Lately I’ve been spending a lot of my time on AI governance. One question keeps coming up in almost every conversation:

-"How do we let teams build agents fast,
without losing control of what those agents do?"

Most organizations I meet are stuck somewhere in between. Either governance is so strict that nothing ever reaches production, or it’s so loose that nobody really dare or knows how many agents are running, what they cost or what they do.

So when Microsoft published Foundry Citadel Platform on GitHub about a month ago, it immediately caught my attention.

What is Foundry Citadel?

Foundry Citadel is an opinionated reference architecture: a blueprint for how to combine services you probably already have in Azure into one coherent governance setup. It is not a new product you buy or a single service you switch on.

Think of it as a castle.
It has four layers of defence, and each layer has its own job.

Layer 1 – The gate (Governance Hub).
All traffic between agents, models, tools and other agents goes through one central AI gateway. This is where rate limits, content filtering, identity checks and cost tracking happen. It uses a hub-and-spoke model: the hub governs centrally, and each team gets its own spoke where it can build freely.

Layer 2 – The watchtower (AI Control Plane).
This is where you keep an eye on everything. Here we collect traces, runs evaluations and red-teaming and give us an overview of our entire fleet of agents.

Layer 3 – The ID badges (Agent Identity).
Nobody gets inside the castle without a badge, and that goes for agents too. Every agent gets its own identity in Entra ID through Agent 365, so you always know who’s who, even with hundreds of them running. And every agent has an owner, so if an agent starts misbehaving, there’s always someone to turn to.

Layer 4 – The guards on the walls (Security Fabric).
Defender, Purview and Entra work across all the other layers to detect jailbreaks, protect sensitive data and control access.

Personal thoughts:

In a previous post I argued that defence might be the thing that lets agentic development scale, rather than the thing that slows it down. Citadel is one of the first concrete attempts I’ve seen to build exactly that. The separation of concerns is what makes it work. Each layer can evolve on its own. You can swap out the gateway, add new evaluations or onboard new agent types without tearing the whole thing down.

You don’t need to build the entire castle on day one. Starting with the gateway alone gives you visibility and cost control, and that’s a pretty good first win. From there you can add the watchtower, the badges and the guards as your agent landscape grows.

If you’re working with AI agents in an enterprise setting, I really recommend checking out the repo. Even if you don’t follow it to the letter, it’s a great map of what a well-governed agent platform could look like.

Cheers friends! 🫶🏻