01 / The problem
Sensitive data needs
context.
A product roadmap, a financial forecast, or an internal strategy document can expose an organization to risk when it reaches the wrong audience. Understanding that risk requires context about the content and how it is being shared.
Data loss prevention policies already helped teams detect, monitor, and block sensitive data sharing. But predefined rules did not always capture contextual risks that deserved a closer look.
The Posture Agent was designed to help security practitioners investigate those gaps. They could describe what they were concerned about in natural language, review relevant content, and identify where permissions or protections needed attention.
02 / The key decision
A question worth asking
again.
We initially explored a simple query tool: enter a prompt, find relevant content, and review the results. It treated each search as a distinct, largely reactive task.
Early feedback from internal practitioners changed that direction. They wanted to revisit the same question regularly, looking for changes as content and sharing activity evolved. The query needed to become an ongoing investigation.
One query.
One set of results.
Respond to a concern and search for relevant content.
One investigation.
Multiple runs.
Return to the same objective, review its history, and run it again.
I grouped related runs under a persistent query in the sidebar. Users could return to an investigation, inspect its run history, modify the prompt, or schedule it to run again. That structure made the agent useful as a proactive practice.
03 / A deliberate pause
Confirm the scope
before the agent runs.
A prompt is easy to submit. The work it triggers can be expensive, depending on the scope of the search and the size of the data estate.
I added a confirmation step between entering the query and starting the analysis. It brings the prompt and selected data sources together so users can review what they are about to ask the agent to do.
The extra step was intentional. It gave users a chance to catch an overly broad scope before committing to a potentially costly run.
04 / The experience
A simple path through
a complex analysis.
The core experience centers on three views: the prompt, the results, and the summary. Each supports a different part of the investigation.
Describe the concern.
Natural-language input gives practitioners a way to express what they want to investigate. The same entry experience supports revisiting a prompt, with the source context visible alongside it.
Review the evidence.
The results list keeps matching content alongside the investigation context. Content types, filters, and protection labels help users narrow their review and identify items that deserve attention.
Understand the findings.
The report brings the query, data sources, analysis period, and findings into one summary. It gives practitioners context for reviewing the agent's conclusions and deciding what to do next.
05 / What shipped
An investigation users
can return to.
The Posture Agent became an available capability in Microsoft Purview. The design moved beyond a one-time search to support an ongoing investigation, with related runs, history, and scheduling organized around a shared objective.
The most consequential change came from understanding how practitioners intended to use the tool. A persistent investigation gave their questions continuity, while scope confirmation and reviewable findings kept the work grounded in decisions they could understand.
Explore the product