Investigation governance for Microsoft 365

An internal investigation in Microsoft 365 goes through people’s email, chats and files. AI can plan the search, normalize records, summarize and point out inconsistencies, but it raises the risk: an agent with too much access can read what it should not, alter a piece of evidence or conclude guilt on its own. This framework defines how to do the work with prior authorization, minimum access and evidence that withstands an independent review.

Sigil Labs put together a governance protocol and a starter repository for Claude Code. The repository holds no credentials, connects to no tenant and does not implement a generic Microsoft Graph connector. The set includes:

• a protocol written in 26 sections, from authorization to closing the case;
• eleven subagents, each with one role and explicit tools;
• a policy hook that denies any unknown tool and fails closed on error;
• a minimal contract for the MCP server, which must be built in a separate project and infrastructure;
• a case template, with a charter, a search plan, a list of custodians and an approvals record;
• a matrix of least-privilege workload identities;
• a proposed specification for the cryptographic seal on the scope;
• a runbook for the first 24 hours.

Nothing starts without authorization. Before any access, the case charter must be signed by someone with verifiable authority, and a lawyer must validate the legal basis, proportionality and handling of personal data. The runbook says to stop if any essential item is missing.

The scope is sealed. The seal specification, a technical proposal, defines the scope_hash as a SHA-256 computed over the part of the charter that says who, what, when, how far and who must approve. Each approval is valid for one specific scope: reformatting the file does not invalidate it, but adding a custodian does.

In this framework the AI model is never given a human Global Administrator account. It sees only narrow, typed MCP tools. The protocol requires the MCP server to act as a policy enforcement point: it must offer no arbitrary Microsoft Graph request, no PowerShell execution, no sending of messages and no deletion. Every call to the tenant states the case, the scope revision, the reason and an idempotency key, and sensitive tools require an approval token that the server verifies cryptographically.

The agent’s access to the tenant grows in tiers. The protocol defines six approval levels, from 0 to 5, plus a forbidden category. Reading aggregate counts is automatic within the case. Applying a legal hold or collecting into a review set takes two people, unless a documented emergency applies. Exporting native content takes two people and the evidence custodian. Write and export identities are blocked by default and enabled only in approved windows.

The CLAUDE.md file guides the model but is not a security control. The rules are enforced by Claude Code permissions, the hook, the MCP server, Microsoft Entra and Microsoft Purview.

Searching the tenant’s data moves through six waves, numbered 0 to 5: capability, metadata, high-precision terms, concepts, context and controlled expansion. Widening the scope requires a newly documented fact, an approval and a new scope hash. Preservation comes before reading: Microsoft states that a hold can take up to 24 hours to take effect, and the protocol requires recording the state of each source until it is confirmed.

Every artifact is classified as source, working copy, derivative or presentation item, and the source is never replaced by a derivative. Each batch gets a manifest with a SHA-256 hash and goes to encrypted, immutable storage kept apart from the code repository.

The framework looks for incriminating and exculpatory evidence alike. The counter-hypothesis reviewer is mandatory: it looks for the innocent explanation, normal practice, an automatic event, a duplicate, a time-zone problem, an administrator’s action and the effect of eDiscovery itself. The permitted labels are descriptive, such as “potentially responsive” or “alternative explanation identified”. The report separates observed fact, inference, hypothesis, limitation, legal question and recommendation.

The AI model does not receive the whole raw corpus. It receives metadata, identifiers, counts and strictly necessary excerpts, after normalization, deduplication, scope filtering and confidentiality screening. All retrieved content is treated as untrusted data: the agent never obeys instructions found in the corpus, and never accepts an “approval” that appears in an investigated message.

The protocol lists 18 automatic stop conditions, among them an expired charter, a scope without a valid hash, a missing or expired approval, a tool outside the allowed list and a request that spans the whole tenant.

The framework is for organizations that need to investigate internally, with authorization, a suspicion of misconduct in Microsoft 365 and want to use AI without giving up control. It is a starting point for whoever will build the MCP server and the workload identities, and for whoever has to review that design.

The framework is a protocol and a starter repository, not a finished product to install. It does not authorize access to data and does not replace legal advice. The protocol allows production only after 20 acceptance criteria are demonstrated in tests, among them that the agent cannot use arbitrary Graph calls, delete or purge content, or release a hold, and that a kill switch exists. Because Purview, Graph and Claude Code change often, permission names and licensing must be checked against current documentation before deployment.