Enterprise Platform Acceleration Roadmap
Planned capabilities that extend the Enterprise Kit to fully leverage Microsoft Azure AI Foundry for large enterprise deployments — bridging the gap between Microsoft native features and regulated enterprise requirements.
CONTEXT
Why These Capabilities?
The Enterprise Kit v1.0 covers the core enterprise baseline. The Microsoft platform (Agent 365, Foundry, MCP stack, Three-IQ) provides strong native capabilities. Accelerating platform establishment at large enterprises — particularly in regulated industries — requires additional capabilities that bridge "platform deployed" to "platform operating at enterprise scale."
The following workstreams describe planned extensions organized by capability area. Each entry describes: what Microsoft provides natively, what the Enterprise Kit currently has, and what is planned.
PLANNED CAPABILITIES — 5 WORKSTREAMS
The 5 Enterprise Acceleration Workstreams
W-1
Agent Portfolio Governance
Extending Agent 365 with bank-grade manifest metadata, Portfolio Registry, and cross-LoB compliance topology.
4 capabilities
W-2
Identity Chain & Principal Propagation
Registry-declarative Entra → SAP/ServiceNow role mapping, A2A delegation chain attestation, and runtime identity enforcement.
3 capabilities
W-3
Data Sovereignty & Clean Core Bridge
SAP → OneLake Bronze/Silver/Gold pipeline, Purview lineage wiring, and Foundry IQ multi-source KB assembly.
4 capabilities
W-4
Regulatory Evidence Automation
Automated OSFI B-10 / FINTRAC / PIPEDA evidence bundle assembly, signed audit export, and regulator-ready reporting.
3 capabilities
W-5
Platform Operations at Scale
Self-service agent onboarding, MCP fleet health dashboards, Work IQ signal integration, and business value observability.
4 capabilities
WORKSTREAM 1
Agent Portfolio Governance
Agent 365 provides the enterprise agent registry. What it does not provide is the bank-grade metadata layer that regulators, risk officers, and LoB owners need to understand the agent portfolio.
Microsoft NativeAgent 365 base manifest: name, description, version, permissions.
Kit Todayagent-templates/ with basic manifest YAML.
To BuildExtended manifest schema: risk_tier (1–4), regulatory_scope (OSFI/FINTRAC/PIPEDA), lob (FX/rates/payments), duplicate_assessment (semantic similarity check against registered agents), data_classification, escalation_matrix.
Microsoft NativeAzure Monitor + Log Analytics for raw telemetry.
Kit Todayobservability/kql/ has basic queries.
To BuildPre-built KQL workbook: agent count by LoB, duplicates by semantic similarity, unregistered agents (detected via Foundry telemetry but absent from A365), policy violation rate by agent class, certification expiry alerts.
Microsoft NativeNo native cross-agent compliance topology view.
Kit Todaytrust-extensions/ has PolicyGraph stub (Cytoscape).
To BuildFull Policy Graph implementation: auto-discovers all registered agents from A365 API, builds adjacency matrix of tool-sharing relationships, highlights policy violation paths (e.g., Agent A shares tool X with Agent B, but Agent B is not allowed tool X per its manifest), renders as interactive Cytoscape topology with filter by LoB / risk tier / certification status.
Microsoft NativeAgent 365 supports cross-cloud sync (Azure + AWS Bedrock + GCP Vertex).
Kit TodayNo configuration for cross-cloud sync.
To BuildConfiguration templates + Bicep module for Agent 365 cross-cloud sync: AWS Bedrock agent registration feed, GCP Vertex agent feed, unified inventory view. Required for enterprises with multi-cloud agent deployments.
WORKSTREAM 2
Identity Chain & Principal Propagation
Entra Agent Identity (Blueprint → BlueprintPrincipal → per-instance) and FMI Path token exchange are GA. What enterprises need on top is a declarative registry that maps organisational roles to system entitlements, and enforcement at runtime.
Microsoft NativeEntra group membership. No auto-mapping to SAP auth objects or ServiceNow roles.
Kit Todaytrust-extensions/ references identity propagation conceptually. No YAML registry.
To Buildidentity-propagation-registry.yaml schema + validation tool: Entra group → SAP auth object → ServiceNow role → allowed data tiers → allowed tool tiers. Runtime Interceptor in SDK starter that reads the registry and blocks tool invocations outside the agent's authorised scope.
Microsoft NativeA2A Protocol v0.3: delegation tokens carry the chain. No persistence layer.
Kit TodayDecision Ledger records individual agent actions. No multi-hop delegation chain records.
To BuildDecision Ledger extension: when an A2A delegation is initiated, record the full chain (Orchestrator → Sub-agent 1 → Sub-agent 2 ...) as a linked ledger entry. Chain entries are cryptographically linked. Purview lineage includes chain context. Auditors can reconstruct any multi-agent workflow from ledger entries alone.
Microsoft NativeFMI Path is GA. Manual configuration.
Kit TodaySAP adapter uses JWT Bearer. FMI Path not pre-configured.
To BuildBicep module + SDK helper: automates FIC (Federated Identity Credential) registration for Entra service principal, SAP BTP trust configuration, and OData V4 token exchange flow. One Bicep deploy = zero-secret SAP integration. Includes ServiceNow OAuth equivalent.
WORKSTREAM 3
Data Sovereignty & Clean Core Bridge
Foundry IQ, Fabric IQ, and Purview are GA. The missing piece is the pipeline that moves SAP financial data into OneLake under strict sovereignty controls — and the Foundry IQ knowledge base assembly that makes it agentic.
Microsoft NativeAzure Data Factory, OneLake, Event Hubs — all GA. No pre-built SAP extraction template.
Kit TodaySAP adapter for real-time OData queries. No batch/CDC pipeline.
To BuildADF pipeline template: SAP OData V4 delta token extraction → Event Mesh → Event Hubs → ADF incremental load → OneLake Bronze (raw) → Silver (validated/CDM) → Gold (aggregated/Fabric IQ). Parameterised for entity (AP/AR/GL/FX). Canadian data residency enforced at ADF pipeline level. Purview scanner wired to classify Bronze on ingest.
Microsoft NativeFoundry IQ: manual KB configuration per source. No automated assembly from multiple enterprise sources.
Kit Todayrag-pipeline/ has index schemas and datasource definitions. Not wired to Foundry IQ.
To BuildBicep module + configuration YAML: automates Foundry IQ KB assembly from SharePoint (via Graph MCP), internal policy repositories, SAP OneLake Gold tables, and regulatory document repositories. Single declarative YAML = fully assembled enterprise KB. Permission-aware from day one (Purview classification → Foundry IQ access tiers).
Microsoft NativeWork IQ (M365 signals) is GA. No pre-built integration in Enterprise Kit.
Kit TodayMicrosoft Graph MCP adapter exists. Work IQ connection not configured.
To BuildWork IQ connection module: wire Calendar, Mail, Teams, SharePoint, OneDrive, User signals into Knowledge Agent and Workflow Agent blueprints. Include Work IQ permission scoping (agent only accesses its authorised M365 signals). Relevant for BoC meeting scheduling agents, policy update notification agents, regulatory calendar agents.
Microsoft NativePurview lineage for ADF + OneLake: GA. Manual configuration.
Kit TodayNo Purview lineage configuration in kit.
To BuildBicep module: automates Purview data source registration, ADF lineage enablement, OneLake scan rule sets, and column-level classification policy application. Outputs lineage graph visualisation in Purview Studio. Required for OSFI B-10 §5.1 data governance evidence.
WORKSTREAM 4
Regulatory Evidence Automation
The Certification Pipeline generates evidence. The Decision Ledger records decisions. Purview captures lineage. What regulated enterprises need is automated assembly of all this evidence into a single signed bundle, formatted for each regulatory framework.
Microsoft NativeNo OSFI-specific tooling. Evidence must be manually assembled.
Kit TodayCertification Pipeline generates PDFs. Decision Ledger records actions. Not assembled into OSFI B-10 format.
To BuildEvidence bundle assembler: pulls from Decision Ledger (all agent decisions), Certification Pipeline (scorecard PDFs), Purview (lineage graph export), Foundry Continuous Eval (eval results), Red Teaming Agent (pass report), Defender for AI (incident log), APIM AI Gateway (invocation records). Assembles into OSFI B-10 §4.3/§4.4/§5.1 evidence package. Signs with Azure Key Vault. ZIP bundle ready for examiner submission.
Microsoft NativeAzure Policy: infrastructure compliance. No AI-specific continuous compliance.
Kit TodayPolicy packs define rules. No continuous monitoring against those rules.
To BuildScheduled Azure Function (daily): evaluates all registered agents against active policy packs. Generates compliance delta report (new violations since last run). Triggers remediation workflow for P1 violations. Posts summary to Teams channel (configurable). Stores compliance history in Cosmos DB for trend analysis.
Microsoft NativeFoundry Red Teaming Agent: GA. Not pre-integrated into Certification Pipeline.
Kit TodayCertification Pipeline defines Bronze/Silver/Gold stages. No Red Teaming Agent gate.
To BuildAdd Red Teaming Agent as mandatory gate in Silver → Gold promotion: invokes Foundry Red Teaming Agent with agent-specific adversarial test suite, captures results, fails promotion if any P1 adversarial finding. Red Teaming report included in Gold certification package. Banking-specific adversarial prompts: financial data extraction, authority spoofing, OSFI rule override attempts.
WORKSTREAM 5
Platform Operations at Scale
Deploying the platform is the start. Operating it at scale — self-service onboarding, MCP fleet health, business value realisation — requires a second wave of capabilities that turns the platform into a product that business units want to use.
Microsoft NativeAgent 365 CLI for agent registration. No self-service UI for non-technical LoB owners.
Kit TodayCLI-based registration. No portal.
To BuildWeb portal (or Teams app): LoB owners fill a structured form (agent purpose, risk tier, data classification, LoB owner, escalation contact). Form generates agent manifest YAML, submits registration request to AI Platform team for review, triggers CI pipeline on approval. Reduces AI Platform team bottleneck for high-volume onboarding.
Microsoft NativeAPIM AI Gateway telemetry in Azure Monitor. No pre-built MCP fleet dashboard.
Kit Todayobservability/ has KQL queries and OTel schema. No fleet-level dashboard.
To BuildAzure Managed Grafana dashboard (or Power BI): MCP server count by tier, invocation volume by server, error rate by server, latency p50/p95/p99, token usage by server, Toolbox version distribution (how many agents on latest vs pinned), APIM policy violation rate. Alert rules for fleet-wide SLA breaches.
Microsoft NativeNo native ROI or business value tracking in Foundry.
Kit TodayBusiness value framework in kit with generic scorecards.
To BuildBanking-specific KPI templates: FX trade research time reduction (hours → minutes), regulatory report preparation time, incident resolution time (ServiceNow agents), policy exception review throughput. Pre-built scorecard template type F (financial services). Integration with existing MIS/BI reporting via Fabric IQ semantic model.
Microsoft NativeFoundry Memory (Preview): cross-agent shared memory with TTL. No enterprise governance layer.
Kit TodayNo Foundry Memory integration.
To BuildMemory governance layer: memory namespace per LoB (isolation), memory classification labels (matches Purview data classification), TTL policy per classification tier (PII: session-only, internal: 24h, business: 7d), memory audit log in Decision Ledger, conflict resolution policy (last-write-wins vs explicit merge). Prevents memory-based information leakage between LoBs.
IMPLEMENTATION SEQUENCE
Suggested Build Order
P1 gaps should be addressed in the order that maximises enterprise value while maintaining the layered build-on-Microsoft approach.
Sprint 1–2
Identity & Governance Foundation
- G-05: Identity Propagation Registry
- G-07: FIC Zero-Secret SAP BTP Module
- G-06: A2A Delegation Chain Attestation
- G-01: Agent Portfolio Registry Manifest Extension
Sprint 3–4
Data Pipeline & Evidence
- G-08: SAP → OneLake Clean Core Bridge
- G-11: Purview Lineage Auto-Wire
- G-09: Foundry IQ Multi-Source KB Assembly
- G-14: Red Teaming Agent Integration
Sprint 5–6
Regulatory Automation & Scale
- G-12: OSFI B-10 Automated Evidence Bundle
- G-13: Continuous Compliance Monitor
- G-02: Agent Sprawl Monitor KQL Workbook
- G-16: MCP Fleet Health Dashboard