{"id":25896,"date":"2026-10-28T09:00:00","date_gmt":"2026-10-28T08:00:00","guid":{"rendered":"https:\/\/kcpdynamics.com\/?p=25896"},"modified":"2026-10-28T09:00:00","modified_gmt":"2026-10-28T08:00:00","slug":"ai-agent-governance-enterprises","status":"publish","type":"post","link":"https:\/\/kcpdynamics.com\/en\/ai-agent-governance-enterprises\/","title":{"rendered":"Technical and Regulatory Framework for AI Agent Governance in LATAM Enterprises"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"25896\" class=\"elementor elementor-25896 elementor-25873\" data-elementor-settings=\"{&quot;ha_cmc_init_switcher&quot;:&quot;no&quot;}\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c20f3eb8 e-flex e-con-boxed e-con e-parent\" data-id=\"c20f3eb8\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;_ha_eqh_enable&quot;:false}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b2475481 elementor-widget elementor-widget-text-editor\" data-id=\"b2475481\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>An AI agent approves a transfer. <a href=\"https:\/\/kcpdynamics.com\/automatizacion-de-procesos-financieros\/\">It runs a payroll process<\/a>. It responds to a customer with data from their credit history. All of this happens in seconds, without any human having reviewed the action. If your company does not have an <strong>AI agent governance<\/strong> framework in production, that scenario is not hypothetical: it is already happening, with or without your permission.<\/p><p>In LATAM, the challenge is twofold. On one hand, <a href=\"https:\/\/kcpdynamics.com\/dynamics-365-ai-agents-2\/\">autonomous agents operate faster<\/a> than any internal policy. On the other, the regulatory environment \u2014LGPD in Brazil, Habeas Data in Colombia and Argentina, emerging legislation in Peru and Mexico\u2014 demands demonstrable controls, not intentions. This article breaks down what <a title=\"AI agents\" href=\"https:\/\/kcpdynamics.com\/?p=25815\">AI agent<\/a> governance means for enterprises in practice, what risks you are ignoring if you do not implement it, and how to build an AI governance framework that can withstand a real audit.<\/p><aside class=\"nseo-tldr\" style=\"background: #f5f5f5;padding: 16px;border-radius: 4px;margin: 0 0 1.5rem 0\">\n  <strong>Summary:<\/strong> <a title=\"AI agents\" href=\"https:\/\/kcpdynamics.com\/copilot-studio-roi-custom-agents-vs-standard-copilot\/\">AI agent<\/a> governance in LATAM enterprises requires usage policies, technical controls (DLP, Zero Trust, action auditing) and alignment with local regulations such as LGPD and Habeas Data. Without that AI agent governance framework, operational and regulatory risk is immediate. The Microsoft ecosystem \u2014Purview, Entra ID and Sentinel\u2014 offers native controls to make it operational from day one.\n<\/aside><p><em>Article reviewed and updated in October 2026 by the KCP Dynamics AI agent governance team, with more than 40 implementation projects in regulated LATAM enterprises.<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0b697524 dce_masking-none elementor-widget elementor-widget-image\" data-id=\"0b697524\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<picture><source type=\"image\/avif\" srcset=\"https:\/\/kcpdynamics.com\/wp-content\/uploads\/avif\/governance-agentes-de-ia-empresas.avif\"><img decoding=\"async\" src=\"https:\/\/kcpdynamics.com\/wp-content\/uploads\/governance-agentes-de-ia-empresas.jpg\" title=\"\" alt=\"Governance shield with concentric layers of control, monitoring and security in pastel blue and beige tones.\" loading=\"lazy\" \/><\/picture>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-31474388 elementor-widget elementor-widget-heading\" data-id=\"31474388\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">The problem nobody wants to name: shadow AI is already operating in your company<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f55dc495 elementor-widget elementor-widget-text-editor\" data-id=\"f55dc495\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Shadow AI is the use of artificial intelligence tools without formal approval from the IT department or management.<\/strong> It is not a marginal phenomenon. According to Microsoft and LinkedIn&#8217;s Work Trend Index 2024, 78% of AI users at work use their own tools not provided by the company (a phenomenon known as BYOAI), and a majority of leaders acknowledge not having a clear plan to implement and regulate its use. The absence of a solid AI governance framework for AI agents in enterprises is precisely what fuels this phenomenon.<\/p><figure id=\"nv75a270ef\" class=\"nseo-visual nseo-visual--stats\" data-nseo-visual=\"stats\" data-nseo-visual-id=\"8\" style=\"margin:2em 0;padding:22px 24px 16px;background:#fff;border:1px solid #ececf1;border-radius:16px;box-shadow:0 1px 2px rgba(24,24,27,0.04),0 8px 24px -12px rgba(24,24,27,0.08);font-family:Inter,ui-sans-serif,system-ui,-apple-system,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;color:#18181b;line-height:1.4;text-align:left\"><figcaption style=\"margin:0 0 18px;padding:0;font-style:normal;text-align:left;font-size:inherit;color:inherit;line-height:1.4\"><span style=\"display:block;margin:0;font-size:17px;line-height:1.35;font-weight:600;letter-spacing:-0.01em;color:#18181b\">El coste real de ignorar la shadow AI en las empresas<\/span><span style=\"display:block;margin:4px 0 0;font-size:14px;line-height:1.5;color:#52525b\">Dos cifras del informe IBM 2024 que justifican invertir en governance antes de que ocurra el incidente.<\/span><\/figcaption><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 720 159\" width=\"100%\" role=\"img\" aria-labelledby=\"nv75a270ef-t\" style=\"display:block;width:100%;max-width:720px;height:auto;margin:0 auto;overflow:visible;font-family:Inter,ui-sans-serif,system-ui,-apple-system,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif\"><title id=\"nv75a270ef-t\">El coste real de ignorar la shadow AI en las empresas<\/title><defs><radialgradient id=\"nv75a270ef-sph-stat\" cx=\"35%\" cy=\"30%\" r=\"75%\"><stop offset=\"0%\" stop-color=\"#a9abf7\"><\/stop><stop offset=\"55%\" stop-color=\"#6366f1\"><\/stop><stop offset=\"100%\" stop-color=\"#4345a4\"><\/stop><\/radialgradient><lineargradient id=\"nv75a270ef-lg-card\" x1=\"0\" y1=\"1\" x2=\"0\" y2=\"0\"><stop offset=\"0%\" stop-color=\"#ffffff\"><\/stop><stop offset=\"100%\" stop-color=\"#f6f6fe\"><\/stop><\/lineargradient><\/defs><g class=\"nv-item nv-node\" data-nv-label=\"78 %\" data-nv-value=\"de los usuarios de IA en el trabajo usa herramientas no aprobadas por su empresa (BYOAI)\"><rect x=\"0\" y=\"2\" width=\"353\" height=\"153\" rx=\"14\" fill=\"url(#nv75a270ef-lg-card) #f9f9fe\" stroke=\"#e9eafd\"><\/rect><circle class=\"nv-ball\" cx=\"24\" cy=\"24\" r=\"6\" fill=\"url(#nv75a270ef-sph-stat) #6366f1\"><\/circle><text x=\"18\" y=\"76\" font-size=\"38\" font-weight=\"700\" letter-spacing=\"-1\" fill=\"#18181b\" style=\"font-variant-numeric:tabular-nums\">78<\/text><text x=\"64.1\" y=\"76\" font-size=\"17\" font-weight=\"600\" fill=\"#52525b\">%<\/text><text x=\"18\" y=\"102\" font-size=\"13.5\" fill=\"#52525b\" text-anchor=\"start\"><tspan x=\"18\" dy=\"0\">de los usuarios de IA en el trabajo usa<\/tspan><tspan x=\"18\" dy=\"18.9\">herramientas no aprobadas por su empresa<\/tspan><tspan x=\"18\" dy=\"18.9\">(BYOAI)<\/tspan><\/text><\/g><g class=\"nv-item nv-node\" data-nv-label=\"670.000 $\" data-nv-value=\"m\u00e1s cuesta de media una brecha en organizaciones con alto uso no controlado de IA\"><rect x=\"367\" y=\"2\" width=\"353\" height=\"153\" rx=\"14\" fill=\"url(#nv75a270ef-lg-card) #f9f9fe\" stroke=\"#e9eafd\"><\/rect><circle class=\"nv-ball\" cx=\"391\" cy=\"24\" r=\"6\" fill=\"url(#nv75a270ef-sph-stat) #6366f1\"><\/circle><text x=\"385\" y=\"76\" font-size=\"38\" font-weight=\"700\" letter-spacing=\"-1\" fill=\"#18181b\" style=\"font-variant-numeric:tabular-nums\">670.000<\/text><text x=\"545.3\" y=\"76\" font-size=\"17\" font-weight=\"600\" fill=\"#52525b\">$<\/text><text x=\"385\" y=\"102\" font-size=\"13.5\" fill=\"#52525b\" text-anchor=\"start\"><tspan x=\"385\" dy=\"0\">m\u00e1s cuesta de media una brecha en<\/tspan><tspan x=\"385\" dy=\"18.9\">organizaciones con alto uso no controlado<\/tspan><tspan x=\"385\" dy=\"18.9\">de IA<\/tspan><\/text><\/g><\/svg><div style=\"margin-top:14px;padding-top:12px;border-top:1px solid #efeff3\"><span style=\"display:block;margin:0 0 6px;font-size:12.5px;color:#8b8b94\">Fuente: IBM Cost of a Data Breach 2024<\/span><details style=\"margin:0;font-size:13px;color:#52525b\"><summary style=\"cursor:pointer;color:#6366f1;font-weight:500;list-style-position:inside\">Ver los datos<\/summary><div style=\"margin-top:10px\"><table><thead><tr><th>Dato<\/th><th>Qu\u00e9 significa<\/th><\/tr><\/thead><tbody><tr><td>78 %<\/td><td>de los usuarios de IA en el trabajo usa herramientas no aprobadas por su empresa (BYOAI)<\/td><\/tr><tr><td>670.000 $<\/td><td>m\u00e1s cuesta de media una brecha en organizaciones con alto uso no controlado de IA<\/td><\/tr><\/tbody><\/table><\/div><\/details><\/div><\/figure><p>In LATAM, where the pressure to digitize is high and control budgets are tight, shadow AI grows faster than the policies that should contain it. IBM, in its Cost of a Data Breach 2024 report, notes that 20% of organizations suffered a breach related to security incidents linked to shadow AI, and that in those with high levels of uncontrolled use the average cost of a breach was approximately $670,000 above the average. AI agent governance in enterprises is, in that context, a direct protection investment.<\/p><p>The qualitative leap with autonomous agents is critical. An employee who uses ChatGPT to draft an email is a data leakage risk. An AI agent that accesses your ERP, queries customer records and executes actions on your behalf is an operational, regulatory and reputational risk of a different order. Agents can introduce false content, execute unauthorized actions or become attack vectors if their digital identities are not managed securely. For this reason, the model risk management associated with autonomous agents \u2014and the AI agent governance in enterprises that underpins it\u2014 must include identity management as an essential part of the framework, not as an afterthought.<\/p><p>At KCP Dynamics we see this in real projects: <strong>the gap does not appear in the demo, but three months later<\/strong>, when the agent has been operating for weeks with broader permissions than necessary and nobody has audited it. It is the most common symptom of an AI agent governance framework in enterprises that exists only on paper.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0d4eec8 elementor-widget elementor-widget-heading\" data-id=\"f0d4eec8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">The LATAM regulatory framework every CTO must know<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-98f8221c elementor-widget elementor-widget-text-editor\" data-id=\"98f8221c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Governing AI agents in enterprises is not just a good practice: in LATAM it is a legal obligation that is tightening. Regulation is not uniform \u2014each country advances at its own pace and with different emphases\u2014, but the regional pattern is clear: classification by risk level, transparency requirements and human oversight in critical systems. The <em>human-in-the-loop<\/em> principle \u2014keeping a person in the decision chain when the impact is significant\u2014 is present explicitly or implicitly in all relevant legislation in the region. Understanding this regulatory framework is indispensable for any AI agent governance strategy in enterprises in the region.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8d6b312f elementor-widget elementor-widget-heading\" data-id=\"8d6b312f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Brazil: LGPD and the most advanced framework in the region<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73d1fe8c elementor-widget elementor-widget-text-editor\" data-id=\"73d1fe8c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Brazil&#8217;s LGPD is the most influential privacy law in LATAM, both in scope and enforcement. During 2024, it incorporated standard contractual clauses for international data transfers, gave data subjects more control over their own data, tightened penalties for non-compliance and expanded reporting requirements. For AI agents that process data from Brazilian customers, this means that <strong>every automated action must be traceable, explainable and reversible<\/strong>. The AI agent governance framework in enterprises must reflect these requirements in its technical controls.<\/p><p>On December 10, 2024, the Brazilian Federal Senate approved PL 2338\/2023, a bill that proposes rights for people affected by algorithmic decisions, including the right to explainability, and transparency obligations regarding the data used to train models. If your agent makes decisions that affect people \u2014credit approval, risk classification, care prioritization\u2014, you need an auditable record of why it made that decision. That is exactly what a mature AI governance framework for AI agents in enterprises must guarantee.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6a1a59d1 elementor-widget elementor-widget-heading\" data-id=\"6a1a59d1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Colombia, Argentina and Habeas Data<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8cb2c930 elementor-widget elementor-widget-text-editor\" data-id=\"8cb2c930\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Colombia maintains a solid and regionally recognized model, and during 2025 proposals were discussed to strengthen it in the face of artificial intelligence challenges. The Habeas Data principle \u2014the right of every person to know, correct and delete their data\u2014 applies directly to any agent operating on customer or employee databases. The AI agent governance model in enterprises must incorporate explicit mechanisms to exercise these rights in an automated way.<\/p><p>The sanctions regime in the region is active, <strong>with more than 120 sanctions in the first half of 2025 alone<\/strong>, and the requirements for transparency and mechanisms to mitigate bias in AI systems are already part of formal obligations. Ignoring AI agent governance in enterprises is not a strategic option: it is a direct and quantifiable exposure.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-09c9dbb7 elementor-widget elementor-widget-heading\" data-id=\"09c9dbb7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Peru, Mexico and the effect of the EU AI Act<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a6888342 elementor-widget elementor-widget-text-editor\" data-id=\"a6888342\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Peru already has an approved law: Law 31814 was complemented in September 2025 with the publication of Supreme Decree 115-2025-PCM, which approves its regulations. Mexico is advancing with proposals that follow the risk-classification model. And for companies with operations in Europe, <a href=\"https:\/\/wsclegal.com\/en\/how-will-the-eu-ai-act-impact-latin-america\/\" target=\"_blank\" rel=\"noopener\">the EU AI Act has extraterritorial reach<\/a>: if a Latin American company develops or uses an AI system that produces outputs used in the EU \u2014for example, an agent that assesses the creditworthiness of European customers\u2014, it falls within the scope of the regulation. <strong>AI compliance in LATAM is no longer just local<\/strong>, and the AI agent governance framework in enterprises must simultaneously address local and international regulatory frameworks. The concepts of <em>responsible AI<\/em> and mandatory human oversight for high-risk systems, central to the EU AI Act, are actively filtering into national legislation across the region.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b747c610 elementor-widget elementor-widget-heading\" data-id=\"b747c610\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">The three technical pillars of AI agent governance<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cf4ccdca dce_masking-none elementor-widget elementor-widget-image\" data-id=\"cf4ccdca\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<picture><source type=\"image\/avif\" srcset=\"https:\/\/kcpdynamics.com\/wp-content\/uploads\/avif\/governance-agentes-de-ia-empresas-los-tres-pilares-tecnicos-del-governance-de-ag.avif\"><img decoding=\"async\" src=\"https:\/\/kcpdynamics.com\/wp-content\/uploads\/governance-agentes-de-ia-empresas-los-tres-pilares-tecnicos-del-governance-de-ag.jpg\" title=\"\" alt=\"Three technical governance pillars: monitoring, usage policies and enterprise AI security in a vertical structure.\" loading=\"lazy\" \/><\/picture>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c862d37c elementor-widget elementor-widget-text-editor\" data-id=\"c862d37c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Having an AI usage policy in enterprises is necessary, but not sufficient. Real AI agent governance in enterprises is built on technical controls that operate in real time, not on PDF documents that nobody reads. At KCP Dynamics, we work with three pillars that complement each other and that any medium-to-large company can implement progressively.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d2c2eefc elementor-widget elementor-widget-heading\" data-id=\"d2c2eefc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">DLP: preventing data from leaving the perimeter<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2c2de046 elementor-widget elementor-widget-text-editor\" data-id=\"2c2de046\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>Data Loss Prevention (DLP) applied to artificial intelligence<\/strong> means establishing rules that detect and block the transmission of sensitive data to unauthorized AI tools. In practice: if an employee tries to paste a contract containing customer data into an external AI chat, the system intercepts it before the data leaves. This control is one of the foundations of AI agent governance in enterprises.<\/p><p>DLP for autonomous agents adds an additional layer: it not only controls what humans send, but also what the agents themselves query, process and transmit. An AI agent connected to your Dynamics 365 can access financial records, customer data and contractual documents. <strong>Without DLP policies specific to agents, that access is invisible to the security team.<\/strong> Usage policies must specify what data each agent can query, in what context and at what classification level. Integrating DLP is not optional in the AI agent governance framework in enterprises: it is the first technical filter that turns a written policy into a real control.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3d9ab6fa elementor-widget elementor-widget-heading\" data-id=\"3d9ab6fa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Zero Trust: no agent is trusted by default<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6ea0a5b7 elementor-widget elementor-widget-text-editor\" data-id=\"6ea0a5b7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The Zero Trust model applied to enterprise AI security starts from a simple premise: <strong>no agent, no user and no system has access by default<\/strong>. Every access request is verified, every action is recorded and privileges are granted only for the specific task the agent must perform. This principle is one of the pillars of AI agent governance in enterprises that want to operate with real guarantees.<\/p><p>In environments with AI agents, this translates into individual digital identities for each agent \u2014not shared service accounts\u2014, minimum necessary permissions (principle of least privilege), and periodic review of those permissions. An agent that manages invoices does not need access to HR data. A customer service agent does not need to see product margins. <strong>Zero Trust enforces that separation technically, not just on paper.<\/strong> In the context of AI agent governance in enterprises, this model turns the principle of least privilege into a verifiable operational reality.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8403a7e elementor-widget elementor-widget-heading\" data-id=\"f8403a7e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Agent action auditing: the record that saves you in an inspection<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9cbdfd44 elementor-widget elementor-widget-text-editor\" data-id=\"9cbdfd44\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>When a regulator asks &#8220;what did your agent do with this customer&#8217;s data?&#8221;, you need a concrete answer, not an estimate. <strong>Agent action auditing is the immutable log that records what it queried, what it processed, what it executed and when.<\/strong> Without this record, AI agent governance in enterprises is incomplete from a regulatory standpoint.<\/p><p>This record has two functions. The first is operational: it allows detecting anomalous behavior before it generates an incident. The second is regulatory: in an environment with LGPD or Habeas Data, that trace is not optional. It is the evidence that demonstrates that the AI agent governance framework in enterprises works in production. Transparency in models \u2014one of the principles of <em>responsible AI<\/em>\u2014 requires precisely this type of trace to detect and mitigate bias in the data processed.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-afcd1cfc elementor-widget elementor-widget-heading\" data-id=\"afcd1cfc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Governance in the Microsoft ecosystem: Purview, Entra ID and Sentinel<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5fe405ad elementor-widget elementor-widget-text-editor\" data-id=\"5fe405ad\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The three technical pillars described are not abstract concepts: they have native implementation on the platform where KCP Dynamics deploys its projects. Microsoft has built an AI agent governance layer in enterprises that connects directly with Dynamics 365 and <a title=\"Copilot Studio\" href=\"https:\/\/kcpdynamics.com\/?p=25814\">Copilot Studio<\/a>, and that has matured significantly in 2025-2026.<\/p><p><strong>Microsoft Purview<\/strong> is the central control for DLP and information. <a href=\"https:\/\/reality-tech.com\/blog\/ai-agent-governance-in-microsoft-purview\" target=\"_blank\" rel=\"noopener\">Purview protects enterprise data through real-time DLP, sensitivity labels and centralized risk visibility<\/a>, ensuring that agents and Copilot only access information that the user is authorized to see. In terms of AI agent governance in enterprises, Purview acts as the control layer that makes every agent interaction with data auditable. Additionally, <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/01\/14\/microsoft-named-a-leader-in-idc-marketscape-for-unified-ai-governance-platforms\/\" target=\"_blank\" rel=\"noopener\">Microsoft Purview Compliance Manager automates adherence to more than 100 regulatory frameworks<\/a>, which is especially useful when a company operates simultaneously under LGPD, Habeas Data and the EU AI Act.<\/p><p><strong>Microsoft Entra ID<\/strong> \u2014and in particular <strong>Entra Agent ID<\/strong>\u2014 solves the agent identity problem. <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/05\/19\/microsoft-extends-zero-trust-to-secure-the-agentic-workforce\/\" target=\"_blank\" rel=\"noopener\">Microsoft has introduced Entra Agent ID as an identity designed specifically for AI agents<\/a>, with full lifecycle management: from creation to deactivation. Each agent operates under a unique and traceable identity, with access recertified periodically and revoked when it is no longer in use. <strong>This eliminates the risk of orphaned agents with active permissions<\/strong>, one of the most frequent attack vectors in environments with multiple deployed agents. For AI agent governance in enterprises, a unique, per-agent managed identity is a non-negotiable requirement.<\/p><p><strong>Microsoft Sentinel<\/strong> closes the cycle with the detection and response layer. <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/09\/30\/empowering-defenders-in-the-era-of-agentic-ai-with-microsoft-sentinel\/\" target=\"_blank\" rel=\"noopener\">Sentinel organizes and enriches security data, enabling AI agents to detect problems faster, investigate with greater clarity and respond automatically when necessary<\/a>. Integrated with Purview and Defender, it provides the immutable agent action log required by any regulatory audit. For AI agent governance in enterprises working in the Microsoft ecosystem, these three products are not optional: they are the technical backbone of the framework.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dc59375b elementor-widget elementor-widget-heading\" data-id=\"dc59375b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Real case: from zero controls to detection in 4 hours<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d8708f5d elementor-widget elementor-widget-text-editor\" data-id=\"d8708f5d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The above concepts make sense with a concrete example. A financial services company in Colombia \u2014a KCP Dynamics client, data anonymized\u2014 had three AI agents in production: one for credit risk classification, one for customer service and one for payment reconciliation. None had an individual identity assigned; all three operated under the same shared service account. There were no differentiated audit logs or DLP policies specific to agents. In other words, AI agent governance in this company was nonexistent in practice.<\/p><p>Six weeks into operation, an internal review detected that the customer service agent had accessed commercial margin records that it did not need for its function. The access was not malicious \u2014it was a permissions configuration error\u2014, but <strong>it had been active for weeks without anyone noticing<\/strong>. In a regulatory audit scenario, that uncontrolled access would have represented direct exposure under Habeas Data. This case illustrates precisely why AI agent governance in enterprises cannot be postponed until after deployment.<\/p><p>After implementing the governance model \u2014Entra Agent ID for individual identities, DLP policies in Purview and audit logs in Sentinel\u2014, the detection time for behavioral anomalies was reduced to less than 4 hours. The payment reconciliation agent, which operates on sensitive financial data, was placed under mandatory human oversight for any action exceeding a defined threshold: a <em>human-in-the-loop<\/em> mechanism that satisfies both the company&#8217;s internal requirements and the demands of ANIF and the Colombian Financial Superintendency. <strong>The cost of implementing the AI agent governance framework was a fraction of the potential cost of a regulatory sanction<\/strong> or a data breach in that context.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6043990a elementor-widget elementor-widget-heading\" data-id=\"6043990a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How to build an AI usage policy in your company from scratch<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8fd44d9a elementor-widget elementor-widget-text-editor\" data-id=\"8fd44d9a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>An AI usage policy in enterprises that actually works is not written in an afternoon. But it does not require years either. The organizations that advance fastest in AI agent governance are those that start with a limited scope and scale it. The common mistake is trying to govern everything at once and governing nothing in practice.<\/p><p>The starting point is the inventory: <strong>what agents and AI are operating in your company today, with or without approval?<\/strong> Include the tools used by the finance team, those used by sales, those used by IT. The shadow AI you cannot see is the one that causes the most damage. Once you have the inventory, you can classify by risk level \u2014access to personal data, access to financial systems, ability to execute actions\u2014 and prioritize controls. This inventory is the first formal act of AI agent governance in enterprises that want to move from intention to real control.<\/p><p>The second step is to define roles and responsibilities. AI compliance in LATAM requires that someone in the organization be responsible for the decisions an agent makes. <strong>If the agent fails, who is accountable?<\/strong> That question must have a named answer before the agent goes into production. In the AI agent governance framework in enterprises, that assignment of responsibility is as important as any technical control.<\/p><p>The third step is to establish technical controls \u2014DLP, Zero Trust, auditing\u2014 and document them in a way that an external auditor can verify. It is not enough for the controls to exist: they must be demonstrable. In sectors such as financial services or regulated manufacturing, that demonstrability is the difference between passing an audit and facing a sanction. <strong>AI agent governance in enterprises in these sectors is, in many cases, already a contractual requirement<\/strong> with clients and partners.<\/p><aside class=\"nseo-callout nseo-callout--consejo\" style=\"background: #eff6ff;border-left: 4px solid #2563eb;padding: 12px 16px;margin: 1rem 0\">\n  <strong>Tip:<\/strong> Start the AI agent inventory with an anonymous survey to teams. Most organizations discover tools that IT was unaware of. That data, however uncomfortable, is the real starting point of AI agent governance in enterprises.\n<\/aside>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9e0ce5a8 elementor-widget elementor-widget-heading\" data-id=\"9e0ce5a8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What sets apart companies that scale securely<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-01e0127f elementor-widget elementor-widget-text-editor\" data-id=\"01e0127f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>There is an idea circulating in the market that is worth debunking: that AI agent governance slows adoption in enterprises. KCP Dynamics&#8217;s experience with clients in manufacturing, retail and financial services in LATAM says the opposite. <strong>Companies with solid AI agent governance frameworks adopt more agents, faster, with fewer incidents.<\/strong> The reason is simple: when teams know that a clear approval process exists, they stop using unauthorized tools on their own and start using the approved ones with confidence.<\/p><p>By adhering to strict data sovereignty and <em>responsible AI<\/em> standards, a company in LATAM can access government and financial contracts that are contractually closed to non-compliant competitors. Enterprise AI security is not just a defensive shield: it is a competitive advantage in regulated sectors. AI agent governance in enterprises is, in that sense, a business enabler as much as a risk control.<\/p><p>The other differentiating factor is the speed of response to incidents. An agent operating without AI agent governance can be generating a problem for weeks before anyone detects it. A governed agent has configured alerts, defined behavioral thresholds and a documented response protocol. <strong>The difference between a minor incident and a reputational crisis is usually measured in hours of detection.<\/strong> That rapid response capability is one of the most tangible benefits of model risk management applied to autonomous agents in enterprises.<\/p><p>At KCP Dynamics we support medium and large enterprises in LATAM in designing and implementing these AI agent governance frameworks, integrating controls directly into the <a href=\"https:\/\/kcpdynamics.com\/copilot-studio-how-to-create-your-personalized-ai\/\">Microsoft Dynamics 365 and Copilot Studio environments where agents operate<\/a>. Not as an additional layer of bureaucracy, but as part of the workflow from day one.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-88bd9fdb elementor-widget elementor-widget-heading\" data-id=\"88bd9fdb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Where to start: the 90-day governance roadmap<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3d4219eb elementor-widget elementor-widget-text-editor\" data-id=\"3d4219eb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>AI agent governance in enterprises does not require an 18-month project to generate value. With a structured 90-day roadmap, a medium-sized organization can go from zero controls to an operational framework that can withstand a basic audit.<\/p><figure id=\"nv00dcfbff\" class=\"nseo-visual nseo-visual--steps\" data-nseo-visual=\"steps\" data-nseo-visual-id=\"7\" style=\"margin:2em 0;padding:22px 24px 16px;background:#fff;border:1px solid #ececf1;border-radius:16px;box-shadow:0 1px 2px rgba(24,24,27,0.04),0 8px 24px -12px rgba(24,24,27,0.08);font-family:Inter,ui-sans-serif,system-ui,-apple-system,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;color:#18181b;line-height:1.4;text-align:left\"><figcaption style=\"margin:0 0 18px;padding:0;font-style:normal;text-align:left;font-size:inherit;color:inherit;line-height:1.4\"><span style=\"display:block;margin:0;font-size:17px;line-height:1.35;font-weight:600;letter-spacing:-0.01em;color:#18181b\">Roadmap de governance de agentes de IA en 90 d\u00edas<\/span><span style=\"display:block;margin:4px 0 0;font-size:14px;line-height:1.5;color:#52525b\">Tres fases secuenciales: no pases a la siguiente sin cerrar la anterior.<\/span><\/figcaption><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 720 195\" width=\"100%\" role=\"img\" aria-labelledby=\"nv00dcfbff-t\" style=\"display:block;width:100%;max-width:720px;height:auto;margin:0 auto;overflow:visible;font-family:Inter,ui-sans-serif,system-ui,-apple-system,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif\"><title id=\"nv00dcfbff-t\">Roadmap de governance de agentes de IA en 90 d\u00edas<\/title><defs><radialgradient id=\"nv00dcfbff-sph-step\" cx=\"35%\" cy=\"30%\" r=\"75%\"><stop offset=\"0%\" stop-color=\"#a9abf7\"><\/stop><stop offset=\"55%\" stop-color=\"#6366f1\"><\/stop><stop offset=\"100%\" stop-color=\"#4345a4\"><\/stop><\/radialgradient><radialgradient id=\"nv00dcfbff-shadow\"><stop offset=\"0%\" stop-color=\"#18181b\" stop-opacity=\"0.16\"><\/stop><stop offset=\"100%\" stop-color=\"#18181b\" stop-opacity=\"0\"><\/stop><\/radialgradient><radialgradient id=\"nv00dcfbff-halo\"><stop offset=\"0%\" stop-color=\"#6366f1\" stop-opacity=\"0.22\"><\/stop><stop offset=\"100%\" stop-color=\"#6366f1\" stop-opacity=\"0\"><\/stop><\/radialgradient><\/defs><line x1=\"152\" y1=\"30\" x2=\"328\" y2=\"30\" stroke=\"#a9abf7\" stroke-width=\"1.5\" stroke-dasharray=\"2 5\" stroke-linecap=\"round\"><\/line><path d=\"M324 26l5 4-5 4\" fill=\"none\" stroke=\"#9294f5\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><\/path><line x1=\"392\" y1=\"30\" x2=\"568\" y2=\"30\" stroke=\"#a9abf7\" stroke-width=\"1.5\" stroke-dasharray=\"2 5\" stroke-linecap=\"round\"><\/line><path d=\"M564 26l5 4-5 4\" fill=\"none\" stroke=\"#9294f5\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><\/path><g class=\"nv-item nv-node\" data-nv-label=\"D\u00edas 1-30: Visibilidad\" data-nv-value=\"Inventario de herramientas autorizadas y no autorizadas, clasificaci\u00f3n por nivel de riesgo y designaci\u00f3n de responsables por agente.\"><ellipse cx=\"120\" cy=\"57\" rx=\"18.7\" ry=\"4.4\" fill=\"url(#nv00dcfbff-shadow)\"><\/ellipse><circle cx=\"120\" cy=\"30\" r=\"34.1\" fill=\"url(#nv00dcfbff-halo)\"><\/circle><circle class=\"nv-ball\" cx=\"120\" cy=\"30\" r=\"22\" fill=\"url(#nv00dcfbff-sph-step) #6366f1\" stroke=\"rgba(24,24,27,0.10)\" stroke-width=\"1\"><\/circle><text x=\"120\" y=\"35.5\" font-size=\"16\" fill=\"#ffffff\" text-anchor=\"middle\" font-weight=\"700\"><tspan x=\"120\" dy=\"0\">1<\/tspan><\/text><text x=\"120\" y=\"86\" font-size=\"15\" fill=\"#18181b\" text-anchor=\"middle\" font-weight=\"600\"><tspan x=\"120\" dy=\"0\">D\u00edas 1-30: Visibilidad<\/tspan><\/text><text x=\"120\" y=\"108\" font-size=\"13.5\" fill=\"#52525b\" text-anchor=\"middle\"><tspan x=\"120\" dy=\"0\">Inventario de herramientas<\/tspan><tspan x=\"120\" dy=\"18.9\">autorizadas y no autorizadas,<\/tspan><tspan x=\"120\" dy=\"18.9\">clasificaci\u00f3n por nivel de<\/tspan><tspan x=\"120\" dy=\"18.9\">riesgo y designaci\u00f3n de\u2026<\/tspan><\/text><\/g><g class=\"nv-item nv-node\" data-nv-label=\"D\u00edas 31-60: Controles t\u00e9cnicos\" data-nv-value=\"Activaci\u00f3n de pol\u00edticas DLP para IA, identidades individuales para agentes y logs de auditor\u00eda en sistemas cr\u00edticos.\"><ellipse cx=\"360\" cy=\"57\" rx=\"18.7\" ry=\"4.4\" fill=\"url(#nv00dcfbff-shadow)\"><\/ellipse><circle class=\"nv-ball\" cx=\"360\" cy=\"30\" r=\"22\" fill=\"url(#nv00dcfbff-sph-step) #6366f1\" stroke=\"rgba(24,24,27,0.10)\" stroke-width=\"1\"><\/circle><text x=\"360\" y=\"35.5\" font-size=\"16\" fill=\"#ffffff\" text-anchor=\"middle\" font-weight=\"700\"><tspan x=\"360\" dy=\"0\">2<\/tspan><\/text><text x=\"360\" y=\"86\" font-size=\"15\" fill=\"#18181b\" text-anchor=\"middle\" font-weight=\"600\"><tspan x=\"360\" dy=\"0\">D\u00edas 31-60: Controles<\/tspan><tspan x=\"360\" dy=\"19.5\">t\u00e9cnicos<\/tspan><\/text><text x=\"360\" y=\"127.5\" font-size=\"13.5\" fill=\"#52525b\" text-anchor=\"middle\"><tspan x=\"360\" dy=\"0\">Activaci\u00f3n de pol\u00edticas DLP<\/tspan><tspan x=\"360\" dy=\"18.9\">para IA, identidades<\/tspan><tspan x=\"360\" dy=\"18.9\">individuales para agentes y<\/tspan><tspan x=\"360\" dy=\"18.9\">logs de auditor\u00eda en sistemas\u2026<\/tspan><\/text><\/g><g class=\"nv-item nv-node\" data-nv-label=\"D\u00edas 61-90: Pol\u00edtica y proceso\" data-nv-value=\"Redacci\u00f3n y aprobaci\u00f3n de la pol\u00edtica de uso de IA, proceso de aprobaci\u00f3n para nuevos agentes y primera revisi\u00f3n de permisos bajo Zero Trust\"><ellipse cx=\"600\" cy=\"57\" rx=\"18.7\" ry=\"4.4\" fill=\"url(#nv00dcfbff-shadow)\"><\/ellipse><circle class=\"nv-ball\" cx=\"600\" cy=\"30\" r=\"22\" fill=\"url(#nv00dcfbff-sph-step) #6366f1\" stroke=\"rgba(24,24,27,0.10)\" stroke-width=\"1\"><\/circle><text x=\"600\" y=\"35.5\" font-size=\"16\" fill=\"#ffffff\" text-anchor=\"middle\" font-weight=\"700\"><tspan x=\"600\" dy=\"0\">3<\/tspan><\/text><text x=\"600\" y=\"86\" font-size=\"15\" fill=\"#18181b\" text-anchor=\"middle\" font-weight=\"600\"><tspan x=\"600\" dy=\"0\">D\u00edas 61-90: Pol\u00edtica y<\/tspan><tspan x=\"600\" dy=\"19.5\">proceso<\/tspan><\/text><text x=\"600\" y=\"127.5\" font-size=\"13.5\" fill=\"#52525b\" text-anchor=\"middle\"><tspan x=\"600\" dy=\"0\">Redacci\u00f3n y aprobaci\u00f3n de la<\/tspan><tspan x=\"600\" dy=\"18.9\">pol\u00edtica de uso de IA, proceso<\/tspan><tspan x=\"600\" dy=\"18.9\">de aprobaci\u00f3n para nuevos<\/tspan><tspan x=\"600\" dy=\"18.9\">agentes y primera revisi\u00f3n de\u2026<\/tspan><\/text><\/g><\/svg><div style=\"margin-top:14px;padding-top:12px;border-top:1px solid #efeff3\"><details style=\"margin:0;font-size:13px;color:#52525b\"><summary style=\"cursor:pointer;color:#6366f1;font-weight:500;list-style-position:inside\">Ver los datos<\/summary><div style=\"margin-top:10px\"><ol><li><strong>D\u00edas 1-30: Visibilidad<\/strong>: Inventario de herramientas autorizadas y no autorizadas, clasificaci\u00f3n por nivel de riesgo y designaci\u00f3n de responsables por agente.<\/li><li><strong>D\u00edas 31-60: Controles t\u00e9cnicos<\/strong>: Activaci\u00f3n de pol\u00edticas DLP para IA, identidades individuales para agentes y logs de auditor\u00eda en sistemas cr\u00edticos.<\/li><li><strong>D\u00edas 61-90: Pol\u00edtica y proceso<\/strong>: Redacci\u00f3n y aprobaci\u00f3n de la pol\u00edtica de uso de IA, proceso de aprobaci\u00f3n para nuevos agentes y primera revisi\u00f3n de permisos bajo Zero Trust<\/li><\/ol><\/div><\/details><\/div><\/figure><ul>\n  <li><strong>Days 1-30 \u2014 Visibility:<\/strong> inventory of AI tools in use (authorized and unauthorized), classification by risk level and designation of responsible parties per agent or system. This phase is the foundation of AI agent governance in enterprises and cannot be skipped.<\/li>\n  <li><strong>Days 31-60 \u2014 Technical controls:<\/strong> activation of DLP policies for AI in Purview, configuration of individual identities with Entra Agent ID for existing agents and enabling audit logs in Sentinel for critical systems. These are the controls that give technical substance to the AI agent governance framework in enterprises.<\/li>\n  <li><strong>Days 61-90 \u2014 Policy and process:<\/strong> drafting and approval of the company&#8217;s AI usage policy, definition of the approval process for new agents, <em>human-in-the-loop<\/em> mechanisms for high-impact decisions and first permissions review under Zero Trust criteria. Upon completing this phase, AI agent governance in enterprises ceases to be an intention and becomes an institutionalized process.<\/li>\n<\/ul><p>This roadmap does not solve everything. But it does close the most critical gaps \u2014those that generate immediate regulatory exposure\u2014 and creates the foundation on which to scale the AI agent governance framework in enterprises as agent adoption grows. <strong>What you cannot afford is to wait for the incident to occur before starting to govern.<\/strong><\/p><p>If your company is at that inflection point \u2014agents already in production or under evaluation, regulation looming and no clear AI agent governance framework\u2014, at KCP Dynamics we can help you build that roadmap with the right controls from day one.<\/p><section class=\"nseo-faq\">\n  <h2>Frequently asked questions<\/h2>\n  <details>\n    <summary>How much does it cost to implement an AI agent governance framework?<\/summary>\n    <p>The cost varies depending on the size of the organization and the number of agents in production, but in medium-sized LATAM enterprises the typical range is between an 8 to 16-week consulting project plus the activation of tool licenses such as Microsoft Purview and Sentinel. What matters is the comparison: the average cost of a data breach in organizations with uncontrolled shadow AI exceeds $670,000 above the average, according to IBM. The AI agent governance framework in enterprises, implemented progressively, typically pays for itself before the end of the first year of operation.<\/p>\n  <\/details>\n  <details>\n    <summary>What happens if we already have agents in production without controls?<\/summary>\n    <p>It is the most common situation in companies that have not yet formalized their AI agent governance. The first step is the inventory: identifying which agents exist, with what permissions they operate and what data they process. From there, controls are prioritized by regulatory risk level \u2014agents that touch personal data or execute financial transactions go first. It is not necessary to halt operations: DLP, identity and auditing controls can be activated incrementally without interrupting existing workflows. What is not advisable is to continue operating without visibility while designing the perfect framework.<\/p>\n  <\/details>\n  <details>\n    <summary>How does governance integrate with Microsoft Purview and Entra ID?<\/summary>\n    <p>Microsoft Purview manages DLP policies and data classification: it defines what information each agent can query and blocks unauthorized transmissions in real time. Microsoft Entra Agent ID assigns a unique identity to each agent, with specific permissions and a managed lifecycle \u2014including periodic review and automatic revocation when the agent is no longer in use. Microsoft Sentinel centralizes audit logs and detects anomalous behavior. All three products integrate natively with Dynamics 365 and Copilot Studio, which are the environments where KCP Dynamics deploys agents in production. This integration is the technical foundation of AI agent governance in enterprises in the Microsoft ecosystem.<\/p>\n  <\/details>\n  <details>\n    <summary>Does the EU AI Act affect companies that only operate in LATAM?<\/summary>\n    <p>It depends on whether the AI systems produce outputs that affect people or companies within the European Union. The EU AI Act has extraterritorial reach: if a Latin American company uses an AI agent to assess creditworthiness, manage HR or classify risk, and that agent operates on data from people in the EU or its results are used there, the company falls within the scope of the regulation. Furthermore, European companies are already incorporating EU AI Act compliance clauses into their supplier contracts, which affects any LATAM company that is part of that value chain. In all these cases, AI agent governance in enterprises must simultaneously address local and European frameworks.<\/p>\n  <\/details>\n  <details>\n    <summary>Which sectors have the strictest governance requirements in LATAM?<\/summary>\n    <p>Financial services is the sector with the greatest regulatory pressure: agents involved in credit decisions, scoring or payment reconciliation are under direct scrutiny from financial superintendencies in Colombia, Brazil, Mexico and Argentina. The healthcare sector follows closely, especially in Brazil under the LGPD, due to the sensitive nature of clinical data. Regulated manufacturing \u2014pharmaceuticals, food, medical devices\u2014 also faces traceability requirements that extend to AI systems participating in the production chain. In all these sectors, AI agent governance in enterprises is already, in many cases, a contractual requirement with clients and certification bodies.<\/p>\n  <\/details>\n  <details>\n    <summary>What is &#8216;human-in-the-loop&#8217; and when is it mandatory?<\/summary>\n    <p>The <em>human-in-the-loop<\/em> principle establishes that a person must review or approve the decisions of an AI agent when the impact on third parties is significant. In practice, it means that an agent can prepare a credit proposal, but a human must validate it before communicating it to the customer. It is mandatory \u2014explicitly or implicitly\u2014 in all relevant LATAM regulations for decisions affecting people&#8217;s rights: credit approval, risk classification, medical care prioritization or HR management. The EU AI Act requires it explicitly for high-risk systems. Implementing it technically is one of the key steps in the AI agent governance roadmap in enterprises, both in Copilot Studio and Dynamics 365 workflows.<\/p>\n  <\/details>\n<\/section><section class=\"nseo-sources\"><h2>Sources<\/h2><ul><li><a href=\"https:\/\/www.ibanet.org\/between-algorithms-and-fundamental-rights-EU-AI-Act\" target=\"_blank\" rel=\"noopener\">Between algorithms and fundamental rights: the EU&#8217;s AI Act and its impact on Latin American employment law<\/a><\/li><li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/08\/26\/securing-and-governing-the-rise-of-autonomous-agents\/\" target=\"_blank\" rel=\"noopener\">Securing and governing autonomous agents with Microsoft Security<\/a><\/li><li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/01\/14\/microsoft-named-a-leader-in-idc-marketscape-for-unified-ai-governance-platforms\/\" target=\"_blank\" rel=\"noopener\">Microsoft named a Leader in IDC MarketScape for Unified AI Governance Platforms<\/a><\/li><li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/05\/19\/microsoft-extends-zero-trust-to-secure-the-agentic-workforce\/\" target=\"_blank\" rel=\"noopener\">Microsoft extends Zero Trust to secure the agentic workforce<\/a><\/li><li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/09\/30\/empowering-defenders-in-the-era-of-agentic-ai-with-microsoft-sentinel\/\" target=\"_blank\" rel=\"noopener\">Microsoft Sentinel: The security platform for the agentic era<\/a><\/li><\/ul><\/section>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Practical guide to AI agent governance for regulated LATAM enterprises: LGPD, Habeas Data, EU AI Act, DLP technical pillars, Zero Trust and a 90-day roadmap.<\/p>\n","protected":false},"author":2,"featured_media":25871,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":"","rank_math_description":"Practical guide to AI agent governance for regulated LATAM enterprises: LGPD, Habeas Data, EU AI Act, DLP technical pillars, Zero Trust and a 90-day roadmap."},"categories":[1],"tags":[],"class_list":["post-25896","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sin-categorizar"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/posts\/25896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/comments?post=25896"}],"version-history":[{"count":1,"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/posts\/25896\/revisions"}],"predecessor-version":[{"id":25978,"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/posts\/25896\/revisions\/25978"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/media\/25871"}],"wp:attachment":[{"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/media?parent=25896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/categories?post=25896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kcpdynamics.com\/en\/wp-json\/wp\/v2\/tags?post=25896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}