Once an AI agent can write to systems, send email or move money, "a human approves it" is not a design. This guide classifies agent actions by consequence and reversibility, maps each class to an approval pattern, and sets out what the audit record must hold to survive a review, grounded in what Microsoft 365 Copilot, Copilot Studio, Microsoft Foundry and Purview actually provide as of September 2026.
Copilot Studio and Microsoft Foundry are not competitors — they sit at different levels of abstraction, and three changes in 2026 have quietly retired most of the advice written about choosing between them. A decision framework built on who owns the runtime, where the data already lives, and who operates the agent on day ninety, with the cost shapes, governance asymmetries and interop paths verified against Microsoft's own documentation.
Microsoft Foundry is no longer a place to call models — it is a platform for hosting, grounding, governing and operating agents. A working architecture guide to prompt and hosted agents, Foundry IQ, Toolbox, MCP and A2A, model choice and Claude, agent identity and RBAC, private networking, evaluation and Agent 365 — with every capability marked GA, Preview or retiring, and the places Microsoft's own documentation contradicts itself named rather than smoothed over.