Agentic AI: What Philippine Enterprises Should Know Before Deploying AI Agents
Something shifted in enterprise AI around late 2025. The question stopped being "should we use AI?" and became "how do we stop our AI from doing something we didn't intend?"
That shift marks the transition from AI assistants to AI agents — and it changes the risk calculus entirely.
What Is an AI Agent, Exactly?
An AI assistant answers questions and helps you draft things. You stay in control of every action.
An AI agent does things. It has access to tools, systems, and APIs. It can read your inbox, create calendar invitations, file support tickets, query your CRM, trigger approval workflows, and send emails — all without you clicking a single button. You give it a goal; it figures out the steps.
Microsoft calls this Agent 365, part of the new M365 E7 Frontier Suite launching May 1, 2026. Google calls their equivalent Gemini for Workspace with Agentspace. Open-source frameworks like AutoGen and CrewAI let developers build custom agents on top of any LLM.
The capability is real, it is available now, and it is being evaluated by IT teams across the Philippines.
Why This Is Different From a Chatbot
Chatbots are stateless. They answer, then forget. They have no persistent access to your systems.
Agents are different in three ways that matter operationally:
1. They have permissions. An agent that can read emails and write calendar entries holds real credentials — OAuth tokens, API keys, or delegated access through Entra. Those credentials can be misused, leaked, or over-scoped.
2. They execute loops. An agent does not just respond once. It plans steps, executes them, evaluates results, and adjusts. A single high-level instruction can trigger dozens of downstream actions across multiple systems before you see the outcome.
3. They are hard to audit after the fact. When a human sends an email, there is a sender. When an agent sends an email on behalf of a user, the audit trail depends entirely on how well your logging was configured before the action happened.
This is not an argument against agents. It is an argument for preparing your environment before you deploy them.
The 4 Infrastructure Prerequisites
1. Identity and Permissions Hygiene
Agents operate under delegated identity — typically the identity of the user who authorized them. If that user has broad, unreviewed permissions (as most long-tenured employees do), the agent inherits that blast radius.
Before deploying any agent:
- Conduct an Entra access review for all users who will authorize agents. Remove permissions that are no longer needed.
- Enable Privileged Identity Management (PIM) for any accounts that interact with sensitive systems. Agents should work with just-in-time elevated access, not standing admin rights.
- Apply the principle of least privilege to every OAuth scope an agent requests. If it needs to read mail, it should not also have write access to SharePoint.
Microsoft Entra Suite — included in M365 E7 — provides the tooling to do this systematically. Without it, you are flying blind on what your agents can actually reach.
2. Data Classification with Microsoft Purview
An agent that can read your files can also surface your files — in summaries, in generated emails, in outputs shared with other systems. The guardrails that prevent sensitive data from leaking are sensitivity labels.
Before agents go live:
- Deploy a Purview sensitivity label taxonomy: at minimum, Public, Internal, Confidential, and Highly Confidential.
- Apply labels to SharePoint libraries, OneDrive folders, and Teams channels — not just individual files.
- Configure auto-labeling policies for content that matches known sensitive patterns (IDs, financial figures, contract language).
Agents respect label-based access controls natively in M365. Without labels, Copilot and Agent 365 will surface whatever the authorizing user can technically read — which, in most unmanaged tenants, is far more than intended.
3. Network Segmentation for AI-Initiated Traffic
An agent is a network actor. It makes HTTP calls, authenticates to APIs, moves data between systems. In environments without proper segmentation, a compromised or misbehaving agent can reach far beyond its intended scope.
Key controls:
- Use Conditional Access policies to restrict agent authentication to known-good device states and locations.
- Apply Microsoft Entra Private Access (part of Entra Suite) to prevent agents from reaching internal resources directly over the public internet.
- Log all API calls made by agent service principals in Microsoft Defender for Cloud Apps or your SIEM. If you cannot see what your agents are calling, you cannot detect anomalies.
For Philippine enterprises running hybrid environments — on-premise Active Directory alongside Azure AD — this means ensuring your network boundary is clearly defined before agents start traversing it.
4. Audit Logging and Rollback Mechanisms
The hardest part of AI agent governance is not prevention — it is recovery. When an agent does something unexpected (sends the wrong email, modifies a file it should not have touched, triggers an approval for the wrong amount), you need to be able to:
- Identify exactly what happened and when — unified audit logs in Microsoft Purview cover most M365 workloads; ensure retention is set to at least 90 days.
- Reverse the action where possible — M365 email recall, SharePoint version history, and Power Automate run history are your tools here. Know them before you need them.
- Notify affected parties — have a defined escalation path for agent-related incidents before you deploy.
This is not theoretical. In early Copilot pilots globally, the most common incident type has been agents surfacing confidential content in shared outputs — not because of a bug, but because permissions were not reviewed before deployment.
The Philippine Context
Three factors make agentic AI governance particularly important for Philippine enterprises.
BPO and knowledge-worker density. The Philippines hosts one of the world's largest concentrations of business process outsourcing operations. Agents that can read, draft, and send communications on behalf of employees interact directly with client data under existing contractual and regulatory obligations. BPO operators should review their MSAs and data processing agreements before enabling agents for any account that handles client information.
BSP data residency requirements. Bangko Sentral ng Pilipinas Circular 982 and subsequent guidance require that customer financial data remain within jurisdiction or under approved cross-border arrangements. Microsoft's Philippine data residency commitments cover Azure and M365 at-rest storage — but agentic workflows that route data through third-party connectors may fall outside that boundary. Map your agent's data flows before enabling it.
DICT Cloud-First Policy. Government agencies and government-owned corporations are under a cloud-first mandate. Agentic AI aligns with this direction, but the DICT requires that cloud deployments be assessed for data classification and security controls. The same Purview labeling and Entra governance work that prepares a private enterprise for agents also satisfies the DICT assessment framework.
Getting Started: Scoped Pilot First
The organizations that will deploy agents successfully in 2026 are not the ones that move fastest. They are the ones that do the prerequisite work before the first pilot.
Before starting, run through the AI readiness self-assessment for Philippine businesses — it covers the identity, data classification, and network prerequisites that determine whether a pilot succeeds or surfaces problems you were not expecting.
A practical starting sequence:
- Run an Entra access review — identify over-permissioned accounts and service principals. Target: two weeks.
- Deploy Purview sensitivity labels — three to five labels covering the most common data classifications in your environment. Target: two weeks.
- Define a scoped pilot — one team, one workflow, one agent. Choose something with clear, measurable outputs and no external-facing consequences (internal IT ticket triage is a good starting point).
- Log everything from day one — enable unified audit logging before the pilot begins, not after something goes wrong.
- Document what the agent is authorized to do — write it down. Share it with legal and compliance. This becomes your AI use policy.
After the pilot, review what the agent actually did versus what you expected. The gap between those two things is where your governance work needs to focus next.
Technica Solutions Inc. assists Philippine enterprises with Microsoft 365 governance, Entra identity management, and cloud infrastructure readiness. If you are evaluating agentic AI and want a structured readiness assessment, our team can help scope the work.
Talk to our Cloud & I.T. team →
