Governance on DR.365

Built for human pace: what Anthropic's source control rewrite means for enterprise IT strategy

Wed, 14 Oct 2026 07:00:00 +0200

In May 2026, Anthropic merged about 2,500 code changes per day into its monorepo. By September it was more than 30,000. Git and the mirror infrastructure around it could not keep up, so a team of seven built its own version control system and moved the entire monorepo onto it in five months (Anthropic Engineering).

Almost nobody reading this will build a version control system. That isn’t the point of the story. Every organization runs processes that were sized for the speed of people: change advisory boards, four-eyes approvals, access reviews, CI pipelines, budgets calculated in person-days. Once agents do a large share of the work, those processes become the bottleneck, and the question is which of them you redesign before they break.

TL;DR

Agents are becoming the main consumers of your systems. Architecture decisions should assume machine clients that are always online and call APIs at high volume.
Review and approval have to move from “a human looked at everything” to rules that decide where a human must look.
Every agent needs an identity, an accountable person and a cost center. Without those three you can neither govern nor budget agent work.

What Anthropic actually changed

The headlines say “Anthropic threw out Git”. The engineering post is more careful. The new system is called Scion, the review tool Antique. Anthropic explicitly says Scion is not a general replacement for git, because that would mean replacing the whole development toolchain. They published the design so that git platforms can adopt parts of it.

The numbers explain why they did it anyway. The main branch history is almost 100 GB, a compressed working copy more than 25 GB, and CI runs roughly 25 million checkouts per day. Git is designed for distributed clients that work offline. Anthropic’s clients are almost entirely agents and jobs that are always online. Scion moves the expensive work to the server: commits, merges, rebases, history and blame happen there, clients get sparse, virtualized checkouts that load files on demand, and much of the functionality is available through an API without any local repository. According to the post, the new infrastructure uses about 200 times less CPU and memory than the old git mirrors, and CI checkouts take seconds instead of minutes.

Three decisions in the post matter beyond source control:

There is no merge queue with a global lock. Anthropic invested in post-merge and pre-deploy testing instead. Conflicts between concurrent changes happen, and Claude usually fixes them faster than a human would notice them.
Antique can express semantic rules for approvals. A comment-only change gets treated differently from a change to sensitive logic, so human reviewers spend their time where it counts.
Access control at repository and directory level was built in from the start, not added later.

Agents are the new primary client

The first lesson is about architecture. Most enterprise systems assume a person in front of a screen. Agents behave differently: they poll, they run in parallel, and they don’t take lunch breaks.

In Microsoft 365 you can see this today in Microsoft Graph throttling. Microsoft lists two typical causes: many requests across all applications in a tenant, and many requests from one application across tenants. Polling a resource and repeatedly scanning collections are named as patterns that lead to throttling. The recommended alternatives are delta queries and change notifications, and for bulk extraction Microsoft points to Graph Data Connect instead of the REST APIs (Microsoft Learn). SharePoint Online goes one step further: an application that keeps exceeding limits can be blocked entirely (Microsoft Learn).

That guidance was written for integration developers. It now applies to every agent that reads mailboxes, sites or Teams channels on someone’s behalf. When I evaluate an agent scenario, I now ask how it detects changes before I ask what it does. An agent that rescans a document library every ten minutes works fine in the pilot and becomes a problem when 40 departments copy it.

For your own systems the same principle applies in the other direction. If agents are going to be the main consumers of an internal platform, give it a proper API, change feeds and per-client limits. A web UI with a scraping agent in front of it is the git mirror of your organization: it works until the volume grows tenfold.

Review by intent instead of line by line

The second lesson concerns control processes. The Anthropic team still reviews every change, but they review the intent, not every line. Their main job, as they describe it, is telling Claude “no”: when it violates system constraints, or when it over-engineers in response to hypothetical concerns.

In regulated environments this is the uncomfortable part. Many change processes implicitly promise that a qualified person checked everything. At 30,000 changes per day that promise can’t be kept, and honestly it often wasn’t kept at 30 per week either. The CAB that approves a stack of changes in 45 minutes is mostly checking that the form is complete.

In my experience, auditors want evidence that changes are controlled and traceable. NIS2 asks for risk management measures that include security in development and maintenance; it does not prescribe that a human reads every line. That leaves room for a model that ITIL already knows as standard changes, applied to agent output:

Low risk (documentation, tests, formatting, configuration within defined guardrails): automated checks, no mandatory human review, full logging.
Medium risk (business logic, integrations): human review of intent and test evidence, with the agent’s summary as input.
High risk (authentication, permissions, data flows across trust boundaries, anything regulated): line-level review by a named person, the way it has always been.

What decides the tier has to be a rule, not a gut feeling. Anthropic models this in the review tool, and you can model it in branch protection rules, CODEOWNERS files or a Power Automate approval flow. The rule itself is the control that an auditor will want to see.

I would be careful with one part of the Anthropic approach: moving checks after the merge. For an internal developer platform that is a reasonable trade. For a system in a KRITIS environment where a faulty change can reach production directly, I wouldn’t do it. The safeguard has to sit before deployment, even if it no longer sits before the merge.

Every agent needs an identity and an owner

Anthropic built access control into Scion from day one, down to the directory level. In Microsoft 365 the equivalent is the identity layer for agents. Microsoft Entra Agent ID gives agents their own identities in the directory, created from agent identity blueprints. Every agent identity requires a human sponsor who is accountable for purpose, lifecycle and access reviews. If the sponsor leaves, sponsorship transfers to their manager. Conditional Access and access packages from entitlement management apply to agents as well (Microsoft Learn). As of October 2026, identity governance for agents is labeled preview, and the licensing depends on Microsoft 365 E7 or Agent 365 licenses; check the current terms before you plan with it.

On top of that, Microsoft Agent 365 provides the registry as one inventory of Microsoft and non-Microsoft agents, including counts of agents without owners (Microsoft Learn). I described the governance side in more detail in the post on the agent lifecycle.

The strategic point: an agent that runs under a shared service account or a person’s delegated credentials cannot be distinguished in the audit log, cannot be throttled separately and cannot be billed separately. Fixing that later for hundreds of agents is the kind of project nobody wants to fund.

Measuring agent work

The budget side breaks in the same way. Controlling in most IT organizations still calculates in person-days, and that model has no line for agent work. A practical way to close the gap is to route agent sessions through an AI gateway, so that every token and every hour of runtime can be assigned to a project and a repository and priced at real cost.

A feature that needed 20 days last year and 3 days of review plus agent runtime this year doesn’t fit that model. Counting agent hours is a start, but hours are an input metric. What you want to know is the cost per accepted change: tokens and runtime plus the human time for review, rework and the cases where someone had to say “no”. Without the human share, agent work looks cheaper than it is.

For Microsoft agents, Agent 365 observability collects activity data and is meant to support business metrics like usage and time savings (Microsoft Learn). That covers part of the picture. Coding agents outside Microsoft 365 need their own attribution, and that is where the gateway approach comes in.

Decisions for the next twelve months

Anthropic expects other organizations to run into this class of problem within the next six to twelve months. Even if your timeline is longer, these are the decisions I would make now:

Inventory human-paced controls. List every approval, review and pipeline step that assumes a person and a working day. Mark which ones would break at ten times the volume.
Introduce risk tiers for changes. Write down which changes need a human, which need a human for intent only and which need logging only. Make the rule machine-readable.
Give agents their own identities. No shared service accounts, every agent with a sponsor, permissions through access packages with an expiry date.
Design integrations for machine clients. Delta queries, change notifications and API budgets instead of polling and scraping.
Attribute agent cost. Tokens and runtime per project, plus the human review time, from the first productive agent onward.

What I wouldn’t do is copy Anthropic’s tooling. Their problem was 25 million checkouts a day. Yours is more likely a change process that takes two weeks for a configuration change an agent prepared in ten minutes. That is the place to start.

References

Anthropic Engineering: Redesigning source control at Anthropic (October 13, 2026)
Microsoft Learn: Microsoft Graph throttling guidance
Microsoft Learn: Avoid getting throttled or blocked in SharePoint Online
Microsoft Learn: Governing agent identities
Microsoft Learn: Manage agent registry in Microsoft 365 admin center
Microsoft Learn: Agent 365 observability
EUR-Lex: Directive (EU) 2022/2555 (NIS2), Article 21

Agent lifecycle: how much governance does a Copilot agent need?

Mon, 12 Oct 2026 07:00:00 +0200

📝 This series has been extended

In October 2026 this series gained an introductory part. This post was originally part 1 and is now part 2. Part 1 sorts Agent Builder, Copilot Studio and Foundry by who carries the risk.

Building an agent with Agent Builder in Microsoft 365 Copilot takes a few minutes. Getting rid of it takes forever in many tenants, because nobody feels responsible. The colleague who built an agent for the travel expense policy last spring has moved to another department. The agent keeps answering questions anyway, based on a policy that has been out of date since July.

That is the problem an agent lifecycle solves. In this post I describe how I would set up a lifecycle for agents built with Agent Builder and Copilot Studio, and which tools Microsoft now provides for it. My take: not every agent needs the full process. Every agent does need an owner, and that only works for agents that are registered. What does not show up in the agent registry cannot be assigned to a person, reviewed or switched off.

The lifecycle by platform

Part 1 covers which tool fits which builder and who carries the risk. For the lifecycle, the phases stay the same, but where they happen depends on the platform.

IT manages Agent Builder agents (intrinsic model, the platform sets the boundaries) in the Microsoft 365 admin center: visibility, sharing, owners, blocking and deletion. There are no versions and no environments, so the lifecycle here is mostly about sharing, ownership and cleanup.

Copilot Studio (configurable model, the administrator sets the rules) uses application lifecycle management with separate development, test and production environments. Data policies, connector rules and publishing approval are tied to those environments (Microsoft Learn).

Foundry (explicit model, the organization owns model and code) follows your own engineering process: versioning, evaluation and publishing run through the development team’s tools and pipelines (Microsoft Learn). Published Foundry agents appear in the agent registry, and admins can stop them there (Microsoft Learn). The rest of this post focuses on Agent Builder and Copilot Studio. Foundry goes through the same phases, implemented with conventional software engineering.

The bridge between Agent Builder and Copilot Studio is the copy feature: an agent from Microsoft 365 Copilot can be copied to Copilot Studio once it needs more than a personal helper can offer. In lifecycle terms, that is the moment an agent changes zones.

Three zones instead of one process for everything

A single approval process for every agent fails on two sides. An IT review is overkill for the personal agent that summarizes my own meeting notes. A click on “Share” is not enough for an agent that answers payroll questions for 3,000 employees.

Microsoft addresses this with a zone model (Microsoft Learn). In zone 1, anyone can build agents for personal or team productivity, grounded in content they can already access. In zone 2, makers approved by IT build agents for other teams. These agents go through an IT review and are deployed to environments that IT manages. Zone 3 is reserved for organization-wide agents that are treated like any other enterprise application. The current whitepaper Administering and Governing Agents is now structured along the same personal, team and enterprise levels.

Microsoft now maps tools to zones more tightly: zone 1 for Agent Builder and SharePoint agents, zone 2 for Copilot Studio, zone 3 for Foundry and Copilot Studio in professional development. I still allow Agent Builder agents in zone 2 as long as they only read content the team can already access. For me, reach decides the zone, not the tool.

For the lifecycle, the zone decides how many phases an agent goes through and how strict they are. An agent in zone 1 takes the short path. As soon as its reach, data access or criticality grows, it moves to the next zone and into a stricter process.

The seven phases at a glance

The diagram builds on a lifecycle model that has been circulating online. I extended it with the zones, the specific Microsoft tools for each phase and a separate decision gate.

1. Identify

Everything starts with a real problem. Ideas go into a backlog, for example a SharePoint list or a Planner board. Each idea gets a short profile with the problem, the target audience and an accountable owner. Without an owner, the idea goes no further.

2. Assess and prioritize

This is where the most important decision of the whole lifecycle happens: which zone does the agent belong in? I look at value and effort, but mostly at the data. Which knowledge sources will the agent use, who is allowed to read them, and should the agent trigger actions in other systems? The answers also determine the tool. Agent Builder covers many zone 1 and 2 scenarios. Once actions, connectors to line-of-business apps or a broad rollout come into play, the path leads to Copilot Studio. If the agent needs its own model or orchestration, it ends up in Foundry and in the development team’s process.

3. Design and prototype

Success criteria come before building. What does the agent need to answer, and how will I know it does that well? Only then does a prototype take shape: directly in Agent Builder for zone 1, in a Copilot Studio development environment for zones 2 and 3. Microsoft recommends environment routing to send makers to personal developer environments automatically, so not everything ends up in the default environment (Microsoft Learn).

4. Validate and decide

This phase finally has a proper tool. Agent Evaluation in Copilot Studio has been generally available since the end of March. It lets you create test sets, choose evaluation methods and repeat runs across agent versions. A Power Automate connector and a REST API (currently in preview) make it possible to include evaluations in CI/CD pipelines (Microsoft Learn).

Security and data protection belong in this phase too: which data can the agent see, which identity does it run under, and do its permissions match the intended audience? If the agent calls other agents or tools, add a second question: do they act with the user’s permissions or with their own, possibly broader credentials? In Copilot Studio this is set per tool, and a connected agent does not inherit the setting of the agent that calls it. The phase ends with a deliberate decision.

The gate: Go, Change, Hold or Stop

The decision after phase 4 has four possible outcomes. Go leads to production. Change sends the agent back to phase 3 because quality or design still fall short. Hold parks it in the backlog, for example because a data source is not yet properly permissioned. Stop ends the idea in a controlled way.

Many organizations underestimate Stop. An agent that fails its tests should not stay in the tenant as a half-finished prototype.

5. Deploy and scale

In zone 3, nobody edits an agent directly in production. Microsoft recommends packaging agents as managed solutions and promoting them from development through test to production with Power Platform pipelines (Microsoft Copilot Blog). That gives you versioning, an auditable change history and the option to roll back.

Publishing to the organization runs through the Microsoft 365 admin center, where admins can approve or reject submitted agents. A gradual rollout follows. User training belongs in the same plan, otherwise even a good agent goes unused.

6. Operate and monitor

Operations is about usage, quality and cost. Copilot Studio provides analytics, Purview covers audit and data protection, and since May 2026 Agent 365 adds a dedicated control plane for agents. Copilot Studio agents appear in its agent registry once they are made available in Microsoft 365. The same agent can show up more than once, for example as a shared and as a published version (Microsoft Learn). Governance actions are logged in Purview.

Two things are a fixed part of operations for me: keeping knowledge sources current so the agent does not answer from outdated documents, and recertifying permissions on a regular schedule. Anyone working with customers in regulated industries knows this principle from identity management. It applies to agents in the same way.

7. Evolve or retire

Every agent ends at some point, either as a new version or through retirement. New versions go through the lifecycle again, starting at phase 2 or 3 depending on the scope of the change.

The admin center now includes the most important actions for retirement (Microsoft Learn). Admins can assign a new owner to Agent Builder and Copilot Studio agents, even when an agent is already ownerless. The new owner gets full edit and delete permissions plus access to the previous owner’s files, and the previous owner loses all access. Agent Builder agents can now have several owners, which admins can add or remove. Agents without a future can be blocked and deleted, with a 30-day window to restore them.

Microsoft’s Zero Trust workshop sums up the idea well: a lifecycle policy that nobody enforces remains a document (Zero Trust Workshop). Without this cleanup, the number of agents only ever grows.

Guardrails across all phases

Underneath the cycle sit six topics that apply in every phase and every zone: identity and ownership, data protection and compliance, permissions and sharing, environments and ALM, inventory and transparency, and quality and cost. In the diagram I mapped each topic to the tools available for it today, from Entra Agent ID through Purview to the agent registry.

Where it still falls short

The picture is not complete yet. Agent Builder agents have no real ALM with environments and versions. If you want to run one of them seriously, moving it to Copilot Studio is hard to avoid.

Copilot Studio has gaps as well. The built-in evaluations live in the cloud, not in source control, which makes automated quality gates in a pipeline harder than in classic software development. In an ESPC webinar, Stephan Bisser presented a CLI tool that versions test cases as YAML files to close that gap.

Finally, licensing: many registry features are available in the admin center. Risk signals in the registry and the advanced security and compliance capabilities of Agent 365 require Microsoft 365 E7 or an Agent 365 license (Microsoft Learn). Clarify this before you roll out.

Five things you can check tomorrow

Open the agent registry in the Microsoft 365 admin center and filter for agents without an owner.
Check whether environment routing sends Copilot Studio makers to their own developer environments, or whether everyone builds in the default environment.
Define the criteria that move an agent from zone 1 to zone 2, and write them down.
Create a first test set in Agent Evaluation for your most important agent.
Decide who takes over the agents of people who leave the organization.

What happens when an approved agent calls tools and hands work to other agents at runtime is the topic of part 3.