What changes when a regulated firm turns on Microsoft 365 Copilot, mapped end-to-end. Architecture, regulatory obligations, and an interactive walkthrough — built for a Global Systemically Important Financial Institution audience.
Personal capacity. Not employer-reviewed or endorsed. Technical claims are generic reference patterns, not internal practice from any specific firm.
Moment · v2.2 Live
Microsoft's contract solves a chunk of the M365 Copilot risk surface, but the regulator-facing obligations — model risk, recordkeeping, conduct supervision, operational resilience, AI Act risk classification — stay with the firm regardless of contract.
Research · PDF, ~30 pages
Reference architecture and regulatory-obligations map for M365 E5 + Copilot. Trust boundaries, sub-processor flow-down, regulator-facing residual obligations — the canonical source.
Tool · Interactive Live
Animated walkthrough of the prompt lifecycle, auth-token chain, six trust boundaries, and the CoWork firm-extension layer. Click any node for protocol-level detail.
Tool · v0.5 preview In progress
Configurator for M365 Copilot tenants. Toggle the eight load-bearing knobs across two slots — current and proposed — and see the architecture redraw plus the delta in regulatory exposure.
Mogambo is learning. The piece is published as a draft for the field — these are the specific things most worth your pushback: