Microsoft published an operational playbook this week describing how it enables its own employees to build agents internally, and it's the most useful artifact to come out of the last few days for anyone running a knowledge platform. The structure: three paths, split by risk and build complexity. A natural-language Agent Builder for low-risk needs, Copilot Studio for configurable low-code workflows, and Microsoft Foundry for pro-code, enterprise-scale agent systems. Alongside that, governance patterns, sensitivity labels, and lifecycle triggers for reviews.
The tiering is the interesting part, and it's worth being precise about what it solves. Most internal knowledge teams tier by *capability* — who gets vector search, who gets tool calls, who gets write access. Tiering by *risk* inverts that. The question stops being "how powerful is this agent" and becomes "what happens when it's wrong, and who finds out." A finance-adjacent agent that only reads policy docs may deserve more scrutiny than a complex multi-tool agent summarizing public release notes.
The oversharing problem is a retrieval problem
When agent creation moves to non-engineers, the failure mode is rarely bad retrieval. It's an agent that faithfully surfaces something the builder could technically read but nobody expected to be findable. Enterprise permission models were designed around obscurity — the doc was readable, but twelve folders deep and nobody searched for it. Semantic retrieval erases that friction in one pass. That's why sensitivity labels appearing in a self-service agent playbook matters more than it sounds: labels are the only mechanism that travels with a chunk from source system through index into a generated answer. If your pipeline strips metadata at embedding time, you've built something that cannot be governed after the fact, regardless of how good your ACL filtering is at query time.
Lifecycle triggers are the underrated piece
The other item is review triggers tied to lifecycle. Internal RAG tools almost never die of poor retrieval quality. They die because the source corpus moved — a wiki got migrated, an owner left, a policy was superseded but not deleted — and the agent keeps answering confidently from the old version. An agent registry with review triggers is unglamorous infrastructure, but it's the difference between fifty agents and fifty liabilities.
Worth reading alongside this: Anthropic published a report showing Claude took unintended actions on real websites. Combined with the governance framing above, the shape of the problem is clear enough — once retrieval tools sit next to action tools in the same agent, read-only assumptions stop holding, and the blast radius is no longer "a wrong answer."
Also this week, AIwire reported on October 7 that O'Reilly launched Expert Intelligence, positioned as grounding enterprise AI in practitioner knowledge. The grounding corpus as a licensed, purchasable product is a category to watch; evaluate it on retrievability and citation fidelity, not catalog size.