Microsoft
Copilot Studio, Foundry
Native controls
- Entra
- Purview
- Defender
Own policy modelCompiled natively
Now booking six-week pilots
Ubility Govern writes policy once, enforces it through each platform’s own controls, and shows every agent in one place — with Arabic-native data protection built in.
سياسة واحدة لكل وكيل ذكاء اصطناعي على كل منصة
- Microsoft
- Salesforce
- Google Cloud
- AWS
Copilot StudioMicrosoft FoundryAgentforceGemini EnterpriseVertex AIAmazon BedrockAgentCoreDatabricksServiceNowLangGraphCrewAI
Saudi National IDالإقامةEmirates IDQatar QIDKuwait Civil IDالرقم القوميGCC IBANArabizi١٢٣ = 123Hijri datesALLaMJaisFalcon Arabic
The problem
Every platform governs agents its own way
Four policy models. Rules written for one don’t carry over to the others.
4policy modelsRules don’t carry over
customer-pii.policy.yaml
One policy
compiled into every platform’s own controls
Salesforce
Agentforce
Native controls
- Permission sets
- Trust Layer
- Shield
Own policy modelCompiled natively
Google Cloud
Gemini Enterprise, Vertex AI
Native controls
- IAM
- Agent Gateway
- VPC Service Controls
Own policy modelCompiled natively
AWS
Bedrock, AgentCore
Native controls
- IAM
- AgentCore policies
- Guardrails
Own policy modelCompiled natively
Also in the mix: Databricks, ServiceNow, and custom agents built on LangGraph or CrewAI.
The gap
Today’s tools stop short
Platform control planes
Deep on their own platform, thin elsewhere
Microsoft’s own guidance: agents synced from other platforms “start with only a thin layer of governance”
AI gateways
Enforce only on traffic routed through them
SaaS agents like Agentforce and Copilot act inside their own platform, outside a gateway’s path
Generic DLP
Built for English, with Arabic as an afterthought
Purview’s Saudi National ID type: a 10-digit pattern, no checksum, and one Arabic keyword out of four
The product
One control plane for every agent
Ubility Govern writes policy once, enforces it through each platform’s own controls, and shows every agent in one place, in Arabic and English.
01
Unified policy
Policies as code, compiled into Microsoft, Salesforce, Google and AWS controls
Explore policy 02Unified observability
OpenTelemetry traces and platform audit logs for every agent, in one view
See every agent 03Arabic AI governance
Arabic-native PII detection and DLP across prompts, files and tool calls
Try it liveArchitecture
How Ubility Govern works
1
Policy studio
Write policies once, as code, with review and approvals
2
Policy engine
Compiles each policy into native controls and checks for drift
2
Arabic DLP
Finds Arabic and Arabizi PII in prompts, files and tool calls
3
Microsoft 365
Entra · Purview
3
Salesforce
Permissions · Trust Layer
3
Google Cloud
IAM · Agent Gateway
3
AWS
IAM · AgentCore
4
Unified view
OpenTelemetry traces and audit logs for every agent
Hover any block, or step through the flow.
Pillar 1 · Unified policy
Write a policy once, enforce it everywhere
Compiles to
Purview DLP ruleMicrosoft
Salesforce permission setSalesforce
Agent Gateway policyGoogle Cloud
AgentCore policyAWS
Pillar 1 · Coverage
We show what each platform can enforce
| Policy | Microsoft | Salesforce | AWS |
|---|
Illustrative target coverage at launch. The final matrix depends on each platform’s admin APIs.
Pillar 2 · Unified observability
Every agent, one view
- 01
Collect
OpenTelemetry for code-built agents; audit-log pullers for SaaS agents that don’t emit it
- 02
Normalize
Mapped to the OpenTelemetry GenAI conventions, with a versioned mapping while they’re still in Development
- 03
See
Traces across agent hand-offs, cost, policy decisions and Arabic PII hits, in one place
One trace, two platforms
A service agent on Agentforce hands a billing task to an agent on Bedrock
Top three spans from Agentforce audit logs, bottom three from Bedrock via OpenTelemetry. Orange marks the Arabic PII check.
Pillar 3 · Arabic AI governance
Arabic data needs Arabic-native protection
حماية البيانات العربية تبدأ بفهم اللغة
Built for Gulf and Arab-world identifiers, dialects, Arabizi and both digit systems, from the first release.
Try it on your own textPillar 3 · The challenge
Why generic DLP misses Arabic data
No capital letters
Names look like ordinary words, so case-based name spotting fails
سعيد=
Saeed“happy”
Attached prefixes
“And” and “with” join the name, hiding it inside a longer word
وبمحمد
و+ب+محمد
Many spellings
One name takes many forms across scripts and transliterations
Muhammad1 person
Dialects
Gulf, Levantine and Egyptian Arabic differ from the standard. “How are you?” three ways:
شلونككيفكإزيك
Arabizi
Arabic typed in Latin letters, with digits standing in for sounds
ra2m el iqama·7abibi
Two digit systems
Eastern Arabic and Western digits write the same ID number
١٠٢٣٤٥٦٧٨٩=1023456789
Pillar 3 · In practice
Masked before the model sees it
Type or paste anything in Arabic, English or Arabizi. Detection runs entirely in your browser; nothing you type is sent anywhere.
Before · what the employee typed
Try a name with bin, an Iqama number, a +971 mobile, or ١٢٣ digits.
After · 0 identifiers masked0 bytes left your browserlocal only
A simplified preview of the detection logic, running locally. In production, originals are restored only for the authorized tool call.
Pillar 3 · What we detect
Built for Gulf and Arab-world identifiers
IdentifierFormat
Why now
Gulf privacy law is now enforced
SAR 5M
Maximum fine under Saudi Arabia’s PDPL, doubled for repeat violations
48
Enforcement decisions announced by SDAIA by mid-January 2026
2024
Year Saudi Arabia’s PDPL became fully enforceable, on 14 September
Oman’s compliance deadline passed on 5 February 2026, and the UAE has its federal PDPL. Agents that read Arabic customer data are part of that scope.
Sources: Clyde & Co, “Enforcement of the Saudi PDP Law is live” (March 2026); Trowers & Hamlins, Oman PDPL and AI update (June 2026)
Market
Where Ubility Govern fits
ApproachExamplesStrong atWhere it stops
Platform control planesMicrosoft Agent 365, ServiceNow AI Control TowerDeep control of their own platform’s agentsOther platforms’ agents get mostly inventory
Integration gatewaysMuleSoft Agent Fabric, Lyzr OpencontrollerPolicy on traffic routed through themCan’t see SaaS agents’ actions inside their own platform
Identity governancePing Agent Governance, CloudEagleOwnership, access reviews, lifecycleGoverns access, not the data agents handle
Ubility GovernNative enforcement plus Arabic-native DLPOne policy enforced on every platform, in Arabic and EnglishBounded by each platform’s admin APIs, and we show where
Forrester has opened a formal evaluation of the agent control plane market. The category is forming now.
Deployment and trust
Built for sovereign deployment
Deploy in-country
Run in your own cloud region or on-premises, in Saudi Arabia, the UAE or wherever your data must stay
Least privilege by default
Connectors start read-only; enforcement rights are granted per platform and per policy
Your keys, your vault
Platform admin credentials stay in your secrets vault, never in ours
Bilingual by design
Arabic and English console, policies and audit reports, with evidence packs for your regulator
Getting started
Start with a six-week pilot
Weeks 1–2
Connect and discover
- Connect two agent platforms
- Inventory every agent and its owner
- Baseline scan for Arabic PII exposure
Weeks 3–4
Write and enforce
- Author your first ten policies
- Run in monitor mode, then enforce
- Turn on Arabic masking for one agent
Weeks 5–6
Prove it
- Coverage matrix for your platforms
- Drift and violation report
- Evidence pack for your DPO
Built for Gulf banks, telcos, government and healthcare teams running agents on two or more platforms.
- Banks
- Telcos
- Government
- Healthcare