> For the complete documentation index, see [llms.txt](https://kb.bevica.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kb.bevica.com/copilot-ai/copilot-and-ai/security-privacy-responsible-ai.md).

# Security, Privacy, Responsible AI

Govern Business Central Copilot and agents with permissions, human oversight, data controls, and responsible AI practices.

Copilot and agents should be governed as part of the Business Central environment. Their use should follow the same principles applied to permissions, segregation of duties, approvals and business-process controls.

## Business Central permissions apply

Copilot and connected agents don't bypass Business Central security. Access to data and operations is controlled by your signed-in Business Central permissions and by the capabilities, APIs, and operations made available.

For custom agents, this means the connection account and exposed tools require particular care. An agent shouldn't receive wider access than its defined task requires.

## Review before action

{% hint style="warning" %}
Copilot-generated suggestions and summaries can be incomplete or incorrect. Review the underlying Business Central records before acting on information that affects:
{% endhint %}

* Financial postings, payments, or reconciliations.
* Customer or supplier commitments.
* Inventory availability and fulfilment.
* Alcohol duty, tax, or regulatory reporting.
* Master data and system setup.

## Keep people in control

Agents can perform work rather than only proposing an answer. Define where people must review, approve, or resolve exceptions, particularly before an agent creates, changes, or posts Business Central records.

## Data governance

Review:

* Whether a feature requires cross-geography data movement.
* Whether Bing Search is enabled for supported Copilot capabilities.
* User and agent permissions.
* The APIs and operations exposed through the Business Central connector or MCP server.
* The status of preview features before production use.

## Responsible AI

Microsoft states that Copilot in Business Central is built in line with its responsible AI principles. Your organisation remains responsible for deciding where a capability is appropriate, configuring access, testing the outcome, and retaining suitable human oversight.

## Microsoft guidance

{% embed url="<https://learn.microsoft.com/en-us/dynamics365/faqs-copilot-data-security-privacy?toc=/dynamics365/business-central/toc.json>" %}

{% embed url="<https://learn.microsoft.com/en-us/dynamics365/business-central/enable-ai>" %}

{% embed url="<https://learn.microsoft.com/en-us/dynamics365/business-central/responsible-ai-overview>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://kb.bevica.com/copilot-ai/copilot-and-ai/security-privacy-responsible-ai.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.