AI Agents in the Workplace: A Governance Guide for Indian SMBs

Last month a manufacturing client in Pune called me in a mild panic. Someone in their accounts team had given Microsoft Copilot access to the company's shared SharePoint folder to "help draft supplier emails faster." Within two weeks, Copilot was cheerfully pulling salary figures, a half-finished acquisition memo, and a vendor's confidential pricing into responses that landed in the wrong inboxes. Nobody had done anything malicious. The tool simply had access to everything, and no one had drawn the lines.

That's the uncomfortable reality of AI agents right now. These aren't chatbots that answer questions. They're systems that act on your behalf: reading files, sending emails, updating records, triggering workflows. Microsoft reported that Copilot usage among business customers has grown sharply through 2024-2025, and Google's Gemini is now bundled into Workspace plans most Indian SMBs already pay for. The agents are already inside your building. The question is whether anyone gave them a security badge and a rulebook.

This post is a practical field guide to AI agent governance for SMBs in India. I'll walk through how to scope what agents can touch, how to build approval gates and audit trails that survive a compliance check, and what this costs in real rupees. No theory. This is what I actually set up for clients running 20 to 200 people.

Key Takeaways

• An AI agent inherits the access permissions of whoever runs it, so a poorly-scoped user account becomes a poorly-scoped agent. Fix access before you deploy.
• Start with a "read-only, human-approves-everything" posture and loosen it deliberately, not the other way around.
• Audit trails are not optional. If your agent sends an email or edits a record, you need a log showing what it did and why. This matters for DPDP Act compliance and any future dispute.
• Budget ₹500 to ₹2,500 per user per month for licensing, plus a one-time ₹40,000 to ₹1.5 lakh for governance setup depending on your size.
• Both Microsoft 365 Copilot and Google Workspace Gemini can be governed properly, but the controls live in different admin consoles and need someone who knows where to look.
• Name a human owner for every agent. "The AI did it" is not a defence anyone accepts.

Why do AI agents in the workplace need governance at all?

Here's the mental model that helps. A traditional software tool does exactly what you click. An AI agent decides how to accomplish a goal you gave it, and it makes those decisions using whatever data and permissions it can reach. Give it a vague instruction like "follow up with clients who haven't paid," and it will interpret that. It might email the right people. It might also email a client who paid last week because the invoice status hadn't synced.

The core risk is not that the AI is malicious. It's that it's capable and literal. It will do a lot, quickly, based on incomplete context and broad access. In an Indian SMB where the same person often handles HR, accounts, and vendor relations from one login, that broad access is the norm, not the exception.

Three specific things go wrong without governance:

• Over-exposure of data. The agent surfaces information the user technically has access to but shouldn't be broadcasting: salary sheets, GST filings, customer PII, unsigned contracts.
• Unauthorised actions. The agent sends, deletes, approves, or schedules something no human reviewed.
• No accountability. When something goes wrong, there's no record of what the agent did, on whose instruction, using what data.

Under the Digital Personal Data Protection Act, 2023, your business is the "data fiduciary" responsible for personal data you process. An AI agent leaking a customer's phone number and address is your liability, not the software vendor's. That's why governance is not a nice-to-have. It's the thing standing between you and a reportable data breach.

What can go wrong: a real case from a Gurgaon services firm

A 35-person digital marketing agency in Gurgaon rolled out Microsoft 365 Copilot to their entire team in early 2025. Licensing came to roughly ₹2,000 per user per month, so about ₹70,000 monthly. The pitch was faster proposals and cleaner client reports. Reasonable goals.

The problem showed up in month two. Their Copilot deployment had access to the full SharePoint and OneDrive estate, and permissions had accumulated messily over years. Interns had access to folders they'd been added to for a single project and never removed from. When staff asked Copilot to "summarise everything we know about Client X," it dutifully pulled in an internal margin sheet showing they were charging Client X almost double what they charged a similar client. That summary got pasted, unedited, into a shared workspace two junior staff could see. Word travels.

We were brought in to clean up. Here's what the fix looked like:

1. Access audit first. We ran a permissions report across SharePoint and found 40+ folders with "everyone" or overly broad access. This took about three days.
2. Sensitivity labels. We applied Microsoft Purview sensitivity labels to financial, HR, and client-commercial folders, marking them so Copilot would exclude or restrict them.
3. Restricted the deployment. Copilot was reconfigured so it could only draw from folders relevant to each user's actual role, using restricted SharePoint search.
4. Turned on audit logging. Every Copilot interaction touching a labelled document now gets logged in Purview.
5. Trained the team. A one-hour session on what to feed the agent and what to keep out.

Total remediation cost: about ₹1.1 lakh one-time, plus ongoing licence fees they were already paying. The margin-sheet incident could easily have cost them the client. If you're deploying agents across a messy file estate, our IT consulting team does exactly this kind of access audit before things go sideways.

Common Mistake: Teams enable Copilot or Gemini org-wide on day one because the licence is already bought and "why waste it." The licence is not the deployment. Turning on the feature without first cleaning up your file permissions is like handing a new employee the master keys to every room and hoping they only open the right doors.

How do you scope what an AI agent is allowed to access?

The single most important governance principle is least privilege. An agent should reach only the data and tools it genuinely needs for its assigned job. Everything else stays out of view.

Work through this in layers.

1. Map your data by sensitivity

Before you touch any admin console, list your data into three buckets:

• Public / low-risk: marketing content, published brochures, general SOPs. Agents can use these freely.
• Internal: project files, internal comms, draft proposals. Agents can access on a role basis.
• Restricted: salaries, bank details, customer PII, GST and tax filings, contracts, board material. Agents get no access, or heavily gated access with approval.

2. Fix the underlying permissions

Remember the golden rule: the agent inherits the user's access. If your accountant can see every folder in the company, so can their Copilot. Clean up user permissions first. Remove stale access, close "everyone can view" shares, and enforce role-based folders.

3. Apply labels and policies at the tool level

In Microsoft 365, use Purview sensitivity labels and Data Loss Prevention rules so restricted files are excluded from Copilot's reach. In Google Workspace, use Drive labels, DLP rules, and Gemini's Workspace admin controls to restrict which content sources are indexed. Getting your licensing and admin setup right matters here, and our Microsoft 365 licensing and Google Workspace licensing teams handle both the procurement and the guardrail configuration.

4. Decide what actions the agent can take autonomously

Reading is one risk level. Acting is another entirely. Draft an email? Usually fine, human sends it. Send an email automatically? Needs a gate. Delete records, approve expenses, modify a customer database? These should almost never be fully autonomous in an SMB.

How to build approval gates and human-in-the-loop controls

An approval gate means the agent proposes and a human disposes. The agent does the drudgery, drafts the output, and stops before anything irreversible happens. A person clicks approve.

Here's a practical framework I use to classify agent actions:

Action type	Example	Risk	Governance rule
Read & summarise	Summarise a project folder	Low to medium	Allowed on role-scoped data; restricted folders excluded
Draft content	Write a proposal or email	Low	Allowed; human reviews before use
Send / publish	Email a client, post to a channel	Medium to high	Human approval required before send
Modify records	Update CRM, edit invoice status	High	Human approval + logged; limited to specific fields
Delete / approve / pay	Delete files, approve expense, release payment	Critical	Never autonomous; dual approval for financial actions

For most SMBs, the sweet spot in year one is: let agents read and draft freely, but require a human for anything that sends, changes, or spends. This captures most of the productivity gain while keeping the blast radius small.

If you're building custom agents that plug into your own systems, such as tying Copilot into your billing software or a WhatsApp workflow, those approval gates need to be coded into the integration itself. That's genuine engineering work, and our custom software development team builds these workflow-with-approval patterns for clients regularly.

What does an AI agent audit trail actually need to capture?

If a client, a regulator, or your own board asks "what did the AI do and why," you need an answer backed by logs. A usable audit trail records:

• Who triggered the agent (the human user or system account)
• What the agent was instructed to do (the prompt or task)
• What data it accessed to complete the task
• What action it took or proposed
• Who approved any gated action, and when
• Timestamp for everything

In Microsoft 365, the Purview audit log captures Copilot interactions including which files were referenced, and you can retain these for compliance periods. Google Workspace surfaces Gemini activity through the security and audit investigation tools in the Admin console. Both require you to actually turn logging on and set a retention window. Neither does this fully by default on lower-tier plans.

For DPDP readiness, keep audit logs for at least the duration you're likely to need them for a dispute or breach investigation. I generally advise clients to retain agent activity logs for a minimum of 12 months. If you're not sure your current plan supports adequate logging, that's worth a conversation with our cloud and managed services team before you scale usage.

Microsoft Copilot vs Google Gemini: which is easier to govern?

Most Indian SMBs are already on one of these two platforms, so the honest answer is usually "govern the one you already pay for." But the controls differ, and that affects your setup effort. Here's a governance-focused comparison.

Governance factor	Microsoft 365 Copilot	Google Workspace Gemini
Approx. add-on cost (per user/month)	~₹2,000 (Copilot add-on)	Bundled into Business Standard/Plus tiers
Data access control	Purview sensitivity labels, restricted SharePoint search	Drive labels, DLP rules, admin data controls
Audit logging	Purview audit log (detailed, requires config)	Admin console security investigation tool
Setup complexity	Higher; more powerful but more knobs	Moderate; simpler console
Best fit	Firms deep in Office, SharePoint, Teams	Firms on Gmail, Drive, lighter IT teams

My general take: if you already live in SharePoint and Teams, Copilot's governance tools are more granular and worth the effort. If you're a leaner team on Gmail and Drive, Gemini is simpler to lock down. I've written a fuller breakdown of the productivity side in AI Copilot in Google Workspace vs Microsoft 365 if you're still choosing a platform.

A step-by-step rollout plan for AI agent governance for SMBs

Here's the sequence I'd hand any Indian SMB, whether you do it yourself or brief a vendor.

1. Weeks 1-2: Access audit. Pull a permissions report across your file estate. Find and close over-broad shares. Remove stale user access. This is unglamorous and the most important step.
2. Week 2: Data classification. Sort data into public, internal, and restricted. Document it. Get sign-off from whoever owns HR and finance data.
3. Week 3: Apply labels and DLP. Configure sensitivity labels and data loss prevention so restricted content is fenced off from agents.
4. Week 3: Turn on audit logging. Enable and set retention (12 months minimum). Confirm the logs actually capture agent activity.
5. Week 4: Define action gates. Write a one-page policy: what agents may do autonomously, what needs approval, who approves. Assign a human owner per agent.
6. Week 4: Pilot with one team. Roll out to 5-8 people in one department. Watch what happens for two weeks.
7. Week 6: Review and expand. Check the audit logs. Fix any surprises. Then widen the rollout department by department, not all at once.
8. Ongoing: Quarterly review. Re-run the access audit, review logs for odd behaviour, update your policy.

The whole thing is roughly a six-week project for a mid-sized SMB. If you'd rather not learn Purview from scratch, this is exactly the kind of scoped engagement our services team takes on. It's a fixed piece of work with a clear outcome.

What about AI agents that talk to customers directly?

Everything above concerns internal agents. Customer-facing agents such as WhatsApp bots and voicebots carry extra weight because they represent your brand and often handle customer PII directly.

Two extra rules apply. First, be clear that customers are talking to an AI when they are. Second, never let a customer-facing agent commit your business to anything, quote a final price, promise a delivery date, or confirm an order, without a validated backend check or a human fallback. A hallucinated commitment to a customer is a contract dispute waiting to happen.

If you're deploying on WhatsApp, note that Meta has been tightening its policies. I covered the implications in WhatsApp Bans AI Chatbot Rivals, and it's worth reading before you build. For governed, compliant customer channels we set up the WhatsApp Business API and AI voicebots with proper escalation paths built in. If a voicebot is on your roadmap, the cost-and-benefit case is laid out in AI Voicebots for Indian SMBs.

Frequently asked questions

Are AI agents like Copilot safe for handling GST and financial data?

They can be, but only if you explicitly exclude tax and financial folders from the agent's access using sensitivity labels and DLP rules. By default the agent sees whatever the user sees, so financial data is at risk until you fence it off. Treat GST filings, bank details, and salary data as restricted with no autonomous agent access.

What does AI agent governance cost for a small Indian business?

Expect ₹500 to ₹2,500 per user per month in licensing depending on your platform and tier, plus a one-time governance setup of roughly ₹40,000 for a small team and up to ₹1.5 lakh for a larger or messier environment. The setup cost is a one-off; the guardrails then run for free.

Does the DPDP Act apply to AI agents processing customer data?

Yes. If an AI agent processes personal data of your customers or employees, your business remains the data fiduciary and is responsible for how that data is handled, secured, and disclosed. The AI vendor being large does not transfer that liability to them. Keep audit logs and restrict access accordingly.

Can I stop an AI agent from accessing certain folders?

Yes. In Microsoft 365 you use Purview sensitivity labels and restricted SharePoint search; in Google Workspace you use Drive labels and admin data controls. Both let you exclude specific content from the agent's reach. This should be configured before you enable the agent org-wide.

Should AI agents be allowed to send emails automatically?

For most SMBs, no. Let the agent draft the email and have a human review and send it. Autonomous sending removes the safety check that catches wrong recipients, wrong tone, or leaked information. Reserve fully autonomous sending for tightly scoped, low-risk use cases only.

Who should own AI agent governance in a small company?

Assign one accountable person, usually whoever runs IT or operations, even if the actual configuration is done by a vendor. Every deployed agent should also have a named human owner responsible for its behaviour. "The AI did it" is never an acceptable answer in an audit or a customer dispute.

How do I start if we've already turned on Copilot with no controls?

Run an access audit immediately, then apply sensitivity labels to your most sensitive folders and turn on audit logging. If you find broad or stale permissions, you likely have exposure right now. Bring in help if you're unsure what the logs are telling you.

The bottom line

AI agents are genuinely useful. I've seen them cut proposal-writing time in half and take real load off support teams. But they're also the fastest way to turn a small permissions problem into a large data-exposure problem, precisely because they act at speed and at scale. The good news is that solid AI agent governance for SMBs is not exotic. It's access hygiene, sensible approval gates, and audit trails that actually record what happened. Six weeks of disciplined setup buys you years of safe usage.

Start with the access audit, because everything else depends on it. Classify your data, fence off the restricted material, keep humans in the loop for anything that sends or spends, and log it all. If you'd like a partner to run the audit, configure the guardrails on Microsoft 365 or Google Workspace, and set up your agents properly the first time, get in touch with eDarpan. You can also read more about how we work on our about page, or plan your broader rollout with our first-90-days AI adoption plan.

Image credit: AI, Automation, and Human Judgment panel at Wikimania 2026 - 11 by Luisalvaz via wikimedia (BY-SA 4.0), sourced through Openverse.