# Control 1.14: Data Minimization and Agent Scope Control

**Control ID:** 1.14<br>
**Pillar:** Security<br>
**Regulatory Reference:** GLBA 501(b), SEC Reg S-P, FINRA 4511, FINRA 3110, FINRA RN 24-09, CCPA §1798.100<br>
**Last UI Verified:** May 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

## Objective

Ensure Microsoft Copilot Studio agents access only the minimum data necessary for their functions by implementing least-privilege principles, documented data access justifications, scope creep prevention controls, and regular access reviews.

---

## Why This Matters for FSI

- **GLBA 501(b):** Helps limit agent access to customer NPI to the minimum necessary for the function
- **SEC Regulation S-P (Safeguards Rule, as amended May 2024):** Supports written policies and procedures for the safeguarding and disposal of customer information; helps evidence justification for agent access to consumer financial records
- **FINRA Rule 4511:** Helps maintain an audit trail of data access decisions and book-and-record retention obligations for AI-mediated interactions
- **FINRA Rule 3110 + Regulatory Notice 24-09 (Generative AI / LLM Guidance):** Applies existing supervisory obligations to AI agent data access on a technology-neutral basis; supports documented data minimization policies and near-real-time monitoring (within tenant audit and DSPM for AI latency windows) of AI-to-data interactions for customer-facing agents
- **CCPA §1798.100:** Supports data minimization for non-GLBA personal information. Most broker-dealer / bank customer financial information is exempt under the GLBA carve-out at CCPA §1798.145(e); CCPA still applies to HR, marketing, and other non-GLBA personal information processed by agents

---

## Control Description

This control establishes data minimization across the full set of agent grounding surfaces:

1. **Agent Data Access Inventory** — Map all data sources and grounding surfaces accessed by each agent: SharePoint / OneDrive sites and libraries, Dataverse tables, Microsoft Graph connectors, **per-conversation file uploads**, **image uploads (vision grounding)**, **public web grounding (Bing-backed)**, **enterprise web / curated URLs**, **connector references** (Power Platform standard, premium, and custom connectors), and **Copilot extensions / declarative agents / API plugins**. Cross-reference Control 1.2 (Agent Registry) for the source-of-truth inventory.
2. **Data Access Justification Framework** — Require documented business need for each agent ↔ grounding surface pair, with zone-based approval workflows (Zone 1 self-service; Zone 2 manager; Zone 3 CISO + AI Governance Lead).
3. **Connector Classification + Permission Minimization** — Use Power Platform DLP to classify connectors into Business / Non-Business / Blocked groups (PPAC → Policies → Data Policies); block connectors not justified by an inventory entry. For OAuth / Graph permission minimization on connectors that authenticate via Entra (custom connectors, Graph connectors, agent identity), use scoped delegated and application permissions per Control 1.18 — Power Platform DLP itself does not configure OAuth scopes.
4. **Grounding Source Minimization (SharePoint, web, files)** — Scope SharePoint knowledge sources to specific document libraries or folders rather than entire sites; coordinate with Control 4.6 (Grounding Scope Governance) which provides the SharePoint enforcement layer (Restricted Content Discovery exclusion lists, Restricted SharePoint Search ≤100-site allowed list, and Data Access Governance reports). Disable public web grounding for Zone 3 agents handling NPI; restrict file upload by sensitivity label and SIT match (see Controls 1.13 and 1.17).
5. **Scope-Drift Monitoring (DSPM for AI + Audit + SIEM)** — Use Microsoft Purview **DSPM for AI** and Activity Explorer to surface sensitive-data interactions with Copilot and agents; query the M365 Copilot audit schema (`CopilotInteraction` records) and join to the agent registry (Control 1.2) to derive scope-expansion signals. No native `AgentScopeExpansion` audit event exists — implement via the `scope-drift-monitor` solution or an equivalent SIEM correlation in Sentinel / Logic Apps.
6. **DLP for M365 Copilot Location** — Apply Purview DLP policies at the **Microsoft 365 Copilot** location to prevent agents from grounding on content carrying restricted sensitivity labels or matched SITs (Control 1.13). This is the runtime enforcement counterpart to inventory-time minimization.
7. **Periodic Access Reviews** — Run **Microsoft Entra ID Governance Access Reviews** on agent identities (Entra Agent ID), connector connections, and knowledge-source group memberships at the cadence defined in Zone-Specific Requirements; record decisions for FINRA 3110 supervisory evidence.

---

## Key Configuration Points

- Inventory all agent-to-grounding-surface mappings (SharePoint, Dataverse, files, images, web, connectors, extensions) with data classification levels — source of truth lives in Control 1.2
- Establish zone-based approval workflow (Zone 1: self-service; Zone 2: manager; Zone 3: CISO + AI Governance Lead)
- Configure Power Platform DLP (PPAC → Policies → Data Policies) to classify connectors used by agents into Business / Non-Business / Blocked groups; block connectors not justified in inventory (cross-reference Control 1.4)
- Create dedicated SharePoint groups for agent-readable content with least-privilege permissions; coordinate with Control 4.6 to apply Restricted Content Discovery (RCD) on high-risk sites and Restricted SharePoint Search (RSS) where appropriate (RSS is a short-term overshare-remediation measure, not a long-term Zone 3 boundary — see 4.6). When validating RCD / RSS with PowerShell, keep the tenant-approved SharePoint Online Management Shell release current enough to expose the required cmdlets.
- Narrow Copilot Studio knowledge sources to specific document libraries / folders rather than entire sites; disable **public web** grounding for Zone 3 agents handling NPI; restrict file uploads and image uploads per zone
- Configure Purview **DSPM for AI** policies and review Activity Explorer (the **AI activities** tab in unified DSPM) for sensitive-data interactions with agents; derive scope-drift signals via SIEM correlation against the M365 Copilot audit schema (`CopilotInteraction` records) — no native scope-expansion audit event exists
- Apply Purview DLP at the **Microsoft 365 Copilot** location with rules tied to sensitivity labels and SITs (Control 1.13)
- Document data access justification for each agent ↔ grounding surface pair; retain per WSP / FINRA 4511 retention schedules
- Run Microsoft Entra ID Governance Access Reviews on agent identities and connector connections per zone cadence

!!! tip "Automation Available"
    See [Scope Drift Monitor](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/scope-drift-monitor) in FSI-AgentGov-Solutions for automated detection of agent data access beyond declared operational scope with approval workflows for scope expansion.

!!! tip "File Upload Security Automation"
    See [File Upload Security Configurator](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/file-upload-security) in FSI-AgentGov-Solutions for automated per-agent file upload validation against zone governance policies with drift detection, Teams alerting, and SHA-256 compliance evidence export.

!!! info "License Requirements"
    - **Microsoft 365 Copilot** — required for agent runtime, Copilot audit (`CopilotInteraction`), and DLP-for-Copilot location coverage
    - **Microsoft 365 E5 Compliance** (or E5 Information Protection & Governance) — required for Purview DSPM for AI, DLP for M365 Copilot location, and Activity Explorer
    - **SharePoint Advanced Management** — included with M365 Copilot; provides RCD, Restricted SharePoint Search, and Data Access Governance reports (see Control 4.6)
    - **Microsoft Entra ID Governance (Entra ID P2)** — required for Access Reviews on agent identities and connector connections
    - **Power Platform DLP** — included with the Power Platform tenant; no add-on required
    - **Copilot Studio per-message capacity / per-user** — required for Copilot Studio agent runtime

    Verify SKU eligibility at deploy time.

!!! warning "Sovereign Cloud Parity (verify at deploy time)"
    - **Power Platform DLP** — parity across Commercial / GCC / GCC High / DoD
    - **Purview DSPM for AI** — Commercial GA; GCC rolling; **GCC High and DoD lag** — verify against the Microsoft 365 roadmap before relying on DSPM for AI in regulated clouds
    - **DLP for M365 Copilot location** — Commercial GA; GCC rolling; GCC High / DoD verify
    - **SharePoint Advanced Management (RCD / RSS / DAG)** — Commercial and GCC; **GCC High / DoD limited** — verify
    - **Copilot Studio** — Commercial and GCC; **GCC High limited preview** as of early 2026 — confirm at deploy time
    - **Entra ID Governance Access Reviews** — parity across Commercial / GCC / GCC High / DoD

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Annual data access review; standard DLP; self-service scope changes | Low risk, minimal data access |
| **Zone 2** (Team) | Quarterly review; enhanced DLP; manager approval for scope changes | Team data requires accountability |
| **Zone 3** (Enterprise) | Monthly review; strict allowlist; CISO approval; real-time monitoring | Customer-facing requires strict minimization |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| Power Platform Admin | Review agent configurations, manage environment settings, configure Power Platform DLP |
| AI Administrator | Manage Microsoft 365 Copilot settings, agent feature access, and Copilot connector delegation |
| SharePoint Admin | Manage site permissions, create agent access groups, coordinate RCD/RSS posture (Control 4.6) |
| Purview Compliance Admin | Configure DLP for M365 Copilot location, review compliance posture |
| Purview Data Security AI Admin | Configure Purview DSPM for AI policies and review Activity Explorer signals |
| Entra Identity Governance Admin | Run Access Reviews on agent identities and connector connections |
| AI Governance Lead | Define approval workflows, conduct quarterly access reviews, own scope-drift response |
| Compliance Officer | Review supervisory evidence, sign off on FINRA Rule 3110 / RN 24-09 documentation |
| CISO | Approve Zone 3 scope changes; own residual-risk acceptance |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [1.2 - Agent Registry](1.2-agent-registry-and-integrated-apps-management.md) | Source-of-truth agent ↔ grounding surface inventory |
| [1.3 - SharePoint Governance](1.3-sharepoint-content-governance-and-permissions.md) | Content access restrictions and label propagation |
| [1.4 - Advanced Connector Policies](1.4-advanced-connector-policies-acp.md) | Power Platform DLP connector classification |
| [1.10 - Communication Compliance Monitoring](1.10-communication-compliance-monitoring.md) | Supervisory monitoring of agent-mediated communications |
| [1.13 - Sensitive Information Types](1.13-sensitive-information-types-sits-and-pattern-recognition.md) | SIT signal feeding DLP-for-Copilot and scope-drift detection |
| [1.18 - RBAC](1.18-application-level-authorization-and-role-based-access-control-rbac.md) | Role-based and OAuth scope minimization for agent identities |
| [1.19 - eDiscovery for Agent Interactions](1.19-ediscovery-for-agent-interactions.md) | Evidence retrieval over CopilotInteraction records |
| [4.6 - Grounding Scope Governance](../pillar-4-sharepoint/4.6-grounding-scope-governance.md) | SharePoint enforcement layer (RCD, RSS ≤100-site allowed list, DAG reports) — required for §4 minimization to be operational |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/1.14/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/1.14/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/1.14/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/1.14/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Every agent in the Control 1.2 registry has a documented justification for each grounding surface (SharePoint scope, Dataverse tables, file upload allowed, image upload allowed, public web on/off, enterprise web URLs, connector references, extensions/plugins) on file
2. Power Platform DLP policy classifies every connector used by an agent into Business / Non-Business / Blocked; no agent uses a connector that is not in the Business group of its environment's policy (cross-check against Control 1.4)
3. SharePoint knowledge sources are scoped to specific libraries / folders, not entire sites; sample 10% of agents and confirm
4. Public web grounding is **disabled** on all Zone 3 agents handling NPI (verify in Copilot Studio agent settings)
5. File upload and image upload posture matches zone policy (Zone 3: restricted to labeled / SIT-validated content) — see Control 1.17 endpoint DLP and the File Upload Security Configurator
6. Purview DSPM for AI policies cover all environments hosting agents that ground on customer data; Activity Explorer / AI activities shows no unexplained sensitive-data interactions in the past 30 days for Zone 3
7. Purview DLP at the Microsoft 365 Copilot location enforces sensitivity-label and SIT-based blocks (Control 1.13); test with a synthetic NPI document
8. SIEM correlation against `CopilotInteraction` audit records produces a scope-drift report at zone cadence (Zone 3: weekly); incidents triaged within SLA
9. Control 4.6 RCD exclusion list and RSS allowed-list (if used) reconcile against the agent grounding inventory — no high-risk site is grounded by a Zone 3 agent and missing from the RCD list
10. Microsoft Entra ID Governance Access Reviews completed at zone cadence on agent identities and connector connections; decisions retained per FINRA 4511
11. Quarterly (Zone 1: annual; Zone 2: quarterly; Zone 3: monthly) access review documented with reviewer, date, scope changes, and approval evidence
12. Sample audit pulls (`CopilotInteraction`, DSPM for AI activity, DLP-for-Copilot rule matches) for the past 90 days are exportable and tied back to the WSP — supports FINRA 3110 supervisory evidence and SEC Reg S-P safeguards documentation

---

## Additional Resources

- [Microsoft Learn: Power Platform DLP policies](https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention)
- [Microsoft Learn: Connector classification](https://learn.microsoft.com/en-us/power-platform/admin/dlp-connector-classification)
- [Microsoft Learn: Add knowledge sources to a Copilot Studio agent](https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-copilot-studio)
- [Microsoft Learn: Knowledge sources in Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-copilot-studio)
- [Microsoft Learn: Public website knowledge sources](https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-add-public-website)
- [Microsoft Learn: File analysis in Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/image-input-analysis)
- [Microsoft Learn: Microsoft Purview DSPM for AI](https://learn.microsoft.com/en-us/purview/dspm-for-ai)
- [Microsoft Learn: DSPM for AI data assessments](https://learn.microsoft.com/en-us/purview/dspm-for-ai)
- [Microsoft Learn: Activity Explorer](https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer)
- [Microsoft Learn: DLP for Microsoft 365 Copilot location](https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about)
- [Microsoft Learn: Audit Microsoft 365 Copilot interactions](https://learn.microsoft.com/en-us/purview/audit-copilot)
- [Microsoft Learn: Restricted Content Discovery](https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery)
- [Microsoft Learn: Restricted SharePoint Search](https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search)
- [Microsoft Learn: SharePoint Data Access Governance reports](https://learn.microsoft.com/en-us/sharepoint/data-access-governance-reports)
- [Microsoft Learn: Microsoft Entra ID Governance Access Reviews](https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview)
- [Microsoft Learn: SharePoint sharing permissions](https://learn.microsoft.com/en-us/sharepoint/modern-experience-sharing-permissions)
- [SEC Final Rule: Regulation S-P amendments (May 2024)](https://www.sec.gov/rules-regulations/2024/05/regulation-s-p-privacy-consumer-financial-information)
- [FINRA Regulatory Notice 24-09 — Generative AI guidance (June 2024)](https://www.finra.org/rules-guidance/notices/24-09)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current (re-verified May 2026)*
