What your agents are not allowed to do
Stopping, and only noticing
Rules run before the agent acts
Azure AI Foundry, Copilot Studio, Microsoft 365 Copilot
Rules can only tell you afterwards
Codex
Which rules step in most
Times each rule stepped in across Mubadala, last 30 days
The rules
Personal data never leaves
Keeping data in
Names, national IDs, bank details and health data are removed from anything an agent sends outside Mubadala.
Hidden instructions in documents
Hidden instructions
Documents and system replies are checked for text that tries to give the agent new orders. Anything suspicious is stripped out before the agent reads it, and recorded.
Restricted data needs clearance
What it may reach
An agent may only read a restricted source if its owner holds the matching clearance and the source can check who is asking.
A person approves anything that changes a system
Your approval
Anything that changes a system or sends something outside needs a named person to approve it, unless the agent acts on its own on routine work.
No unqualified financial advice
What it may say
Agents outside Finance may not give investment, tax or accounting advice to anyone outside Mubadala.
Approved models only
What it may reach
An agent doing real work must run on a model on the approved list. Anything else is refused before it starts.
Each department stops at its budget
What it may do
Departments that stop at the limit take no more tasks once the monthly budget is gone. The rest warn you at 80% and tell your manager at 100%.
Someone reads it before it goes outside
What it may say
Any message an agent sends outside Mubadala is held for a person to read, unless Marketing owns it and the work is routine.
Everything the riskiest agents do is kept
What it may do
Agents on high care or highest care work keep a full record of every question, answer and step for 24 months.
Agents nobody registered
What it may reach
Work coming from an agent nobody registered is flagged to the platform team. It can only be spotted, not stopped: we only see what these agents report.
What the rules caught
The department passed its monthly budget. Because work stops at the limit, further tasks were refused until the budget was raised.
The department passed its monthly budget. Because work stops at the limit, further tasks were refused until the budget was raised.