Nathen Harvey

MCP for Busy Leaders — Part 5/10 (Assistants need roles) 𝗠𝗖𝗣 𝗳𝗼𝗿 𝗕𝘂𝘀𝘆 𝗟𝗲��𝗱𝗲𝗿𝘀 — 𝗣𝗮𝗿𝘁 𝟱/𝟭𝟬 𝗔𝗻 𝗔𝗜 𝗮𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗱𝗼𝗲𝘀𝗻’𝘁 𝗻𝗲𝗲𝗱 “𝗺𝗼𝗿𝗲 𝗽𝗼𝘄𝗲𝗿.” 𝗜𝘁 𝗻𝗲𝗲𝗱𝘀 𝗮 𝗿𝗼𝗹𝗲. Most teams try to govern AI with a single rule: “Be careful.” That’s not governance. That’s hope wearing a tie. When assistants can call tools, the cleanest safety pattern is the oldest one in IT: role-based access. So I recommend 3 roles that scale well in enterprises: 1) Observer (Read-only) The assistant can: • search docs (RAG) • query read-only data • summarize, explain, draft It cannot: • change records • trigger workflows • initiate actions Use it for: Q&A, reporting, troubleshooting, policy lookups. 2) Operator (Safe writes) The assistant can: • create a ticket • draft an email • propose a change • run low-risk actions with guardrails But: • writes are bounded (limits) • sensitive actions may require approval • everything is logged Use it for: service desk, internal ops, standard workflow steps. 3) Executor (High-impact actions, gated) The assistant can perform high-impact actions, but only with: • explicit approvals (human-in-the-loop) • strict limits • break-glass controls • complete audit trail Use it for: privileged operations, financial actions, production changes. The key leadership point: 𝗛𝘂𝗺𝗮𝗻𝘀 𝗮𝗹𝘄𝗮𝘆𝘀 𝗼𝘄𝗻 𝘁𝗵𝗲 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻. 𝗥𝗼𝗹𝗲𝘀 𝗷𝘂𝘀𝘁 𝗱𝗲𝗳𝗶𝗻𝗲 𝗵𝗼𝘄 𝗳𝗮𝗿 𝘁𝗵𝗲 𝗮𝘀𝘀𝗶𝘀𝘁𝗮𝗻𝘁 𝗰𝗮𝗻 𝗴𝗼. Why roles matter (business outcomes) • Fewer incidents: less “surprise automation” • Faster adoption: teams know what’s allowed • Cleaner audits: roles map to policy and evidence • Better partnerships with risk/compliance: because it’s concrete Practical move (this week) Pick one workflow and assign roles intentionally: • Start Observer in production • Graduate to Operator with limits • Use Executor only when approvals + audit are non-negotiable If your assistant has “all tools, all the time,” that’s not empowerment. That’s unbounded blast radius. 𝗤𝘂𝗲𝘀𝘁𝗶𝗼𝗻: Which role would create value fastest in your org—Observer, Operator, or Executor? (Part 6/10 tomorrow: The two doors — Data vs Action.) Follow if you want the exec-simple version of MCP (no jargon, all outcomes). 𝗣𝗿𝗼𝗺𝗽𝘁𝘀 𝗮𝗿𝗲 𝗮𝗱𝘃𝗶𝗰𝗲. 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝘀 𝗮𝗿𝗲 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻. #MCP #EnterpriseAI #AIArchitecture #AIGovernance #PlatformEngineering #TechLeadership

13

1 Comment

🚀 Announcing the latest app-building capabilities in Copilot Cowork and Copilot Studio. With these new experiences, makers can describe the business outcome they want and use natural language to create, refine, connect, and publish a full-stack business application. But building the application is only part of the story. As we continue expanding who can create software, we must ensure these solutions can also be governed, secured, and managed at enterprise scale. 🛡️ Secure and governed by default Applications are built within Copilot Cowork or Copilot Studio and can connect to enterprise data through governed connectors. They also support Git-backed source control—helping teams manage the application lifecycle. By default, Microsoft Entra identity and existing organizational data and connector policies are respected. Once applications are published, administrators gain centralized inventory and operational controls through the Microsoft 365 admin center. 🔐 Content Security Policy Content Security Policy provides another important layer of protection. At a high level, CSP allows administrators to control which content an application can load and where it can be embedded—helping protect against risks such as clickjacking and unauthorized content execution. Administrators can initially use report-only mode to identify potential policy violations before moving to enforcement. This enables organizations to introduce stronger security controls thoughtfully across development, test, and production environments. This is what the future of business application development looks like—lowering the barrier to creation without lowering our standards for governance, security, compliance, or lifecycle management. I encourage everyone to try the new app-building experience and learn more in the announcement: https://lnkd.in/gbFvaQZu If you're keen to learn more: - You can read about the Cowork updates here : https://lnkd.in/gwuhnuTF - You can see Ryan's announcement here : https://lnkd.in/p/gFUcziu6 - You can see Clay's post here: https://lnkd.in/p/gdhDECXM - You can read about updates coming to Copilot Studio here : https://lnkd.in/gKE2MdXp If you’re joining us at the Power Platform Community Conference, register for our full-day Build, Deploy and Manage Vibe Coded Apps at Scale workshop on October 26. You’ll receive hands-on experience creating an application, refining the experience, connecting it to data, deploying it, and learning the management patterns required for real organizational use. https://lnkd.in/grP-zeFm Hope to see you there! #MicrosoftCopilot #CopilotCowork #CopilotStudio #PowerPlatform #Governance #Security #Compliance #ManagedApps #VibeCoding

63

6 Comments

Join Andi and Brian on the PurePerformance podcat as they talk with Alexandra Franz, Lead Product Engineer in SRE at Dynatrace , about her unique career path and the critical role of observability in managing large-scale systems. In this episode, you’ll learn: - How her team prepares for major traffic events like Black Friday, Cyber Monday, and the Super Bowl. - The importance of regional traffic patterns and hardware considerations for capacity planning. - Why global cloud outages, while stressful, can highlight the value of a skilled SRE. If you’re curious about the world of SREs and large-scale observability, don’t miss this episode: https://lnkd.in/gqa2rdmC #sre #techpodcast #observability

2

Whoah this is very cool. Travis is one of the most forward-thinking product minds in software right now. Exciting! Travis’ view on AI and agents is deeply grounded in systems. When everyone else was stumbling around aimlessly, Travis showed me how agents can be built and understood in a principled way, where you can not only predict how a change will impact stability, but also explain why a bug led to instability. tl;dr Travis thinks about agents more in regards to long term stability rather than momentary performance.

4

1 Comment

Sonatype, are in. 🤝 Public package registries are essential, load-bearing infrastructure for the global software supply chain — yet their funding models are under increasing strain. Sonatype is proud to join other enterprise leaders in committing to support sustainable package registries. As demand grows, particularly with AI accelerating both software consumption and security pressures, the organisations that depend on these services at scale have a role to play. 🌍 This is about helping registries invest in the security, resilience, reliability and observability that benefit the whole ecosystem — while keeping access free for individual developers and small organisations. Open source stays open. 💚 Read the OpenSSF commitment: https://lnkd.in/esiqQMgU #OpenSource #PackageRegistries #SoftwareSupplyChain #Sustainability #MavenCentral

23