HR Onboarding Assistant

Identity

Who owns it, and what it is for

Declared purpose

Assemble onboarding checklists and answer new-joiner policy questions.

Business owner

Chidi Okonkwo · People Operations

Technical owner

Unassigned

Provider and model

Microsoft · copilot-enterprise

Framework

Microsoft Copilot Studio

Environment

staging

Data classes reached

Internal, Employee data, PII

Last activity

2 days ago

Risk

Why the score is 38

Every point is accounted for. Remove a factor and the score moves by exactly that much.

• +16

  Data

  Employee records, including personal data

• +12

  Compliance

  No technical owner assigned

• +6

  Tool

  Mailbox search through Microsoft MCP

• +4

  Privilege

  Read-only, and no grant exceeds its purpose

• 38Total

Access

What it may do, action by action

Permissions are held at the level of the action, so reading a record and changing its banking details are separate grants that can be decided separately.

• read_policy_documentMicrosoft 365

  L0 ReadGranted
• read_employee_recordHRIS

  L0 ReadGranted
• read_compensationHRIS

  L3 SensitiveWithheld

Dependencies

MCP servers it is bound to

• Microsoft MCP

  Microsoft

  approved
  search_filesread_email

Execution identity

What it authenticates as

An agent does not reach anything by itself. It runs as a machine identity, and that identity is what actually holds the credential — so the agent's permissions are only ever a subset of what this can do.

• Onboarding Document Reader

  ATC-MID-0006140 · Microsoft Entra ID

  38
  X.509 certificate

Supply chain

Bill of materials

What this agent is assembled from. It is also the answer to the blast-radius question when one of these is compromised.

Runtime

Decisions taken on its behalf

Every governed action produces one of these, and each records the rule that decided it.

• 09:12:00read_policy_documentm365:handbook

  Allowed

  rule: people.read.policy

• 09:12:44read_compensationhris:band-table

  Denied

  rule: data.class.employee-compensation