[{"data":1,"prerenderedAt":1662},["ShallowReactive",2],{"site-nav-content":3,"blog:\u002Fblog\u002Fwhat-is-ai-governance":177,"blog-index-copy":793,"blog:\u002Fblog\u002Fwhat-is-ai-governance:surround":814,"hiring-banner-content":1631,"site-cta-content":1643},{"header":4,"productNav":9,"nav":42,"footer":61,"askAI":132,"id":161,"title":162,"archived":163,"authors":164,"badge":164,"body":165,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":173,"relatedHeading":164,"seo":174,"series":164,"sitemap":163,"status":164,"stem":175,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":176},{"productLabel":5,"loginLabel":6,"contactLabel":7,"contactSalesLabel":8},"Product","Log in","Contact","Get started for free",[10,14,18,22,26,30,34,38],{"label":11,"to":12,"description":13},"Overview","\u002Foverview","Seven layers. One closed loop.",{"label":15,"to":16,"description":17},"Conflux","\u002Fproduct\u002Fconflux","Where your team, workstreams, and agents meet.",{"label":19,"to":20,"description":21},"Agent Teams","\u002Fproduct\u002Fagent-teams","Specialist teams - governed from day one.",{"label":23,"to":24,"description":25},"Lifecycle Graph","\u002Fproduct\u002Flifecycle-graph","Intelligence that compounds across every interaction.",{"label":27,"to":28,"description":29},"Company Wiki","\u002Fproduct\u002Fwiki","Playbooks and policies where expertise stays.",{"label":31,"to":32,"description":33},"Workstreams","\u002Fproduct\u002Fworkstreams","From brief to signed-off deliverable on one canvas.",{"label":35,"to":36,"description":37},"Perception Console","\u002Fproduct\u002Fperception","Ask your whole business in plain English.",{"label":39,"to":40,"description":41},"Governance","\u002Fproduct\u002Fgovernance","Frontier AI you can actually sign off on.",[43,46,49,52,55,58],{"label":44,"to":45},"Models","\u002Fmodels",{"label":47,"to":48},"Pricing","\u002Fpricing",{"label":50,"to":51},"Integrations","\u002Fintegrations",{"label":53,"to":54},"Security","\u002Fsecurity",{"label":56,"to":57},"Partners","\u002Fpartners",{"label":59,"to":60},"Insights","\u002Fblog",{"productHeading":5,"companyHeading":62,"resourcesHeading":63,"legalHeading":64,"docsLabel":65,"docsUrl":66,"statementLines":67,"copyright":70,"companyLinks":71,"resourcesLinks":86,"legalLinks":102,"socialLinks":109,"bottomLinks":119},"Company","Resources","Legal","Docs","https:\u002F\u002Fdocs.gonimbus.ai",[68,69],"Stop training someone else's model.","Control your AI.","© 2026 Nimbus Intelligence, Inc. All rights reserved.",[72,73,74,75,76,78,81,84],{"label":47,"to":48},{"label":50,"to":51},{"label":53,"to":54},{"label":59,"to":60},{"label":77,"to":57},"Partner Program",{"label":79,"to":80},"Careers","\u002Fcareers",{"label":82,"to":83},"System status","\u002Fstatus",{"label":7,"to":85},"\u002Fcontact",[87,90,93,96,99],{"label":88,"to":89},"Glossary","\u002Fglossary",{"label":91,"to":92},"Compare","\u002Fcompare",{"label":94,"to":95},"Evaluate","\u002Fevaluate",{"label":97,"to":98},"Problems","\u002Fproblems",{"label":100,"to":101},"Use cases","\u002Fuse-cases",[103,106],{"label":104,"to":105},"Terms of Service","\u002Fterms",{"label":107,"to":108},"Privacy Policy","\u002Fprivacy",[110,113,116],{"label":111,"href":112},"LinkedIn","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fgonimbusai\u002F",{"label":114,"href":115},"X","https:\u002F\u002Fx.com\u002Fgonimbusai",{"label":117,"href":118},"Instagram","https:\u002F\u002Fwww.instagram.com\u002Fgonimbus_ai\u002F",[120,122,124,127,128],{"label":121,"to":105},"Terms",{"label":123,"to":108},"Privacy",{"label":125,"to":126},"Compliance","\u002Fcompliance",{"label":82,"to":83},{"label":129,"to":130,"external":131},"LLMs.txt","\u002Fllms.txt",true,{"text":133,"prompt":134,"platforms":135},"Ask AI about Nimbus","I'm researching enterprise intelligence platforms and want to know how Nimbus combines perception, collaboration, and autonomous agents to drive strategic decision-making. Summarize the highlights from Nimbus's website: https:\u002F\u002Fgonimbus.ai",[136,141,146,151,156],{"name":137,"label":138,"icon":139,"hrefPrefix":140},"chatgpt","ChatGPT","simple-icons:openai","https:\u002F\u002Fchatgpt.com\u002F?prompt=",{"name":142,"label":143,"icon":144,"hrefPrefix":145},"perplexity","Perplexity","mdi:magnify","https:\u002F\u002Fwww.perplexity.ai\u002Fsearch\u002Fnew?q=",{"name":147,"label":148,"icon":149,"hrefPrefix":150},"grok","Grok","simple-icons:x","https:\u002F\u002Fx.com\u002Fi\u002Fgrok?text=",{"name":152,"label":153,"icon":154,"hrefPrefix":155},"claude","Claude","simple-icons:anthropic","https:\u002F\u002Fclaude.ai\u002Fnew?q=",{"name":157,"label":158,"icon":159,"hrefPrefix":160},"google-ai","Google AI","simple-icons:google","https:\u002F\u002Fwww.google.com\u002Fsearch?udm=50&aep=11&q=","content\u002Fshared\u002Fnav.md","Site navigation",false,null,{"type":166,"value":167,"toc":168},"minimark",[],{"title":169,"searchDepth":170,"depth":170,"links":171},"",2,[],"md","\u002Fshared\u002Fnav",{"title":162,"description":169},"shared\u002Fnav","Q7sDe7TuGEwhwUMamyeOxjvGlsUaF3Iay9VTW0KaE_U",{"id":178,"title":179,"archived":163,"authors":180,"badge":184,"body":186,"date":769,"definedTerm":164,"department":164,"description":770,"extension":172,"eyebrow":164,"faqHeader":771,"faqs":774,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":784,"relatedHeading":164,"seo":785,"series":786,"sitemap":131,"status":164,"stem":787,"subhead":164,"tags":788,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":792},"content\u002Fblog\u002Fwhat-is-ai-governance.md","What is AI Governance",[181],{"name":182,"to":183},"Nimbus Research","https:\u002F\u002Fgonimbus.ai",{"label":185},"Explainer",{"type":166,"value":187,"toc":744},[188,197,200,203,222,225,237,242,341,351,355,363,366,397,400,430,437,442,448,459,465,471,482,486,492,498,504,512,518,526,545,549,552,559,573,584,588,592,600,604,607,611,618,622,625,629,632,636,643,647,650,654,657,661,664,668,671,675,680,684,687,691,702,706],[189,190,191,192,196],"p",{},"AI governance is the set of rules, ",[193,194,195],"strong",{},"enforced in the software people actually use",", that decide who may use which AI, on which company data, and whether that AI is allowed to change a live business system — plus a record of what happened afterwards.",[189,198,199],{},"A training video is not that. An acceptable-use PDF is not that. An admin toggle the model can ignore is not that. If an unapproved change can still succeed, you have guidance, not governance.",[189,201,202],{},"People use the phrase for three different things, and they get mixed up:",[204,205,206,216,219],"ol",{},[207,208,209,210,215],"li",{},"A public commitment — for example the ",[211,212,214],"a",{"href":213},"https:\u002F\u002Foecd.ai\u002Fen\u002Fai-principles","OECD AI Principles",".",[207,217,218],{},"A company committee with a risk register.",[207,220,221],{},"The runtime that actually stops a change to CRM, ERP, or a customer message.",[189,223,224],{},"All three are real. Only the third one would have blocked an unlogged field change that later showed up in a forecast.",[189,226,227,231,232,236],{},[211,228,230],{"href":229},"https:\u002F\u002Fwww.gartner.com\u002Fen\u002Farticles\u002Fai-governance-trism","Gartner’s TRiSM"," language is about that third layer: trust, risk, and security around the systems that run — not a quarterly slide about principles. The ",[211,233,235],{"href":234},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","NIST AI Risk Management Framework"," says the same thing in public-sector language: Govern, Map, Measure, Manage. Mapping systems and measuring incidents still fail if the product people click can write to Salesforce without a named signer.",[238,239,241],"h2",{"id":240},"words-youll-hear","Words you’ll hear",[243,244,245,251,267,278,284,290,305,315,326],"ul",{},[207,246,247,250],{},[193,248,249],{},"Live business system."," CRM, ERP, HR, billing — the tools that hold official numbers and customer records. At work, this is where a fluent sentence becomes a fact other teams will inherit.",[207,252,253,256,257,261,262,266],{},[193,254,255],{},"Write \u002F write-back."," The AI is allowed to ",[258,259,260],"em",{},"change"," that system, not only draft a suggestion. See ",[211,263,265],{"href":264},"\u002Fblog\u002Fwhat-is-write-back-governance\u002F","What is write-back governance",". At work, a next-step note and an Amount field are not the same risk class.",[207,268,269,272,273,277],{},[193,270,271],{},"Human-in-the-loop."," A person must approve before the job can finish. See ",[211,274,276],{"href":275},"\u002Fblog\u002Fwhat-is-human-in-the-loop-ai\u002F","What is human-in-the-loop AI",". At work, the gate shows the payload in the language of the live system, not a wall of prompt text.",[207,279,280,283],{},[193,281,282],{},"Named signer."," The identity that authorised the change. At work, “someone in the channel clicked yes” is not a signer.",[207,285,286,289],{},[193,287,288],{},"Fail-closed."," Missing approval means nothing happens. Fail-open means the change goes through unless someone happens to stop it.",[207,291,292,295,296,299,300,304],{},[193,293,294],{},"DPIA."," A data-protection impact assessment — thinking through purpose, risk, and personal data ",[258,297,298],{},"before"," you turn a tool loose. ",[211,301,303],{"href":302},"https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002Fartificial-intelligence\u002F","UK ICO guidance on AI and data protection"," still wants a lawful basis and purpose when the “user” is an AI.",[207,306,307,310,311,215],{},[193,308,309],{},"Shadow AI."," Personal ChatGPT for work because the official path is missing. See ",[211,312,314],{"href":313},"\u002Fblog\u002Fwhat-is-shadow-ai\u002F","What is shadow AI",[207,316,317,320,321,325],{},[193,318,319],{},"Inventory."," A list of where AI actually runs. The ",[211,322,324],{"href":323},"https:\u002F\u002Fwww.justice.gov\u002Fmedia\u002F1373026\u002Fdl","US plan described in OMB M-24-10"," puts a named owner and an inventory first, not a PDF.",[207,327,328,331,332,335,336,340],{},[193,329,330],{},"Least privilege."," Only the data and tools required for ",[258,333,334],{},"this"," job. A ",[211,337,339],{"href":338},"\u002Fblog\u002Fwhat-is-an-ai-workstream\u002F","workstream"," is how that instinct becomes a company object.",[189,342,343,344,347,348,350],{},"Model safety is adjacent and different. Safety is about what a model will say in the abstract. Enterprise governance is about what ",[258,345,346],{},"your"," people and tools may do with ",[258,349,346],{}," systems and data. You can have a carefully aligned model and still have ungoverned CRM writes.",[238,352,354],{"id":353},"why-you-should-care","Why you should care",[189,356,357,358,362],{},"Without working rules, AI becomes a side effect. A field moves. A journal posts. A customer is told a policy the company does not hold. Nobody can say who allowed it. In February 2024, a British Columbia tribunal held Air Canada responsible for a chatbot that invented a bereavement-fare policy. ",[211,359,361],{"href":360},"https:\u002F\u002Fwww.cbc.ca\u002Fnews\u002Fcanada\u002Fbritish-columbia\u002Fair-canada-chatbot-lawsuit-1.7116416","CBC reported"," that the airline’s argument — the chatbot is a separate legal entity — failed. A customer-facing commitment without a working gate is still the company’s commitment.",[189,364,365],{},"It affects you if you:",[243,367,368,374,380,391],{},[207,369,370,373],{},[193,371,372],{},"Own a number."," Forecasts and close packs inherit whatever changed.",[207,375,376,379],{},[193,377,378],{},"Own a customer relationship."," Model output that becomes a commitment is still the company’s commitment.",[207,381,382,385,386,390],{},[193,383,384],{},"Own risk or legal."," Privacy law does not pause for a chatbot. ",[211,387,389],{"href":388},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj","GDPR"," still applies to purpose, minimisation, and erasure.",[207,392,393,396],{},[193,394,395],{},"Are asked “who is in charge of AI here?”"," An inventory and a named owner beat a principles slide.",[189,398,399],{},"Good governance in practice is four working rules:",[243,401,402,408,414,420],{},[207,403,404,407],{},[193,405,406],{},"People and rights."," Humans and AI tools are both actors. Roles decide what they may start, see, and sign.",[207,409,410,413],{},[193,411,412],{},"Data at question time."," Purpose and minimisation still apply when an AI is the one looking.",[207,415,416,419],{},[193,417,418],{},"Action rights."," Read-only is a control. Unrestricted tools are an incident waiting for a bad prompt.",[207,421,422,425,426,215],{},[193,423,424],{},"Evidence and spend."," Chat scrollback is not a management system. Uncapped spend is a budget failure and often a security failure. See ",[211,427,429],{"href":428},"\u002Fblog\u002Fwhat-is-ai-token-economics\u002F","What is AI token economics",[189,431,432,433,436],{},"Blocking consumer ChatGPT at the office network, while people use personal phones, is not governance. It is a ",[211,434,435],{"href":313},"shadow AI"," problem with extra steps.",[438,439,441],"h3",{"id":440},"what-changes-by-role","What changes by role",[189,443,444,447],{},[193,445,446],{},"Finance."," Governance is whether an AI-proposed journal can post, against which checklist, with which signer, and whether the spend of the run was capped. “Unlimited AI” is not a control. Surprise inference bills are a governance failure that looks like a cloud invoice.",[189,449,450,453,454,458],{},[193,451,452],{},"Legal."," Lawful basis, purpose limitation, customer-facing language, and reconstructable authorisation. Legal also has to separate the OECD-style public commitment from the runtime. A principles page does not implement Article-style oversight. For higher-risk systems, ",[211,455,457],{"href":456},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj","EU AI law"," Article 14 talks about effective oversight: people must be able to interpret outputs and interrupt the system. A footer that says “generated by AI” is not that.",[189,460,461,464],{},[193,462,463],{},"Operations."," Isolation of jobs, connector scope, and a place to put a paused run. Ops already runs change control. Governance is change control that includes a model as a proposer.",[189,466,467,470],{},[193,468,469],{},"Go-to-market."," The difference between a draft email and a sent commitment; between a suggested next step and a changed Amount. GTM feels friction first. The honest metric is time-to-approved-write, not time-to-first-answer.",[189,472,473,476,477,481],{},[193,474,475],{},"Security."," Identity of the connected user, read versus write, prompt injection as a path to a tool call, and the new store created by logs and indexes. The ",[211,478,480],{"href":479},"https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F","OWASP Top 10 for LLM applications"," treats retrieval and tool use as a security surface, not only a quality issue. Network DLP helps with paste-out. It does not quote a CRM change.",[438,483,485],{"id":484},"what-people-get-wrong","What people get wrong",[189,487,488,491],{},[193,489,490],{},"Governance as a committee."," Useful for risk registers. Useless if the product can still write.",[189,493,494,497],{},[193,495,496],{},"Governance as model safety."," Refusals on public-web questions do not bind Salesforce.",[189,499,500,503],{},[193,501,502],{},"Governance as a secure web gateway."," Necessary for some paste-out paths. Insufficient for writes, approvals, and causal history.",[189,505,506,509,510,215],{},[193,507,508],{},"Governance as blocking."," Blocks without a sanctioned path train people onto phones. See ",[211,511,314],{"href":313},[189,513,514,517],{},[193,515,516],{},"Theatre."," A checkbox, a prompt that says “ask first,” or an admin toggle the model can ignore.",[189,519,520,521,525],{},"Good looks like: connectors default to read-only; writes are quoted; a named signer cannot be waived by the model; evidence lives on a ",[211,522,524],{"href":523},"\u002Fblog\u002Fwhat-is-a-lifecycle-graph\u002F","lifecycle graph","; spend has a ceiling; scope follows the job. Failure looks like a PDF, a blocked URL, and a personal API key in a wiki.",[189,527,528,529,532,533,536,537,539,540,544],{},"Adjacent concepts: ",[211,530,531],{"href":264},"write-back governance"," is the write subset. ",[211,534,535],{"href":275},"Human-in-the-loop"," is the gate. ",[211,538,31],{"href":338}," are the isolation unit. An ",[211,541,543],{"href":542},"\u002Fblog\u002Fwhat-is-an-enterprise-ai-operating-system\u002F","enterprise AI operating system"," is the product shape that makes those rules the default path.",[238,546,548],{"id":547},"how-this-shows-up-in-nimbus","How this shows up in Nimbus",[189,550,551],{},"Nimbus treats governance as how work is released, not as a sidecar policy engine.",[189,553,554,555,558],{},"Connectors — secure links to live systems — default to ",[193,556,557],{},"read-only",". When a change is proposed, the product shows the intended action and waits. A named person must sign. The model cannot waive the gate. Missing approval is fail-closed: nothing happens.",[189,560,561,562,564,565,567,568,572],{},"Scope is the ",[211,563,339],{"href":338},": one job, with the playbooks, systems, teams, and budget that belong to that job. Evidence is the ",[211,566,23],{"href":523},". The ",[211,569,571],{"href":570},"\u002Fblog\u002Fwhat-is-a-company-wiki-for-ai-agents\u002F","company wiki"," is the asserted policy the run must cite. Model routing does not bypass the gate.",[189,574,575,576,579,580,215],{},"See ",[211,577,39],{"href":578},"\u002Fproduct\u002Fgovernance\u002F",". For scoring vendors: ",[211,581,583],{"href":582},"\u002Fblog\u002Fhow-to-evaluate-an-agent-harness\u002F","how to evaluate an agent harness",[238,585,587],{"id":586},"questions-people-actually-ask","Questions people actually ask",[438,589,591],{"id":590},"is-ai-governance-the-same-as-making-the-model-safe","Is AI governance the same as making the model “safe”?",[189,593,594,595,347,597,599],{},"No. Model safety is about what the model will say in the abstract. Enterprise governance is about what ",[258,596,346],{},[258,598,346],{}," systems and data.",[438,601,603],{"id":602},"can-we-rely-on-the-secure-web-gateway","Can we rely on the secure web gateway?",[189,605,606],{},"Network controls help with paste-out. They do not quote a CRM change, bind an approver, or store a causal history. Use both.",[438,608,610],{"id":609},"must-a-person-always-approve","Must a person always approve?",[189,612,613,614,617],{},"For many operational writes, yes. For read-only analysis, maybe not. The mistake is calling a system “human-approved” because a human ",[258,615,616],{},"could"," look, while changes proceed on model initiative.",[438,619,621],{"id":620},"do-the-oecd-ai-principles-require-a-specific-product","Do the OECD AI Principles require a specific product?",[189,623,624],{},"No. They are a public commitment. A product can make evidence cheaper to produce. The commitment does not implement a gate.",[438,626,628],{"id":627},"is-a-dpia-enough-to-go-live","Is a DPIA enough to go live?",[189,630,631],{},"It is necessary thinking, not a runtime. You still need identity, scope, fail-closed writes, and a record. The DPIA should describe those controls, not replace them.",[438,633,635],{"id":634},"does-blocking-chatgpt-count-as-governance","Does blocking ChatGPT count as governance?",[189,637,638,639,642],{},"It is a network control. Without a sanctioned path that can see the right files, people use personal phones. Blocking can tighten ",[258,640,641],{},"after"," substitution exists.",[438,644,646],{"id":645},"how-is-this-different-from-it-change-management","How is this different from IT change management?",[189,648,649],{},"It is the same instinct — who may change production, with what evidence — applied to a proposer that speaks English. Existing CAB processes rarely see model-initiated payloads unless the product emits them.",[438,651,653],{"id":652},"who-should-be-the-named-owner-of-ai","Who should be the named owner of AI?",[189,655,656],{},"Someone who can inventory systems and stop a write path, not a volunteer “champion” with no authority over CRM. Federal-style guidance starts with inventory and ownership for a reason.",[438,658,660],{"id":659},"can-we-govern-only-customer-facing-chatbots-and-ignore-internal-copilots","Can we govern only customer-facing chatbots and ignore internal copilots?",[189,662,663],{},"Internal tools still process personal data and still write to live systems. Air Canada was customer-facing. Ungoverned CRM hygiene is an internal path to the same class of invented fact.",[438,665,667],{"id":666},"do-we-need-the-eu-ai-act-if-we-are-not-a-high-risk-provider","Do we need the EU AI Act if we are not a high-risk provider?",[189,669,670],{},"You may still have GDPR duties, sector rules, and customer contracts. Oversight and records are useful even when a specific Act title does not apply. Do not claim “Act compliant” because you have a button.",[438,672,674],{"id":673},"where-does-spend-fit","Where does spend fit?",[189,676,677,678,215],{},"Uncapped inference is a control failure. Quotes, ceilings, and attribution by job are governance of a scarce, abusable resource. See ",[211,679,429],{"href":428},[438,681,683],{"id":682},"is-an-acceptable-use-policy-still-worth-writing","Is an acceptable-use policy still worth writing?",[189,685,686],{},"Yes, as communication. No, as enforcement. Write the PDF. Then put the same rules in the product people actually use.",[238,688,690],{"id":689},"related-reading","Related reading",[189,692,693,695,696,698,699,215],{},[211,694,265],{"href":264},", ",[211,697,314],{"href":313},", and ",[211,700,701],{"href":542},"What is an enterprise AI operating system",[238,703,705],{"id":704},"sources","Sources",[243,707,708,713,717,722,726,731,735,740],{},[207,709,710],{},[211,711,712],{"href":229},"Gartner, AI governance and TRiSM",[207,714,715],{},[211,716,214],{"href":213},[207,718,719],{},[211,720,721],{"href":302},"ICO, AI and data protection",[207,723,724],{},[211,725,235],{"href":234},[207,727,728],{},[211,729,730],{"href":360},"CBC, Air Canada chatbot lawsuit",[207,732,733],{},[211,734,389],{"href":388},[207,736,737],{},[211,738,739],{"href":456},"EU AI Act (Regulation 2024\u002F1689)",[207,741,742],{},[211,743,480],{"href":479},{"title":169,"searchDepth":170,"depth":170,"links":745},[746,747,752,753,767,768],{"id":240,"depth":170,"text":241},{"id":353,"depth":170,"text":354,"children":748},[749,751],{"id":440,"depth":750,"text":441},3,{"id":484,"depth":750,"text":485},{"id":547,"depth":170,"text":548},{"id":586,"depth":170,"text":587,"children":754},[755,756,757,758,759,760,761,762,763,764,765,766],{"id":590,"depth":750,"text":591},{"id":602,"depth":750,"text":603},{"id":609,"depth":750,"text":610},{"id":620,"depth":750,"text":621},{"id":627,"depth":750,"text":628},{"id":634,"depth":750,"text":635},{"id":645,"depth":750,"text":646},{"id":652,"depth":750,"text":653},{"id":659,"depth":750,"text":660},{"id":666,"depth":750,"text":667},{"id":673,"depth":750,"text":674},{"id":682,"depth":750,"text":683},{"id":689,"depth":170,"text":690},{"id":704,"depth":170,"text":705},"2026-08-17","AI governance is the working rules for who may use which AI, on which data, and whether it may change a live business system.",{"eyebrow":772,"title":773},"Short answers","Rules that actually stop a change",[775,778,781],{"question":776,"answer":777},"What is AI governance?","The working rules for who may use which AI, on which data, and whether it may change a live business system, plus a record of what happened.",{"question":779,"answer":780},"Is a policy PDF governance?","Only if the software enforces it. A document the model can ignore is guidance.",{"question":782,"answer":783},"What has to be true before a write?","A named person or a named rule has allowed that exact change. If they have not, the change does not happen.","\u002Fblog\u002Fwhat-is-ai-governance",{"title":179,"description":770},"explainer","blog\u002Fwhat-is-ai-governance",[786,789,790,791],"governance","compliance","audit","3P7kWkstCX-Me3qq2PZcPS9sMhi7EacGegrGNsiBExQ",{"hero":794,"id":796,"title":797,"archived":163,"authors":164,"badge":164,"body":798,"date":164,"definedTerm":164,"department":164,"description":802,"extension":172,"eyebrow":803,"faqHeader":164,"faqs":164,"footerBand":804,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":60,"relatedHeading":810,"seo":811,"series":164,"sitemap":131,"status":164,"stem":812,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":813},{"filename":795},"u2221455217_Flat_design_of_a_futuristic_minimalist_landscape__5d589295-cdea-4ea9-a262-be766881accf_1.png","content\u002Fblog\u002Findex.md","Exploring the future of intelligence.",{"type":166,"value":799,"toc":800},[],{"title":169,"searchDepth":170,"depth":170,"links":801},[],"Deep dives into pre-cognitive intelligence, sentient enterprises, and the evolving landscape of AI-driven business transformation.","Latest Research",{"headline":805,"description":806,"primaryLabel":807,"primaryTo":808,"secondaryLabel":809,"secondaryTo":12},"Stay at the frontier.","Subscribe for product updates and new insights.","Subscribe","\u002Fnewsletter","Explore the platform","More research",{"title":797,"description":802},"blog\u002Findex","BFSWGYO9bcTlaulivKYWyg08_DJHsdGg3OC6g_CG1Hw",[815,1273],{"id":816,"title":817,"archived":163,"authors":818,"badge":820,"body":821,"date":769,"definedTerm":164,"department":164,"description":1253,"extension":172,"eyebrow":164,"faqHeader":1254,"faqs":1256,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1266,"relatedHeading":164,"seo":1267,"series":786,"sitemap":131,"status":164,"stem":1268,"subhead":164,"tags":1269,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1272},"content\u002Fblog\u002Fwhat-is-an-ai-workstream.md","What is an AI Workstream",[819],{"name":182,"to":183},{"label":185},{"type":166,"value":822,"toc":1229},[823,830,833,836,844,847,849,923,931,933,939,942,961,964,989,992,994,999,1007,1012,1017,1025,1027,1033,1038,1044,1050,1056,1062,1065,1072,1074,1081,1084,1090,1106,1108,1112,1115,1119,1122,1126,1129,1133,1139,1143,1148,1152,1155,1159,1164,1168,1171,1175,1182,1186,1189,1193,1196,1200,1205,1207,1215,1217],[189,824,825,826,829],{},"An AI workstream is a ",[193,827,828],{},"shared workspace for one job",": a brief, the tools allowed, the people and AI on it, a budget, and a finish line.",[189,831,832],{},"A Slack channel with a bot is not a job. It is a room. Anyone can paste anything. The bot never knows when the work is done. Next quarter, nobody can say which systems were in play or who was allowed to change them.",[189,834,835],{},"If you cannot name the systems in scope and the approval policy on writes, you do not have a workstream. You have a conversation.",[189,837,838,839,843],{},"Software teams already learned this. Work lives in issues and tickets, not in unbounded chat. ",[211,840,842],{"href":841},"https:\u002F\u002Fwww.atlassian.com\u002Fagile\u002Fproject-management\u002Fepics-stories-themes","Atlassian’s epics and stories"," are named packages with a boundary. AI operations are still catching up. The missing object is often the work package: a place where the job actually lives.",[189,845,846],{},"The analogy is not decoration. Tickets have a requester, a scope, an owner, and a closed state. Copilots have a thread. Threads do not archive cleanly, do not attach least-privilege connectors, and do not carry a named signer. When AI started touching live systems, the thread stopped being a sufficient container.",[238,848,241],{"id":240},[243,850,851,857,863,876,882,892,897,905,914],{},[207,852,853,856],{},[193,854,855],{},"Brief."," What this job is for, and what “done” means. At work, “Q3 regional discount hygiene” is a brief. “My stuff” is not.",[207,858,859,862],{},[193,860,861],{},"Connector."," A secure link to a live system (CRM, ERP, Drive). Attach what this job needs — not every system “just in case.” Default is read-only.",[207,864,865,331,868,870,871,875],{},[193,866,867],{},"Scope \u002F least privilege.",[258,869,334],{}," job. ",[211,872,874],{"href":873},"https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fprivacy\u002Fguidance\u002Fminimum-necessary-requirement\u002Findex.html","HIPAA’s minimum necessary"," is the same instinct: do not attach every system to every task. GDPR purpose limitation is the privacy-law cousin.",[207,877,878,881],{},[193,879,880],{},"God workspace."," One org-wide chat that can see every folder and every CRM object because setup was easier. At work, this is how recruiting sees finance forecasts.",[207,883,884,887,888,215],{},[193,885,886],{},"Agent team."," The AI specialists assigned to the job. The workstream is the stage; the team is the cast. See ",[211,889,891],{"href":890},"\u002Fblog\u002Fwhat-is-multi-agent-ai\u002F","What is multi-agent AI",[207,893,894,896],{},[193,895,282],{}," Who must approve a write. At work, this is a role that already owns that class of change.",[207,898,899,902,903,215],{},[193,900,901],{},"Budget."," The spend ceiling for the job. See ",[211,904,429],{"href":428},[207,906,907,910,911,215],{},[193,908,909],{},"Wiki section."," The asserted playbooks this job may load. See ",[211,912,913],{"href":570},"What is a company wiki for AI agents",[207,915,916,919,920,215],{},[193,917,918],{},"Lifecycle Graph."," The chain this job emits as it runs. See ",[211,921,922],{"href":523},"What is a lifecycle graph",[189,924,925,926,930],{},"An ",[211,927,929],{"href":928},"\u002Fblog\u002Fwhat-is-an-agentic-workflow\u002F","agentic workflow"," is the sequence of steps. The workstream is the durable instance those steps run inside. A workflow definition without a workstream is a script on someone’s laptop. A workstream without a workflow is a folder with no process.",[238,932,354],{"id":353},[189,934,935,936,938],{},"Without a boundary, two departments sharing an AI tool will either over-share (the recruiting job can see finance forecasts) or under-share (people export spreadsheets to personal ChatGPT). The workstream is the compromise: enough context to do ",[258,937,334],{}," job, not the whole company.",[189,940,941],{},"It affects you if work:",[243,943,944,947,950,953,956],{},[207,945,946],{},"touches more than one system",[207,948,949],{},"involves more than one role",[207,951,952],{},"can change a live record",[207,954,955],{},"needs a budget you can attribute",[207,957,958,959],{},"must still be explainable after people leave — see ",[211,960,922],{"href":523},[189,962,963],{},"Open workstreams the way you would open a ticket:",[243,965,966,973,980,983,986],{},[207,967,968,969,972],{},"One workstream per ",[193,970,971],{},"outcome",", not per person. “Q3 regional discount hygiene” can have several humans. “My stuff” cannot be governed or archived.",[207,974,975,976,979],{},"Attach the ",[193,977,978],{},"minimum"," connectors.",[207,981,982],{},"Set the write policy on day one, even if you start read-only.",[207,984,985],{},"Reuse templates, not last month’s chat thread.",[207,987,988],{},"Close or archive when the job ends. A sprint that never ends is not a sprint.",[189,990,991],{},"A standing “Ask AI” workstream with org-wide connectors recreates the copilot, including the blast radius.",[438,993,441],{"id":440},[189,995,996,998],{},[193,997,446],{}," Chargeback becomes possible because the job is named. Close workstreams can attach ERP read-only, load the close checklist from the wiki, and keep GTM out of the ledger. A company-wide AI pool with no workstream attribution is a shared kitchen.",[189,1000,1001,1003,1004,1006],{},[193,1002,452],{}," Scope is a processing purpose. A workstream for a renewal can include legal and go-to-market on ",[258,1005,334],{}," goal without merging their entire universes. Legal also gets a closed state: when the job ends, retention follows the type of record instead of an immortal channel.",[189,1008,1009,1011],{},[193,1010,463],{}," This is the ticket analogue they already wanted. Ops should refuse god workspaces, insist on a finish line, and treat human wait as a status, not a side conversation in Slack.",[189,1013,1014,1016],{},[193,1015,469],{}," Cross-functional launches finally have a place that is not a merged Slack. GTM still should not get finance’s ERP “for context.” Templates beat copying last quarter’s thread, which silently copies last quarter’s over-attached connectors.",[189,1018,1019,1021,1022,1024],{},[193,1020,475],{}," Least privilege is now a product object, not a memo. Connectors default to read-only. Adding a write path is a deliberate change to ",[258,1023,334],{}," job, not a tenant-wide toggle. A workstream that never closes is a standing access grant.",[438,1026,485],{"id":484},[189,1028,1029,1032],{},[193,1030,1031],{},"One workstream per person."," You cannot archive “my stuff.” You cannot attribute it. You cannot apply least privilege.",[189,1034,1035,1037],{},[193,1036,880],{}," Setup is easier. Blast radius is the company.",[189,1039,1040,1043],{},[193,1041,1042],{},"ChatGPT Projecthe unit."," Some files, some instructions. Typically no connector-level least privilege, quoted writes, spend caps, or lasting record. Fine for personal research. Not an operations unit.",[189,1045,1046,1049],{},[193,1047,1048],{},"Too small."," If setup exceeds the job, use a lighter sanctioned copilot path. Do not open a workstream to rewrite one sentence.",[189,1051,1052,1055],{},[193,1053,1054],{},"Too large."," If you cannot explain the purpose in one sentence, or you keep attaching “one more connector,” split.",[189,1057,1058,1061],{},[193,1059,1060],{},"Never closing."," Standing rooms recreate Slack, including the archaeology problem.",[189,1063,1064],{},"Good looks like: one outcome, minimum connectors, write policy on day one, wiki sections subscribed, budget capped, named signer, archive when done. Failure looks like an org-wide copilot with every OAuth grant and a channel that outlives the campaign.",[189,1066,1067,1068,1071],{},"The ",[211,1069,1070],{"href":542},"enterprise AI OS"," metaphor is isolation plus I\u002FO plus state. The workstream is the isolation unit. Without it, connectors, wiki, and agent teams have nowhere to attach that an auditor could name.",[238,1073,548],{"id":547},[189,1075,1076,1077,1080],{},"In Nimbus, workstreams are how ",[211,1078,1079],{"href":928},"agentic workflows"," become company objects rather than a file only one engineer can run.",[189,1082,1083],{},"Each workstream carries a brief, wiki sections (approved playbooks), connector attachments (read-only by default), agent team assignment, spend budget, release policy on writes, and nodes on the Lifecycle Graph.",[189,1085,1086,1087,1089],{},"Cross-department work is multiple teams on one workstream, not a merged Slack. Operators open this themselves; the point of an ",[211,1088,543],{"href":542}," is that the job folder is a product, not a forward-deployed spreadsheet.",[189,1091,575,1092,1095,1096,695,1100,695,1104,215],{},[211,1093,31],{"href":1094},"\u002Fproduct\u002Fworkstreams\u002F",". Related product: ",[211,1097,1099],{"href":1098},"\u002Fproduct\u002Fagent-teams\u002F","Agent teams",[211,1101,1103],{"href":1102},"\u002Fproduct\u002Fwiki\u002F","Wiki",[211,1105,39],{"href":578},[238,1107,587],{"id":586},[438,1109,1111],{"id":1110},"is-a-chatgpt-project-a-workstream","Is a ChatGPT “Project” a workstream?",[189,1113,1114],{},"It is a weak analogue: some files, some custom instructions. It typically lacks connector-level least privilege, quoted writes, spend caps, and a lasting record. Useful for personal research. Not an operations unit.",[438,1116,1118],{"id":1117},"how-small-is-too-small","How small is too small?",[189,1120,1121],{},"If the setup cost exceeds the job, use a lighter sanctioned copilot path. Do not create a workstream to rewrite one sentence.",[438,1123,1125],{"id":1124},"how-large-is-too-large","How large is too large?",[189,1127,1128],{},"If you cannot explain the purpose in one sentence, or you keep attaching “one more connector,” split.",[438,1130,1132],{"id":1131},"can-one-workstream-serve-multiple-departments","Can one workstream serve multiple departments?",[189,1134,1135,1136,1138],{},"Yes — go-to-market and legal on a renewal, for example. They share ",[258,1137,334],{}," goal’s scope, not each other’s entire universe.",[438,1140,1142],{"id":1141},"how-do-we-budget-them","How do we budget them?",[189,1144,1145,1146,215],{},"Caps per workstream, plus an organisation pool. Chargeback by workstream beats “the AI bill.” See ",[211,1147,429],{"href":428},[438,1149,1151],{"id":1150},"is-a-slack-channel-with-a-bot-enough-if-we-add-a-approve-command","Is a Slack channel with a bot enough if we add a \u002Fapprove command?",[189,1153,1154],{},"No. A command is not connector least privilege, a quoted payload, a durable chain, or an archive policy. It is still a room.",[438,1156,1158],{"id":1157},"who-is-allowed-to-open-a-workstream","Who is allowed to open a workstream?",[189,1160,1161,1162,215],{},"Whoever is allowed to open that class of job in analogue life — with the same instinct as who may open a ticket or a change request. An “AI team” bottleneck recreates the waitlist that causes ",[211,1163,435],{"href":313},[438,1165,1167],{"id":1166},"what-happens-when-the-job-ends","What happens when the job ends?",[189,1169,1170],{},"Close or archive. Revoke standing connector usefulness. Keep the reconstructable chain according to retention, not the entire chat.",[438,1172,1174],{"id":1173},"do-we-need-a-workstream-for-read-only-analysis","Do we need a workstream for read-only analysis?",[189,1176,1177,1178,215],{},"When the analysis crosses systems, roles, or must be replayed later, yes. When it is personal drafting with no live-system scope, a sanctioned copilot may be enough. See ",[211,1179,1181],{"href":1180},"\u002Fblog\u002Fcollaborative-ai-and-personal-assistants\u002F","collaborative AI and personal assistants",[438,1183,1185],{"id":1184},"how-do-wiki-and-connectors-differ-inside-a-workstream","How do wiki and connectors differ inside a workstream?",[189,1187,1188],{},"Wiki is asserted policy the job must follow. Connectors are live systems the job may read (and, if enabled, write). Mixing them into one “knowledge” pile is how Drive folklore overwrites the playbook.",[438,1190,1192],{"id":1191},"can-we-keep-one-standing-workstream-for-ask-anything","Can we keep one standing workstream for “ask anything”?",[189,1194,1195],{},"You can. You will recreate the copilot, including over-share. Standing Q&A belongs on a tightly scoped, read-only path if it exists at all.",[438,1197,1199],{"id":1198},"how-does-this-relate-to-agent-teams","How does this relate to agent teams?",[189,1201,1202,1203,215],{},"The workstream is the job. The agent team is the cast assigned to it. Changing the cast does not change the brief, the connectors, or the signer. See ",[211,1204,891],{"href":890},[238,1206,690],{"id":689},[189,1208,1209,1211,1212,215],{},[211,1210,701],{"href":542}," and ",[211,1213,1214],{"href":928},"What is an agentic workflow",[238,1216,705],{"id":704},[243,1218,1219,1224],{},[207,1220,1221],{},[211,1222,1223],{"href":841},"Atlassian, epics, stories, and themes",[207,1225,1226],{},[211,1227,1228],{"href":873},"HHS, HIPAA minimum necessary requirement",{"title":169,"searchDepth":170,"depth":170,"links":1230},[1231,1232,1236,1237,1251,1252],{"id":240,"depth":170,"text":241},{"id":353,"depth":170,"text":354,"children":1233},[1234,1235],{"id":440,"depth":750,"text":441},{"id":484,"depth":750,"text":485},{"id":547,"depth":170,"text":548},{"id":586,"depth":170,"text":587,"children":1238},[1239,1240,1241,1242,1243,1244,1245,1246,1247,1248,1249,1250],{"id":1110,"depth":750,"text":1111},{"id":1117,"depth":750,"text":1118},{"id":1124,"depth":750,"text":1125},{"id":1131,"depth":750,"text":1132},{"id":1141,"depth":750,"text":1142},{"id":1150,"depth":750,"text":1151},{"id":1157,"depth":750,"text":1158},{"id":1166,"depth":750,"text":1167},{"id":1173,"depth":750,"text":1174},{"id":1184,"depth":750,"text":1185},{"id":1191,"depth":750,"text":1192},{"id":1198,"depth":750,"text":1199},{"id":689,"depth":170,"text":690},{"id":704,"depth":170,"text":705},"An AI workstream is one shared job: a brief, the tools allowed, the people and AI on it, a budget, and a finish line.",{"eyebrow":772,"title":1255},"One job, one shared place",[1257,1260,1263],{"question":1258,"answer":1259},"What is an AI workstream?","A shared workspace for one job: a brief, the tools allowed, the people and AI on it, a budget, and a finish line.",{"question":1261,"answer":1262},"Is a Slack channel with a bot a workstream?","No. A channel has no brief, no allowed-tool list, and no finish line a person can refuse.",{"question":1264,"answer":1265},"What makes it finish?","A named outcome and someone who can say the work does not go out.","\u002Fblog\u002Fwhat-is-an-ai-workstream",{"title":817,"description":1253},"blog\u002Fwhat-is-an-ai-workstream",[786,1270,1271,789],"workstreams","enterprise-ai","GqysvBAVOydIlMQ2bTUJZvFY1Z9D-lp9m7VqL4XVPA0",{"id":1274,"title":1275,"archived":163,"authors":164,"badge":1276,"body":1280,"date":769,"definedTerm":164,"department":164,"description":1609,"extension":172,"eyebrow":164,"faqHeader":1610,"faqs":1612,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1622,"relatedHeading":164,"seo":1623,"series":1624,"sitemap":131,"status":164,"stem":1625,"subhead":164,"tags":1626,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1630},"content\u002Fblog\u002Fnimbus-vs-microsoft-copilot.md","Nimbus vs Microsoft Copilot: Great Inside Office, or Work That Leaves Microsoft?",{"label":1277,"10|authors":1278},"Comparisons",[1279],{"name":182,"to":183},{"type":166,"value":1281,"toc":1591},[1282,1304,1307,1327,1329,1382,1386,1392,1401,1408,1419,1422,1425,1429,1432,1435,1438,1441,1444,1446,1459,1473,1481,1485,1487,1491,1494,1498,1501,1505,1510,1514,1521,1525,1528,1532,1535,1539,1546,1550,1556,1558,1568,1570],[189,1283,1284,1285,1291,1292,1298,1299,1303],{},"“Copilot” is several products that get collapsed in procurement. ",[193,1286,1287],{},[211,1288,1290],{"href":1289},"https:\u002F\u002Fwww.microsoft.com\u002Fmicrosoft-365\u002Fcopilot","Microsoft 365 Copilot"," is the add-on that sits in Word, Excel, PowerPoint, Outlook, Teams, and the Copilot app. ",[193,1293,1294],{},[211,1295,1297],{"href":1296},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fmicrosoft-copilot-studio\u002F","Copilot Studio"," is the low-code environment for multi-step agents beyond Microsoft. Nimbus is an ",[211,1300,1302],{"href":1301},"\u002Fblog\u002Fwhat-is-an-agent-harness\u002F","agent harness"," for work that leaves Microsoft — Salesforce, NetSuite, and the rest of the stack where money actually moves.",[189,1305,1306],{},"Nobody else will be as good at “summarise this thread and the attached deck” inside Outlook. That recap is tenant productivity. Updating forty opportunities in Salesforce is company operations. If your programme starts with “every knowledge worker has a Copilot licence,” you are specifying Microsoft. If it starts with “RevOps will not allow unapproved Salesforce writes from an agent, and we need a record of those releases,” you are specifying Nimbus. You can keep both. Using Nimbus does not mean ripping Copilot out of Office.",[189,1308,1309,1310,1211,1314,1318,1319,1322,1323,1326],{},"Microsoft’s own ",[211,1311,1313],{"href":1312},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fmicrosoft-365\u002Fcopilot\u002Fmicrosoft-365-copilot-architecture","architecture",[211,1315,1317],{"href":1316},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fcopilot\u002Fmicrosoft-365\u002Fmicrosoft-365-copilot-privacy","privacy"," docs are the source: Copilot is grounded in Microsoft Graph — mail, files, meetings, and sites the user can already access — and prompts, responses, and Graph data are not used to train foundation LLMs. That is the right privacy story for find-and-draft inside Microsoft. It still describes ",[258,1320,1321],{},"find and draft inside Microsoft",", not ",[258,1324,1325],{},"sign a write in Salesforce",". Agent Builder covers simple agents inside Copilot, grounded in Microsoft 365 content, for information workers. Studio is the step that leaves Graph.",[238,1328,241],{"id":240},[243,1330,1331,1337,1343,1349,1355,1361,1371,1376],{},[207,1332,1333,1336],{},[193,1334,1335],{},"Microsoft 365 Copilot."," The per-person assistant inside Office, grounded in Microsoft Graph — mail, files, meetings, and sites the user can already access.",[207,1338,1339,1342],{},[193,1340,1341],{},"Microsoft Graph."," The map of what this person can already open in Microsoft 365. Copilot should not leak a file they cannot open in SharePoint.",[207,1344,1345,1348],{},[193,1346,1347],{},"Copilot Studio."," Low-code agents with branching, approvals, and connectors to Salesforce, SAP, ServiceNow, and custom APIs. You can publish to Teams. Metering is often credits or messages on top of licences.",[207,1350,1351,1354],{},[193,1352,1353],{},"Agent Builder."," Simple agents inside Copilot, grounded in Microsoft 365 content, for information workers.",[207,1356,1357,1360],{},[193,1358,1359],{},"Workstream."," In Nimbus, a shared workspace for one job across systems that are not all Microsoft.",[207,1362,1363,1366,1367,1370],{},[193,1364,1365],{},"Write-back."," Changing a live system. You ",[258,1368,1369],{},"can"," update Salesforce from Studio. The update is a flow-shaped side effect in Microsoft’s world. In Nimbus it is a quoted release with a named signer.",[207,1372,1373,1375],{},[193,1374,918],{}," The causal record of who approved, what changed, and what the next team should believe.",[207,1377,1378,1381],{},[193,1379,1380],{},"E5."," Microsoft 365 E5 explains identity, compliance, and Office. It does not explain CRM write-back or a company work ledger.",[238,1383,1385],{"id":1384},"why-the-difference-matters","Why the difference matters",[189,1387,1388,1389,1391],{},"Studio agents that leave Graph for other connectors inherit a different permission story: connector logins, rules that stop sensitive files leaking, environment strategy. IT knows this is where Copilot programmes stall. You ",[258,1390,1369],{}," update Salesforce from Studio. The update is a flow-shaped side effect in Microsoft’s world. In Nimbus it is a quoted release with a named signer. Approvals in a Power Platform artefact are real. They are not a Lifecycle Graph of the job across departments.",[189,1393,1394,1395,1397,1398,1400],{},"In Nimbus, the scarce resource is control of work across systems that are not all Microsoft. The quarterly review deck may live in SharePoint. The opportunities live in Salesforce. The revenue number finance trusts may live in NetSuite. A ",[211,1396,339],{"href":338}," puts those in one job. Records stay read-only until someone who is allowed to approve writes actually does. The ",[211,1399,23],{"href":523}," keeps the release.",[189,1402,1403,1407],{},[211,1404,1406],{"href":1405},"\u002Fblog\u002Fnimbus-vs-glean\u002F","Glean","-class search and Copilot-class Graph grounding solve findability. Nimbus assumes you can already find the policy. The failure is that AI work does not land in a signed-off artefact. Purpose limitation is easier to explain when a recruiting workstream cannot see finance forecasts. A Copilot licence that sees “whatever this user can already open” is a different design — Microsoft’s Graph design, by intention. That design is correct inside Office. It is a wide blast radius if the same licence is treated as the operating model for every system the user can already open.",[189,1409,1410,1411,1414,1415,1418],{},"Lock-in is the honest trade. Copilot deepens Microsoft 365. Nimbus is lock-in of a different kind: the work loop and the graph. If most proprietary work is already in Microsoft, Copilot’s return is easier. If most money-moving systems are Salesforce, NetSuite, and specialist software, Copilot Studio becomes a connector project — and Nimbus was designed as that project plus the record. E5 explains identity, compliance, and Office. It does not explain CRM ",[211,1412,1413],{"href":264},"write-back",", choosing models across vendors, or a Lifecycle Graph. Standardise Copilot where Microsoft’s graph ",[258,1416,1417],{},"is"," the work. Standardise an operating layer where the business process is the work.",[189,1420,1421],{},"Role by role: a knowledge worker in Word, Excel, Outlook, and Teams wants the side pane — nobody else will recap the thread and the attached deck as well. IT owns Graph, licences, and often Studio as a Power Platform artefact: a helpdesk bot, an HR FAQ, a Teams helper. RevOps lives in Salesforce, not in SharePoint; a Studio connector to Salesforce is a flow-shaped side effect, not a company release. Finance trusts NetSuite, not the recap. Security will like Graph grounding and the privacy docs, and still ask who signed a CRM write. A CIO who already bought E5 should use Copilot where Microsoft’s graph is the work — and still not pretend E5 bought an operating layer.",[189,1423,1424],{},"SharePoint agents are Q&A on sites. Use them for findability. Do not use them as the operating model. Keep Copilot in Office. Put the job that leaves Microsoft in a workstream.",[238,1426,1428],{"id":1427},"when-microsoft-copilot-is-a-better-fit","When Microsoft Copilot is a better fit",[189,1430,1431],{},"Choose Microsoft 365 Copilot when the job is knowledge-worker productivity in Word, Excel, Outlook, and Teams, and Microsoft’s own files and mail are the corpus.",[189,1433,1434],{},"Choose Copilot Studio when the agent is a Power Platform artefact IT will own — a helpdesk bot, an HR FAQ, a Teams helper. Metering is often credits or messages on top of licences; budget that as a Microsoft programme, not as a Nimbus substitute.",[189,1436,1437],{},"SharePoint agents are Q&A on sites. Use them for findability. Do not use them as the operating model.",[189,1439,1440],{},"Do not choose Copilot as a stealth operating layer for non-Microsoft systems. You will spend a year on connector reviews and still lack workstreams, specialist teams, and a Lifecycle Graph.",[189,1442,1443],{},"Keep Copilot in Office. Using Nimbus does not mean ripping it out. A coherent coexistence: Copilot for tenant productivity; Nimbus for jobs that also touch Salesforce, NetSuite, and the rest of the stack. Drafts can move from a recap into a workstream. Write credentials for money-moving systems should sit in Nimbus connector scopes, not in a Studio flow by default.",[238,1445,548],{"id":547},[189,1447,1448,1449,1453,1454,1458],{},"Nimbus does not try to be the Word side pane. It does not assume the only intelligence in the company is whatever Microsoft licensed this quarter. See ",[211,1450,1452],{"href":1451},"\u002Fmodels\u002F","models",". Routing includes not throwing the most powerful model at a simple lookup. Treat Microsoft-hosted models as infrastructure options in an enterprise conversation with ",[211,1455,1457],{"href":1456},"\u002Fcontact\u002F","sales",", not as a reason Copilot and Nimbus are the same product.",[189,1460,1067,1461,1464,1465,1469,1470,1472],{},[211,1462,1463],{"href":1102},"wiki"," is what the company asserts. ",[211,1466,1468],{"href":1467},"\u002Fintegrations\u002F","Connectors"," are scoped per workspace. Agents get the systems you attached, in the mode you allowed, until a human releases a write. ",[211,1471,1099],{"href":1098}," finish the work Copilot handed you after the recap.",[189,1474,1475,1476,1480],{},"You can ",[211,1477,1479],{"href":1478},"\u002Foverview\u002F","set Nimbus up yourselves",". Copilot programmes at organisational scale are famous for implementation. Keep Copilot in Office; do not staff a consulting partner to invent an operating layer.",[189,1482,575,1483,215],{},[211,1484,39],{"href":578},[238,1486,587],{"id":586},[438,1488,1490],{"id":1489},"does-nimbus-replace-microsoft-365-copilot","Does Nimbus replace Microsoft 365 Copilot?",[189,1492,1493],{},"No. Keep Copilot in Office. Nimbus does not try to be the Word side pane. It tries to be the place agent teams finish work that leaves Microsoft.",[438,1495,1497],{"id":1496},"does-copilot-studio-replace-nimbus","Does Copilot Studio replace Nimbus?",[189,1499,1500],{},"Only if “a few Power Platform agents” is the entire AI programme. Studio can be shared inside the Microsoft tenant. It does not replace Nimbus as a governed execution layer with a company wiki and an operational ledger.",[438,1502,1504],{"id":1503},"can-nimbus-use-azure-openai-or-microsoft-models","Can Nimbus use Azure OpenAI or Microsoft models?",[189,1506,1507,1508,1458],{},"Nimbus routes models for quality, cost, and latency — including not throwing the most powerful model at a simple lookup. Treat Microsoft-hosted models as infrastructure options in an enterprise conversation with ",[211,1509,1457],{"href":1456},[438,1511,1513],{"id":1512},"why-not-standardise-on-copilot-because-we-already-buy-microsoft-365-e5","Why not standardise on Copilot because we already buy Microsoft 365 E5?",[189,1515,1516,1517,1414,1519,1418],{},"E5 explains identity, compliance, and Office. It does not explain CRM ",[211,1518,1413],{"href":264},[258,1520,1417],{},[438,1522,1524],{"id":1523},"do-we-need-a-microsoft-partner-to-get-nimbus-running","Do we need a Microsoft partner to get Nimbus running?",[189,1526,1527],{},"No. You can set it up yourselves. Copilot Studio at organisational scale usually is not self-serve in the same way.",[438,1529,1531],{"id":1530},"can-we-keep-copilot-and-put-salesforce-writes-in-nimbus","Can we keep Copilot and put Salesforce writes in Nimbus?",[189,1533,1534],{},"Yes. That is the intended coexistence. Recap in Outlook; finish in a workstream. Do not let a Studio Salesforce connector become the unofficial write path “because we already had an approval step in the flow.” Quote the change, name the signer, store the outcome.",[438,1536,1538],{"id":1537},"who-should-own-which-product","Who should own which product?",[189,1540,1541,1542,1545],{},"IT typically owns Microsoft 365 Copilot and Studio: licences, Graph, Power Platform environments. Line operators own Nimbus workstreams that touch Salesforce, NetSuite, and specialist systems. Security reviews Graph grounding ",[258,1543,1544],{},"and"," write gates. A single “we already pay Microsoft” owner will stretch Copilot into an operating layer.",[438,1547,1549],{"id":1548},"what-about-glean-if-we-already-have-copilot","What about Glean if we already have Copilot?",[189,1551,1552,1553,215],{},"Copilot respects Microsoft permissions inside Microsoft. Glean searches across many apps, including Microsoft, and respects source permissions. You may still need Glean if SharePoint search is not enough, and still need Nimbus if neither is an operating layer. See ",[211,1554,1555],{"href":1405},"Nimbus vs Glean",[238,1557,690],{"id":689},[189,1559,1560,695,1562,695,1564,698,1566,215],{},[211,1561,1302],{"href":1301},[211,1563,265],{"href":264},[211,1565,701],{"href":542},[211,1567,1555],{"href":1405},[238,1569,705],{"id":704},[243,1571,1572,1576,1581,1586],{},[207,1573,1574],{},[211,1575,1290],{"href":1289},[207,1577,1578],{},[211,1579,1580],{"href":1316},"Microsoft 365 Copilot privacy",[207,1582,1583],{},[211,1584,1585],{"href":1312},"Microsoft 365 Copilot architecture",[207,1587,1588],{},[211,1589,1590],{"href":1296},"Microsoft Copilot Studio",{"title":169,"searchDepth":170,"depth":170,"links":1592},[1593,1594,1595,1596,1597,1607,1608],{"id":240,"depth":170,"text":241},{"id":1384,"depth":170,"text":1385},{"id":1427,"depth":170,"text":1428},{"id":547,"depth":170,"text":548},{"id":586,"depth":170,"text":587,"children":1598},[1599,1600,1601,1602,1603,1604,1605,1606],{"id":1489,"depth":750,"text":1490},{"id":1496,"depth":750,"text":1497},{"id":1503,"depth":750,"text":1504},{"id":1512,"depth":750,"text":1513},{"id":1523,"depth":750,"text":1524},{"id":1530,"depth":750,"text":1531},{"id":1537,"depth":750,"text":1538},{"id":1548,"depth":750,"text":1549},{"id":689,"depth":170,"text":690},{"id":704,"depth":170,"text":705},"Microsoft 365 Copilot lives in Word, Outlook, and Teams; Nimbus is for jobs that also touch Salesforce, NetSuite, and the rest of the business.",{"eyebrow":772,"title":1611},"Inside Office, or across the company",[1613,1616,1619],{"question":1614,"answer":1615},"Where does Microsoft 365 Copilot live?","In Word, Outlook, and Teams. It is strong where the work already sits in Microsoft 365.",{"question":1617,"answer":1618},"When is that not enough?","When the job also touches Salesforce, NetSuite, or anything else outside that suite.",{"question":1620,"answer":1621},"Do we replace Copilot?","No. Keep it for Office work. Use Nimbus for the job that has to leave Microsoft and still have a signer.","\u002Fblog\u002Fnimbus-vs-microsoft-copilot",{"title":1275,"description":1609},"comparisons","blog\u002Fnimbus-vs-microsoft-copilot",[1624,1627,1628,1629,1271],"microsoft-copilot","copilot-studio","m365","wOEE0tFNw3fpqNYUAVE31zDiChOKd5i0BdiFV9cFPyo",{"enabled":163,"message":1632,"linkLabel":79,"linkHref":80,"id":1633,"title":1634,"archived":163,"authors":164,"badge":164,"body":1635,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1639,"relatedHeading":164,"seo":1640,"series":164,"sitemap":163,"status":164,"stem":1641,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1642},"We're hiring! Join the team building the Sentient Enterprise.","content\u002Fshared\u002Fhiring.md","Hiring banner",{"type":166,"value":1636,"toc":1637},[],{"title":169,"searchDepth":170,"depth":170,"links":1638},[],"\u002Fshared\u002Fhiring",{"title":1634,"description":169},"shared\u002Fhiring","1zs3boivKda1e-b-hAyuNcmZSKjZUAXmecnwHVgcHzk",{"fold":1644,"id":1648,"title":1649,"archived":163,"authors":164,"badge":164,"body":1650,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":1654,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1658,"relatedHeading":164,"seo":1659,"series":164,"sitemap":163,"status":164,"stem":1660,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1661},{"headline":1645,"description":1646,"primaryLabel":8,"primaryTo":1647,"secondaryLabel":809,"secondaryTo":12},"Run frontier AI your business actually owns.","Governed workstreams, 3,000+ integrations, and a proprietary knowledge graph. Start on Free.","\u002Fsignup?plan=free","content\u002Fshared\u002Fcta.md","Site CTAs",{"type":166,"value":1651,"toc":1652},[],{"title":169,"searchDepth":170,"depth":170,"links":1653},[],{"headline":1655,"description":1656,"primaryLabel":8,"primaryTo":1647,"secondaryLabel":1657,"secondaryTo":85},"See what governed AI looks like on your stack.","Connect your tools, run a workstream, and keep every decision on your ledger. Start on Free.","Talk to our team","\u002Fshared\u002Fcta",{"title":1649,"description":169},"shared\u002Fcta","eYqahyaPnbp8GKrWpoORbZdtmkWmgHr5F61ZHOnb8sY",1792999485744]