I don’t ever remember being excited about the things my parents told me I couldn’t do. It always felt like big brother was infringing on my first amendment rights. “Don’t say this”, “Don’t do that”, “Don’t hang out with them.” As a child I wanted to rebel because I knew best, they were lame, they didn’t have a clue. But there is a scripture that says there is nothing new under the sun and that has never been more true than in the world of Power Platform.
Sure, governance conversations are boring. Sure, the proliferation of AI and low-code tools has made building easier than ever. But easier to build doesn’t mean ready to build. Handing a citizen developer access to every connector in the Power Platform ecosystem without guardrails is like handing a kid a lightsaber and calling them a Jedi. The force may be with them but a Jedi they are not.
The Pattern I Keep Seeing
I have a number of Power Platform engagements during the year and the pattern I see most is building in the default environment and it grinds my gears. To be fair, it’s not the organization’s fault. It’s Microsoft’s and I say that tongue in cheek but with an air of seriousness. Power Platform was designed with the business user in mind and the best way to get users building is to give them somewhere to build. So every user with an M365 license gets access to the default environment straight out of the box. This one is easy to spot unless I run into that one sweetheart customer who says “Duke, we have an environment strategy” and trust me, more on that later.
Here is where it gets interesting. It is not just that every licensed user has access to the default environment. Every user lands there with the Environment Maker security role already assigned. That means they don’t just have read access. They can build. They can create apps, flows, and connections from the moment they are provisioned. No request, no approval, no conversation. They didn’t sneak in through the back door. Microsoft handed them the keys at the front.
What Governance Actually Covers
When most people hear the word governance they tune out. It sounds like paperwork, like red tape, like the IT department trying to slow everyone down. But governance in the context of Power Platform is not about slowing anyone down. It is about making sure the things you build actually work, stay secure, and don’t become someone else’s emergency six months from now.
An environment strategy is an organized approach to defining, classifying, and managing the separate workspaces where solutions move through their lifecycle from development, to testing, to production. As an advisor, one of the topics I frequently cover is risk and without a proper environment strategy you are essentially saying you are happy to assume all of it. I think of an environment strategy like the old Amex commercial. Don’t leave home without one.
In my experience I have seen one too many clients without one and it is problematic for a number of reasons, primarily security. When we skirt security we shuck responsibility. Separation of environments speaks to separation of duties and separation of access controls and that matters more than most organizations realize until it doesn’t.
I have clients who are comfortable letting users test in the dev environment. I am not. When I am in the throes of building a solution I do not want testers in the same space because they are testing a moving target. I may be working on an app and a flow simultaneously and a tester could trigger something that is not ready to be triggered. That creates noise, wastes time, and muddies the environment. Beyond that, working this way means there is no meaningful promotion process. Solutions should move deliberately from dev to UAT to production. That discipline is what keeps untested changes from making it somewhere they should not be.
Beyond environment strategy, governance also covers data loss prevention policies, connector management, security roles, and application lifecycle management. DLP policies are not an IT concern. They are a business concern. They define what data can talk to what systems and what connectors are available to makers. Without them, a well-meaning citizen developer can inadvertently connect a business process to a consumer service and move sensitive data outside the organization without anyone knowing it happened.
The Cost of Doing Nothing
This is the part nobody wants to sit with. Governance feels optional right up until it isn’t. I have seen organizations running automations built by employees who left the company two years ago. The flow is still running. Nobody knows what it touches. Nobody knows what it does. It just runs. That is not a Power Platform problem. That is a governance problem.
When there is no environment strategy, no ALM discipline, and no access controls, what you end up with is an estate you cannot audit, cannot support, and cannot explain to a regulator. You have apps in production that were never tested. You have flows connecting to systems that the business no longer uses. You have connectors touching data that nobody approved. And when something breaks, and it will break, everyone looks at IT and IT looks at a tangle they had no part in creating.
The conversation about governance is uncomfortable. The consequences of not having it are worse. There is a scripture that says there is safety in a multitude of counselors. Governance is that counsel. It is the voice in the room that asks the question nobody wants to ask before something goes wrong instead of after.
The Agentic Era Changes the Stakes
Everything I have described so far applies to the Power Platform as most organizations know it today. Apps, flows, and automations built by makers with varying levels of skill and oversight. The governance conversation is already overdue for most organizations. But there is a new layer coming that makes the urgency significantly higher.
We are moving into the agentic era. Copilot Studio now allows organizations to build AI agents that act autonomously on behalf of users and business processes. These are not apps that wait for someone to click a button. These are agents that reason, decide, and act. They can send emails, update records, trigger workflows, and interact with external systems without a human in the loop.
Think about what that means in an environment with no governance. The Environment Maker problem we talked about earlier gets multiplied. Now it is not just that anyone can build an app. Anyone can deploy an agent. An agent with access to your business data, your customer records, your operational systems. An agent that can take action on your behalf without you knowing it happened until the damage is done.
Agents are not apps. The risk profile is fundamentally different. An ungoverned app can expose data. An ungoverned agent can act on it. That distinction matters and most organizations are not having this conversation yet. Governance was optional for some when we were talking about canvas apps and simple flows. It is not optional when we are talking about autonomous agents operating inside your business processes.
Agent governance means knowing who can build agents, what systems those agents can connect to, what actions they are permitted to take, and how their activity is logged and audited. It means having environment strategy that accounts for agent development and deployment separately from general maker activity. It means DLP policies that have been revisited with AI capabilities in mind. This is not theoretical. It is happening now and the organizations that treat agent governance as an afterthought will feel it.
What Good Looks Like
I promised earlier I would come back to that sweetheart customer who told me they had an environment strategy. That is always a good day. It means the conversation shifts from remediation to optimization. That is where I want every client to be.
Good governance looks like a deliberate environment strategy with dedicated environments for development, UAT, and production. It looks like DLP policies that were designed with the business in mind, not just bolted on after the fact. It looks like ALM discipline where solutions are packaged and promoted through environments properly before they touch live data and live users. It looks like security roles that were assigned intentionally, not inherited by default.
For organizations moving into Copilot Studio and agent development it looks like all of the above plus a clear framework for how agents are built, reviewed, approved, and monitored. The Center of Excellence toolkit that Microsoft provides is a strong starting point. It gives you visibility into what is being built across your tenant, who is building it, and where the risks are concentrated. It is not a silver bullet but it is a foundation.
The goal is not to lock everything down. The goal is to enable makers and agents to do what they do well inside a structure that protects the business. Governance done right does not slow innovation. It makes innovation sustainable.
Have the Conversation Before Something Breaks
I started this article talking about my parents and the rules I didn’t want to follow. Looking back, most of those rules existed because they had seen something I hadn’t. They were trying to keep me from a problem I couldn’t see yet. That is exactly what governance is doing for your Power Platform environment.
The organizations that treat governance as a checkbox exercise will eventually have the conversation they were trying to avoid, except they will have it under pressure, after something has already gone wrong. The organizations that treat it as a business enabler will move faster, build with more confidence, and scale without the chaos.
You don’t have to have it all figured out on day one. But you do have to start the conversation. An environment strategy, even a simple one, is better than none. A DLP policy reviewed annually is better than one that was never created. And if you are already building with Copilot Studio or planning to, start the agent governance conversation now. Not after the first incident.
There is safety in a multitude of counselors. Governance is that counsel. Have the conversation before something breaks.