Groundwork: the foundation your AI stands on. All seven layers, published.

The problem it solves. The fastest way to build an assistant is to run it as the owner's account. It works on day one, and it means the AI can read every email, open every file and act as the most powerful person in the business. When something goes wrong, the log says the owner did it.

What gets built. Each assistant gets its own identity in Microsoft Entra, with exactly the access it needs for its one task and nothing more. No shared accounts. No standing admin rights. If an assistant is retired, its access is removed in one place.

What you get. A list of every AI identity in your business, what each one can touch, and who owns it. If your insurer asks "what can your AI access", you hand them the list.

Acceptance criteria. No assistant runs under a personal account. Every assistant identity has a named human owner. Access is documented per identity.

The problem it solves. AI is only useful if it can read your business information, and that's precisely the risk. Most SMB tenants have years of accumulated over-sharing: sites open to "Everyone", ex-staff still in groups, client files with no classification. An assistant pointed at that inherits all of it.

What gets built. Your sensitive data is identified and labelled: client records, financials, staff information, anything under a contractual or legal obligation. Data loss prevention rules stop that information leaving for consumer AI tools or unapproved destinations. A written boundary states, in plain English, what assistants may read, what they may never read, and what happens when they encounter something unclear.

What you get. One page your team can understand: "our assistants can see this, can never see that". Plus the technical controls that enforce it, so the boundary doesn't depend on anyone remembering.

Acceptance criteria. Sensitive data categories are labelled. DLP blocks those categories from leaving to unapproved AI services. The boundary document is signed off by the business owner.

This layer is where Groundwork meets security. If your tenant has never been through a health check, this is usually where we find out.

The problem it solves. Without a defined place to build, assistants end up scattered: one in a personal Power Automate, one in a trial tenant someone spun up, one in a vendor's platform on a credit card. Nobody knows what exists, and nothing can be handed over.

What gets built. Dedicated environments in your Microsoft Power Platform for building and for production, so a half-finished assistant can't touch live data. A connector policy that states which systems assistants may connect to. Named builders: the people in your business permitted to create and change assistants.

What you get. Every assistant lives in a place you own, under an account you control, built by someone you've named. Switch vendors, switch consultants, switch staff: it stays.

Acceptance criteria. Separate build and production environments exist. Connector policy is applied and documented. Builder roles are assigned to named people.

The problem it solves. The Autonomy Spectrum only works if the levels are enforced by the system, not by good intentions. "A person approves before it sends" has to be a gate the assistant cannot bypass, not a habit.

What gets built. Approval gates matched to each task's level. Hard stops: actions no assistant may take regardless of level, such as sending payment details, changing access, or contacting anyone on a do-not-contact list. Escalation rules: what "unusual" means for each task, and who gets it when it happens.

What you get. Confidence that an assistant at Level 2 genuinely cannot send without approval, and one at Level 3 genuinely cannot touch the things you've said are off-limits. When you move a task up a level, the gate changes and nothing else does.

Acceptance criteria. Each assistant's level is enforced technically. Hard-stop list is documented and tested. Escalation routes to a named person and has been exercised at least once.

The problem it solves. The question you'll eventually be asked, by a client, an insurer or yourself at 11pm, is "what did it send to whom on Tuesday". If the answer takes longer than a minute, you don't have governance; you have hope.

What gets built. Every assistant action is logged with the identity that performed it, the input it acted on, the output it produced and the human who approved or reviewed it. Logs are retained for a period you set and can't be edited by the assistant. A weekly summary lands with the task owner.

What you get. Answers in thirty seconds. Evidence for the graduation decisions in the Autonomy Spectrum. A record that satisfies the "how do you control your AI" question in a client security questionnaire.

Acceptance criteria. Every assistant action is attributable to an identity and a human owner. Retention period is set and documented. The weekly summary is delivered and read.

The problem it solves. The first assistant is built carefully. The fifth is built on a Friday afternoon by someone who's confident now. Without a lightweight process, the foundation erodes one shortcut at a time.

What gets built. An agent register: one list of every assistant, its task, its level, its owner, its identity, when it was last reviewed. An approval path fit for a small business: a one-page request, a named approver, a checklist against the six layers above. A graduation record for level changes.

What you get. You always know what AI is running in your business, who's responsible for each piece, and that nothing got added without meeting the standard. When a client asks for your AI register, you have one.

Acceptance criteria. Register exists and is complete. Approval path is documented and has been used for at least one assistant. Level changes are recorded.

The problem it solves. Every consultant says "no lock-in". The test is whether your own person can add an assistant six months after I've gone. If they can't, the lock-in is real, whatever the contract says.

What gets built. Documentation of the six layers as they exist in your tenant, in language your nominated person can follow. Templates for the common assistant types. A half-day enablement session where that person builds an assistant on Groundwork with me watching, and then one without me watching.

What you get. Independence you can test. If you never call me again, the foundation keeps working and your team keeps building. If you do call me, it's because you've chosen to.

Acceptance criteria. Your nominated person has built one assistant end-to-end on Groundwork. Documentation is stored in your tenant. Enablement is delivered and signed off.