable the same way. Eight connectors joined the catalog in the same stretch: HubSpot, Google Workspace, Postman, Miro, Sentry, Ramp, Lucid, and G2. On the agent side, Gemini Enterprise, Gemini CLI, and Antigravity joined too. This is more than a longer list of connectors. Each new connection follows the same rules: the agent sees only what the acting user is allowed to see, sensitive fields are redacted before the model receives them, and every call is checked against policy you write in plain language.
That matters most where security reviews tend to get cautious. A support agent that can pull a customer's onboarding docs from SharePoint and their record from HubSpot is genuinely useful, but only if it inherits the person's permissions rather than gaining more than them. Without that, wider reach just adds risk.
Trust means being able to see what happened
Calling something governed is a claim. What makes it real is being able to answer two questions after the fact: what did the agents do, and what did they cost.
Both got easier this cycle. Cost is now attributed by team, model, and token usage, so you can see which team's adoption is driving spend and act on it, and you can spot a single expensive session instead of reading one large bill. The audit trail gained a time-range filter, which helps when you need this quarter's agent activity for a review rather than the whole history. Webhooks can now apply CEL conditions on delivery, so you forward the events that matter to your SOC instead of all of them.
No single one of these is a marquee feature. Together they let you show what happened rather than assert it.
Built for production
A control plane is only worth using if it stays up under load and speaks the standards your clients already use. A good part of this cycle went into that work. We now serve built-in tools consistently from the catalog, mount tools correctly regardless of which handshake a client used, retry stalled tool discovery with sensible timeouts, and advertise per-endpoint OAuth metadata so any gateway endpoint is directly connectable. This is the work that decides whether agents keep functioning on a busy afternoon.
Where this is going
The direction stays the same. Connect agents to more of the enterprise, and make each new surface governed, attributable, and visible by default. More connectors will come, and the guarantee underneath them will not change.
FAQ
How do I let AI agents use real enterprise systems without over-permissioning them?
Route every agent through a control plane that enforces the acting user's existing permissions, redacts sensitive data before the model sees it, and checks each call against policy. The agent can then reach systems like SharePoint, OneDrive, and HubSpot without gaining more access than the person it acts for.
Can an agent read our SharePoint and OneDrive files now?
Yes. The Microsoft 365 Graph connector is generally available with file search and reads, and it now covers Teams chats and channels as well. It honors existing permissions without repeated consent prompts.
How do we see what agents cost?
Spend is attributed by team, model, and token usage, so you can see which adoption is driving cost and catch outliers, instead of reading one opaque bill.