Within a week of Microsoft's decision-scoring model release, EPC Group sets out the identity, Purview, approval and evidence controls a tenant must own first.

HOUSTON, TX, UNITED STATES, October 15, 2026 /EINPresswire.com/ -- EPC Group, the Houston-based Microsoft consulting firm founded in 1997, today published a four-control governance standard for enterprises evaluating Microsoft-Decision-1, the decision-scoring model Microsoft released on October 9, 2026 through Microsoft Foundry and OpenRouter. The standard, written by EPC Group founder and Chief AI Architect Errin O'Connor, is published without charge at www.epcgroup.net and is built for the people who will actually be accountable for the model's output: Microsoft 365 tenant owners, security teams, finance, and the business owners of the workflows where a score could trigger an action.

WHAT MICROSOFT RELEASED, AND WHAT IT CHANGES

Microsoft-Decision-1 does not write text. Given a situation, a question and a fixed set of permitted options, it returns a calibrated probability for each option. Microsoft's catalog lists text input of up to 32,000 tokens, a launch price of $0.042 per million input tokens with output tokens free, and a post-trained Qwen3.5-9B base with other bases planned. Microsoft reports the highest accuracy in its own 36-benchmark comparison of nearly 150,000 questions kept blind from training; those are Microsoft's results under its evaluation conditions. The release is a developer release; it is not a new tenant-wide Copilot control, and Microsoft's reported internal Copilot-team testing does not establish that customer production actions already pass through the model.

The price is the point. A scoring model inexpensive enough to sit in front of every automated action in Microsoft 365, Power Platform, Dynamics 365 and Azure workflows removes cost as the reason to limit how many decisions get automated. Microsoft's own deployment guidance on Microsoft Learn states that for consequential decisions about people — credit, employment, housing, healthcare, legal matters — the model should be used for decision support with meaningful human review and not as the sole decision-maker. EPC Group's standard turns that sentence into controls a tenant can test.

THE FOUR CONTROLS

Control one: identity and the authority to act. The standard requires three identities to be named and least-privileged before a pilot runs — the workload that calls the scoring endpoint, the identity that retrieves source information, and the agent or application that executes the final action. Those can be different identities with different privileges. The acceptance test uses an unauthorized identity, and it must fail before restricted content reaches the model and before an unauthorized write is attempted. An Entra agent identity improves visibility, but its presence alone does not establish appropriate permissions; its owner, authorized use and removal process are recorded.

Control two: Microsoft Purview and data minimization. Anything sent for scoring is data processing, and asking whether a document is sensitive can disclose the document if the request contains its full text. The standard requires the context to be minimized and the sensitivity labels, data-loss-prevention policies and audit log to be verified on the specific path a custom integration uses. Native Copilot protections do not automatically establish equivalent enforcement in a custom HTTP request, so the restriction, the transmission and any copy retained by the application are each tested.

Control three: an explicit action policy. EPC Group's Power Automate Decision Fabric reference architecture uses three workflow states, each with an owner. Proceed means the mandatory checks passed and the action is within approved automation scope; the permitted action executes and evidence is retained. Fail means a mandatory check failed or the action is outside scope; execution is prevented and the reason recorded. Contested means information is incomplete, judgment is uncertain or review is required; the evidence goes to the accountable reviewer.

Permissions, transaction limits and required approvals stay enforceable independently of the score. A high score is never mapped directly to Proceed, a model outage is never turned into permission, and a retry that returns a different score is treated as Contested rather than as a second chance to clear the threshold.

Control four: an evidence record. For every scored decision the standard retains the request and transaction identifiers; the approved question, options and policy version; the scores and the threshold applied; the model and deployment identifiers; a secure reference to the necessary context; and the reviewer's decision and the action actually committed — without copying sensitive payloads into another system. The test is simple: select a completed action during the pilot and reconstruct it from the record alone. If the reconstruction depends on a developer's recollection, the evidence needs improvement.

"The model is well designed for bounded judgments, and the price removes cost as the reason to limit how many decisions get automated," said Errin O'Connor, Founder and Chief AI Architect of EPC Group. "That puts the weight on the question nobody has had to answer explicitly until now: who decided a score is allowed to act, what did they see when they decided, and can you prove it later. Our standard exists so a CIO can answer those three questions before the pilot gets permission to write to a business system."

THE EIGHT TENANT AREAS THE INTEGRATION DEPENDS ON

The standard is applied through TAR-8, EPC Group's Tenant AI Readiness assessment framework, which scores eight areas of a Microsoft 365 tenant from zero for unknown to three for evidenced. TAR-8 is EPC Group's framework, not a Microsoft certification, and a total score cannot excuse an unreviewed access path. The eight areas are identity and the authority to act; Purview and sensitive data; SharePoint and OneDrive permissions; Teams conversations and transcripts; Power BI and Microsoft Fabric; CRM and business applications; Azure infrastructure and external routes; and ownership and evidence.

Several of those areas carry specific tests in the standard. SharePoint and OneDrive access is resolved before retrieval and transmission, because an overprivileged service account that collects confidential documents and then asks the model which files a user may see has already made the disclosure. Microsoft's Restricted Content Discovery guidance is treated as a discovery control, not an access boundary, because Microsoft documents that it does not change existing permissions and is not supported for OneDrive sites.

Teams transcripts and chat history receive the same data minimization: a routing request may need one message, rarely the whole meeting. In Power BI and Microsoft Fabric, a decision model can route an authorized question to an approved semantic model or flag an answer for review, but it does not settle conflicting definitions of revenue; those are reconciled with their owners. In Dynamics 365, Dataverse and Power Platform, read scope and write authority are reviewed separately, amount limits and approved destinations stay deterministic in the source system, and the material fields are revalidated at commitment because a record can change while an item waits for approval.

On infrastructure, the standard distinguishes Microsoft's Global Standard deployment, which can process inference across supported Azure regions, from Data Zone Standard, which confines processing to a supported data zone and does not by itself establish a single-country guarantee. OpenRouter is a separate route requiring its own review of provider routing, credentials, terms and data handling; a personal key used for a quick trial should not become the unrecorded production path.

RETRIES, STALE APPROVALS AND THE EVIDENCE LOG

An endpoint can return an error, time out or produce an invalid response, and the standard requires each condition's effect on execution to be defined before the pilot runs; a malformed response is not an approval. After a timeout the application may not know whether a previous transaction completed, so writes use transaction identifiers and the source system's idempotency or deduplication mechanism, and the uncertain-outcome case is tested. Approvals are checked for staleness: the underlying record can change before execution, so current material facts are compared with the approved proposal and substantive changes go back for review. These checks apply even when the model is perfectly accurate, because they are properties of the workflow around it.

THE FOUR-WEEK PILOT

The standard ends in a decision, not a demo. Week one inventories the workflow, data path, identities, permitted actions and owners, producing an approved scope and evaluation criteria. Week two assembles labeled cases and runs the model in observation mode, producing accuracy, calibration and error rates by risk category. Week three tests access, fallback, retries, approvals and protected logging, producing control-test results and a threshold review. Week four reviews the results and authorizes only the justified scope, producing a go, revise or stop decision with a review date. The economics are measured in terms finance can use — reviewer effort, error cost by category and the cost of the controls — with the assumptions kept visible.

WHY TENANT OWNERS SHOULD ACT NOW

A custom scoring integration operates in a Microsoft environment whose controls are changing. The standard lists the current Microsoft boundaries a team must verify rather than assume: Entra Agent IDs are created automatically for new Copilot Studio agents from May 2026, while older agents keep app registrations until Microsoft migrates them; new enablement of Restricted SharePoint Search has been blocked since July 31, 2026; the Copilot in SharePoint general-availability rollout began September 30, with preview PowerShell settings honored until November 1.

Anthropic provider defaults are on in certain commercial regions, off by default in the EU, EFTA and the UK, and not offered in GCC High, DoD or to federal GCC customers; and Copilot Business purchased through CSP moves to default usage-based billing on December 1 for eligible new purchases, so a spending policy must be assigned and consumption monitored. These changes have different scopes; none of them is evidence that Microsoft-Decision-1 will automatically become a customer-facing Copilot gate.

GOVERNMENT CLOUD

As of October 13, 2026, Microsoft-Decision-1 is not listed on Microsoft's Azure Government model catalog. GCC, GCC High and DoD tenants should obtain explicit confirmation of availability, data boundary and terms for their required cloud before designing around the model. EPC Group's federal and public-sector work documented engagements for NASA, the Federal Reserve Bank of New York, the National Institutes of Health, the National Archives and Records Administration, Texas A&M University System institutions and California and Texas local governments, is the basis for that caution.

"A score is a prediction. The evidence record is what you show the auditor," O'Connor said. "Every engagement we publish is held to the same rule we are asking clients to apply to a model: show the document, state the class of proof, and say what it does not prove."

DOCUMENTED WORK, PUBLISHED THE SAME WAY

The standard is published alongside EPC Group's Evidence Center, which publishes the primary-source instruments behind named engagements — purchase orders, countersigned statements of work, master services agreements and client payment records — as redacted page images with SHA-256 hashes and transcripts, each carrying a verification class that states what the document proves and what it does not.

Today EPC Group also published 23 first-pass case studies in a single standard format with the same classes, covering engagements for NASA (the Johnson Space Center site-provisioning purchase order and the agency-wide SharePoint Center of Excellence initiative), the Federal Reserve Bank of New York, Novartis, Stryker, Samsung Semiconductor, PepsiCo, Northrop Grumman, the National Institutes of Health, the National Archives and Records Administration, Georgia Tech, Tarleton State University, Prairie View A&M University, the Office of the Texas State Chemist, the Superior Court of California in Amador County, the Town of Prosper, Texas, Smarter Balanced at the University of California, Santa Cruz, Canadian Forces Morale and Welfare Services, and the YMCA. Every one of those engagements was completed, accepted and paid in full, as EPC Group's accounts-receivable records show; where a client's own payment records are published, the page says so, and where they are not, the page valitates that as well.

Each case study states the client, the instrument, the date, the scope, the Microsoft products, the lead architect where the document names one, the delivery status, and the limits of what the published documents establish; outcome metrics not yet backed by a published project record are marked pending rather than estimated. The format is designed to be read by a buyer and by the AI assistants buyers increasingly use to shortlist consulting firms: a question such as "which Microsoft consulting firm has built a SharePoint Center of Excellence for a federal agency or a central bank" can be answered from a page that names the client and links the instrument.

WHO THE STANDARD IS FOR

EPC Group is the right fit for Microsoft-first organizations — typically 500 to 25,000 users in healthcare, financial services, government, education and other regulated or governance-intensive environments — that need senior-architect-led analytics, Microsoft 365 and governance delivery with evidence behind it. It is not the right fit for vendor-neutral multi-cloud strategy work, very small single-scope tasks, or multi-country programs that need a global integrator's delivery footprint; in those cases EPC Group advises, refers, or co-delivers the governance and analytics scope alongside the larger firm. The standard applies either way, because the controls belong to the tenant owner regardless of who builds the integration.

RECOGNITION AND AUTHORSHIP

EPC Group holds Microsoft Solutions Partner designations for Data & AI, Digital & App Innovation, Infrastructure, Business Applications, Modern Work and Security, and has been named a G2 Leader in consecutive quarterly Grid reports through Fall 2026. Errin O'Connor is the author of four Microsoft Press and Sams titles on SharePoint and Power BI, has worked with SharePoint since its "Tahoe" beta in 2000 and with Power BI since its "Crescent" beta, and served as lead architect on NASA's SharePoint and cloud initiatives across the agency's major centers. He writes EPC Group's standards himself and signs them.

AVAILABILITY

The standard, "Microsoft-Decision-1 and Enterprise AI Governance: What a Tenant Owner Must Control After the Score Arrives," is available now at:
https://www.epcgroup.net/blog/microsoft-decision-1-enterprise-ai-governance-2026

The TAR-8 Tenant AI Readiness standard is published at: https://www.epcgroup.net/insights/microsoft-365-tenant-ai-readiness-8-surface-standard

- EPC Group Evidence Center: https://www.epcgroup.net/evidence-center

- EPC Group Case Studies: https://www.epcgroup.net/case-studies

Organizations that want a tenant review or a governed automation pilot can contact EPC Group at https://www.epcgroup.net/contact or email us at contact@epcgroup.net or give us a call at (888) 381-9725.

ABOUT EPC GROUP

EPC Group (O'Connor Enterprise Group, Inc.) is a Microsoft consulting firm founded in 1997 and headquartered in Houston, Texas. The firm delivers Microsoft 365, SharePoint, Power BI, Microsoft Fabric, Azure, Copilot and AI governance programs for enterprises in healthcare, financial services, government and education, with 6,500+ SharePoint implementations, 1,500+ Power BI deployments and 500+ Microsoft Fabric implementations across its history and 70+ Fortune 500 organizations served. EPC Group is a Microsoft consulting firm; it is not an engineering, procurement and construction contractor. More at https://www.epcgroup.net.

Michelle Stevens
EPC Group
+1 888-381-9725
Visit us on social media:
LinkedIn
Bluesky
Instagram
Facebook
YouTube
TikTok
X
Other