Turn field signals into cash decisions.
Follow a fictional safety observation, payroll exception, RFI and owner report through Contoso Builders.
See the construction workflowA NEW YORK-BASED MANAGED AI AND SECURITY FIRM
Managed Intelligence Provider.
Saying no to the CEO on Copilot is not an option. Putting your name on an untested rollout is not one either. There is a third answer: yes, in a tested order. A Managed Intelligence Provider runs the AI side of your business the way a managed IT provider runs your computers. Governance, security and the workflows sit under one roof, so AI is safe to use and pays for itself.
01 Source02 Boundary03 Human decision04 Evidence
Your name goes only on decisions that were tested.
Find what is shared too widely before Copilot returns it.
Your people hold the approval gate.
START WITH THE OUTCOME
What do you want to be true by the end of the quarter?
Pick the sentence you want to be able to say. Each one opens a page that writes the first step for your own tools, free, before any call.
Safer
Nobody on my team can paste a client file into a personal AI account.The AI Governance Simulator: your task, your tools, the step where it goes wrong.Our AI policy is one page everyone signed, with the control named behind each clause.The AI Use Policy Builder: twelve answers, the draft, Word and PDF.Every agent we run has an owner, a permission row and a kill switch.The Agent Inventory Builder: up to six agents, seven columns, the three fixes first.Faster
The weekly report writes itself and a person signs it.The Workflow Finder: which tasks to hand to AI first, with the hours back.One workflow is live with a person at the gate.The Governed AI Blueprint: nine answers, the plan your owner will ask for.We know what to do next, and it is scoped in writing.A fifteen-minute scoping call with an engineer. No pitch, no access to your systems.Cheaper
The AI bill has a cap and a name on every line.The Copilot readiness check: what to switch on first and what it costs to leave off.The next AI vendor answered the questions that decide it before we signed.The Vendor AI Due Diligence Questionnaire: nine answers, the questions to send, Word and PDF.We found the agents nobody owns before an auditor did.The Agent 365 readiness check: four questions, a score, a PDF.THE CATEGORY
What does a Managed Intelligence Provider do?
A Managed Intelligence Provider runs the AI side of a business the way a managed IT provider runs its computers. Governance, security and the workflows sit under one roof, so AI is safe to use and pays for itself.
For your firm that means the controls are installed in your own Microsoft 365 environment (your tenant) and the workflows are built there too. A named person sits at every decision that matters. Simplicity IT has delivered Microsoft infrastructure and security work since 2011; AI is the newest layer under the same discipline.
THE MICROSOFT INSIGHT
What will Microsoft 365 Copilot find on day one?
Everything the signed-in user already has permission to see, including every file that was shared too widely years ago.
Microsoft 365 Copilot returns only content the signed-in user already has at least view permission to see, so anything shared too widely is findable from day one. (Microsoft Learn, checked Oct 31, 2026)
Scope and test the pilot group's access first and the first oversharing find lands in your report. Skip that step and it lands in a client meeting.
THE METHOD
How does Decision-Gated Delivery work?
Decision-Gated Delivery tests the controls, then widens the access, and every phase ends in your written decision.
- Read-only discovery. Nothing in your tenant changes.
- Findings on one page that separate what was tested from what was assumed.
- A pilot before any wave.
- Rollback agreed before anyone flips a switch.
- Your written decision closes each phase and opens the next.
THE PERMISSION ROW
Who approves what when an AI workflow runs?
A named person, at the step the permission row says needs one.
Every governed workflow carries a permission row with four settings: may see, may draft, may do with approval, may do alone. The row is agreed before the workflow runs, and each approval is recorded with its outcome. That record is what you show a board, an examiner or an auditor.
Without the row, the first action an agent takes on its own is the one you explain afterward.
THE FIRST RUNG
Where do you start when the CEO wants Copilot this quarter?
With a free four-question check, then a read-only assessment, then a scoped pilot that can start before the file cleanup finishes.
The check takes a few minutes and downloads as a PDF with no email required. The assessment is scoped separately from implementation and quoted after a scoping call. A pilot group with tested access can be live while the wider cleanup runs where the pilot shows it is needed.
AFTER TWO WEEKS
What will be working after two weeks?
- A read-only discovery of your tenant is complete, with no setting changed.
- One page separates what was tested from what was assumed, in your words.
- A pilot group is named, its access is scoped and checked, and the rollback for each planned change is written down.
- You have the next phase in front of you as a written decision, with its scope and its quote.
HONEST ABOUT LIMITS
What this does not do yet
It does not stop a person typing a client's name into a prompt. Blocking a Copilot or Cowork response when the typed prompt contains chosen sensitive information types is in preview and rolling out to tenants. (Microsoft Learn, checked Oct 31, 2026, preview) So governance starts before the prompt: labels and data loss prevention (DLP) on the files, scoped access, and a person at the gate.
It does not make a compliance claim on your behalf: the engagement produces the evidence, and your compliance officer owns the attestation.
Nothing is widened until you decide in writing, so the pace is yours, including the pace of the cleanup.
THE ONE THING TO REMEMBER
Copilot shows people what they already have permission to see, so test the permissions before you widen the access.
Said another way: the risk sits in your sharing settings, not in the AI.
Said a third way: a tested decision carries your name; an assumption carries your name on the incident.
EXPLORE THE WORK
From a job site to an agent control room.
Put a person at the agent action gate.
Hartwell Trust Bank shows how ownership, permission checks and evidence work together.
See the governance pathTest the boundary before buying hardware.
Compare tenant-private and local options against the workload and its data rules.
See the private AI methodConnect a signal to an accountable response.
Use Microsoft Defender XDR and Microsoft Sentinel evidence to guide an approved containment step.
See the response pathCREDIBILITY
Show the evidence behind the claim.
Simplicity IT is a Microsoft Solutions Partner. Partner designations and funding options are verified for each engagement before they appear in a proposal.
The operating model connects with Simple Growth, SimpleOS Reach, SimpleOS Delivery, Simple Time, SimpleOS Desk, Simple Merge and Simple Council. These are Simple Intelligence Group software products, separate from Simplicity IT services.
Review the proofSHOW YOUR WORK
See the control path on a fictional bank.
What a pasted prompt can expose
A fictional bank tests the data boundary before access widens.
Coming
See every demonstrationDIRECT ANSWERS
Questions before you decide.
What is a Managed Intelligence Provider?
A firm that runs the AI side of a business the way a managed IT provider runs its computers. Governance, security and the workflows sit under one roof, so AI is safe to use and pays for itself. Simplicity IT is one, for regulated mid-market firms on Microsoft.
Do you work inside our Microsoft tenant or on your own platform?
Inside your tenant. Controls are built with Microsoft Purview, Microsoft Entra, Microsoft Defender and Microsoft Agent 365, and workflows run in Microsoft 365. Nothing of yours moves to a platform Simplicity IT owns.
What happens first?
Read-only discovery. No setting changes until you hold a one-page record of what was tested and what was assumed. Then you decide in writing which step comes next.
Can a Copilot pilot start before the file cleanup is finished?
Yes, when the pilot group's access is scoped and tested first. Decision-Gated Delivery pilots before waves, so the cleanup runs where the pilot proves it is needed instead of everywhere at once.
How is the work priced?
Quoted after a scoping call. Assessment is scoped separately from implementation, rollback is agreed before any switch is flipped, and a named delivery lead is on every engagement.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.