Plan for responsible AI use
Before you configure technical controls, establish a responsible AI framework that guides how your organization uses AI-enabled Power Platform features. Microsoft's responsible AI principles provide the foundation, but administrators must translate those principles into enforceable governance decisions.
Apply Microsoft's responsible AI principles
Microsoft's responsible AI framework defines six principles that apply to every AI-enabled resource in Power Platform:
- Fairness - AI systems should treat all people equitably. For Power Platform, this principle means reviewing AI Builder models for bias and ensuring agents don't produce discriminatory responses.
- Reliability and safety - Systems should perform reliably and safely. Administrators enforce this principle through content moderation levels and testing requirements before production deployment.
- Privacy and security - AI should respect privacy and handle data securely. Data residency controls and customer-managed encryption (covered in subsequent units) directly implement this principle.
- Inclusiveness - AI should benefit everyone. Ensure agents support accessible interactions and that AI-generated content meets accessibility standards.
- Transparency - AI systems should be understandable. Require that agents disclose they're AI-powered and that makers document what knowledge sources inform agent responses.
- Accountability - People should be accountable for AI systems. Establish clear ownership for every AI resource - who built it, who approves it, and who monitors it.
Require human oversight for AI outputs
A key governance decision is determining where human review is required before AI outputs reach end users or influence business processes. Power Platform provides several mechanisms.
Content moderation levels in Copilot Studio control how aggressively the system filters AI-generated responses. The moderation affects the resulting interactions. Administrators need to find the balance between governance and usability. Four levels are available:
- Highest - Maximum filtering; blocks any response that might be inappropriate. Best for external-facing agents serving customers.
- High - Strong filtering with some flexibility. Suitable for most internal business agents.
- Low - Minimal filtering. Use only for development/testing environments.
- Lowest - Nearly no filtering. Reserved for tightly controlled scenarios with explicit human review.
Administrators should establish a governance standard: production agents in Red and Yellow zones use High or Highest moderation, while Green zone development environments can use lower levels for testing.
Ungrounded response controls determine whether an agent can generate answers that aren't directly supported by its configured knowledge sources. When you disable "Allow ungrounded responses," the agent only answers questions it can ground in provided data - triggering a fallback topic for anything else.
Tip
For regulated environments like Zava Pay, disable ungrounded responses and require Highest content moderation. This ensures agents only provide verifiable, knowledge-backed answers to customers handling financial data.
Establish AI resource ownership
Every AI-enabled resource needs a clear accountability chain:
- Copilot Studio agents - Assign an owner responsible for knowledge source accuracy, content moderation settings, and ongoing monitoring.
- AI Builder models - Designate who maintains training data quality and retrains models when accuracy degrades.
- AI prompts - Identify who reviews prompt outputs periodically and approves changes to prompt instructions.
Document these ownership assignments in your governance framework. At Zava, the admin team maintains a registry of AI resources alongside their environment inventory, tracking which zone each resource operates in and who bears accountability for its responsible operation.
Define zone-appropriate AI policies
Map your responsible AI requirements to your governance zones:
| Zone | Moderation level | Ungrounded responses | Knowledge source review | Human oversight |
|---|---|---|---|---|
| Green (DIY) | High | Allowed (development only) | Self-service | Maker responsible |
| Yellow (Partnered) | High | Disabled in production | Coach review before publish | Coach approval |
| Red (Professional) | Highest | Disabled | Security team review | Formal approval |
This zoned approach lets makers experiment freely in Green environments while applying progressively stricter responsible AI requirements as solutions move toward production and regulated workloads.
Important
Content moderation and ungrounded response settings currently apply to each agent, not each environment. Establish governance processes that verify correct settings during solution promotion reviews.