In Half 4 of this sequence, I used the Energy BI report administration and authoring expertise to audit report themes throughout Material workspaces. The workflow labored, however it was not as easy as I wished it to be. We discovered the PBIR limitation, labored out a fallback for the legacy reviews, and ended up with a number of prompts and directions that I needed to bear in mind every time I ran the method.

So, this submit continues from there. I wish to put these directions right into a reusable customized agent and run it towards my Material tenant. I’m significantly involved in whether or not it follows the legacy fallback, creates a separate audit log for every run, and asks for approval earlier than publishing. These had been all issues we had to consider within the earlier walkthrough.

If you happen to’d prefer to hearken to the content material on the go, right here is the AI generated podcase constructed from the content material of this weblog 👇:

What This Weblog Will Cowl #

On this submit, I wish to cowl:

• why this workflow advantages from a customized agent
• the best way to create and evaluation the customized agent in VS Code
• how the agent connects to Material and makes use of the Energy BI report expertise
• how constraints, hooks, and approval checkpoints defend the publish course of
• the best way to run the agent throughout the workspaces we are able to entry
• what the audit modified, what it left unchanged, and the way a lot the train price

Create a Customized Agent #

The exploration in Half 4 provides us a helpful start line. We all know the best way to obtain the reviews, the place the PBIR technique fails, and which fallback to make use of for legacy reviews. We even have the accredited theme in ./pbi-theme/biinsight.json. I need the customized agent to make use of these information with out me having to elucidate the entire course of once more in each new chat.

The customized agent is a Markdown file that VS Code reads as a specialised agent profile and makes accessible in Copilot Chat. I fairly like this as a result of I can open the file and browse precisely what I’m asking the agent to do. If one thing wants altering after a take a look at run, I can edit the directions there.

A customized agent file has two primary elements. The primary one is the YAML frontmatter, which is the small block between the opening and shutting --- traces. VS Code makes use of it to know the agent’s identify, what the agent is for, and which instruments it may well use. The second half is the Markdown physique, which accommodates the standing directions. On this case, I don’t need a basic agent that tries to do the whole lot. I desire a very particular agent that makes use of the Energy BI report expertise and follows the identical audit and approval course of each time.

The next diagram exhibits the method we’re going to observe, from creating the agent to reviewing the audit and deciding whether or not to publish. The fallback directions and accredited theme come from Half 4.

%%{init: {'themeVariables': {'lineColor': '#5a6b8c', 'sequenceNumberColor': '#3f3d3d'}}}%%
sequenceDiagram
    autonumber

    actor Person as BI Person
    participant Copilot as GitHub Copilot
    participant Agent as Workspace Theme Audit Agent
    participant Mgmt as powerbi-report-management
    participant Auth as powerbi-report-authoring
    participant Native as Native Repository
    participant Material as Material Tenant

    Person->>Copilot: Create customized agent
    Copilot->>Native: Create .agent.md file
    Copilot->>Native: Add theme directions and publish hook

    Person->>Agent: Run theme audit throughout accessible workspaces
    Agent->>Mgmt: Listing workspaces and reviews
    Mgmt->>Material: Question Material tenant
    Material-->>Mgmt: Workspace and report stock
    Mgmt-->>Agent: Studies in scope

    loop For every report
        Agent->>Mgmt: Obtain report definition
        Mgmt->>Material: Request PBIR definition

        alt PBIR obtain succeeds
            Material-->>Mgmt: PBIR report definition
            Mgmt->>Native: Save report information
        else Legacy report or unsupported definition
            Agent->>Native: Learn fallback instruction
            Agent->>Mgmt: Use fallback obtain path
            Mgmt->>Native: Save fallback report information
        finish

        Agent->>Auth: Audit report towards accredited theme
        Auth->>Native: Examine theme and visible formatting
        Auth->>Native: Apply secure local-only modifications
    finish

    Agent->>Native: Create new timestamped audit log
    Agent-->>Person: Current abstract and ask for publish approval

    alt Person approves publishing
        Person-->>Agent: Approve publish
        Agent->>Mgmt: Publish accredited report modifications
        Mgmt->>Material: Replace report definition
        Material-->>Mgmt: Publish outcome
        Mgmt-->>Agent: Publish outcome
        Agent-->>Person: Report publish end result
    else Person doesn't approve
        Person-->>Agent: Don't publish
        Agent-->>Person: Cease with native modifications and audit log solely
    finish

Let’s undergo the numbered steps within the diagram earlier than creating the agent. I’ve grouped the associated steps collectively so it’s simpler to observe. The 2 ability contributors present which directions the agent makes use of for every job. As we mentioned in Half 4, the talents themselves don’t run independently; the agent follows them and makes use of instruments to hold out the work.

• Steps 1 to three, create the agent and supporting information: I ask GitHub Copilot to create the customized agent. Copilot writes the .agent.md file into the repository, then provides the reusable theme directions and publish hook. That is the setup work. As soon as I’ve reviewed these information, I can reuse them in later audit runs.
• Steps 4 to eight, discover the reviews in scope: I begin an audit with the customized agent. Following the powerbi-report-management ability, it queries Material for the workspaces and reviews my account can entry. The returned stock provides the agent the reviews to work via. On this instance, I ask for all accessible workspaces, however we are able to slim that down within the immediate.
• Steps 9 to 12, obtain a report definition: For every report, the agent follows the administration ability to request its PBIR definition from Material. When the obtain succeeds, it saves the report information within the native repository. These are the information the audit will examine and doubtlessly change.
• Steps 13 to fifteen, use the legacy fallback when wanted: If the traditional PBIR obtain fails for a legacy or unsupported definition, the agent reads the fallback directions we ready in Half 4 and follows that obtain path. That is a substitute for steps 11 and 12. We don’t run each paths for each report. Getting the information regionally additionally doesn’t imply the agent can safely edit each report format, as we are going to see within the outcomes.
• Steps 16 to 18, audit and make native modifications: The agent follows the powerbi-report-authoring ability to match the downloaded report with the accredited theme. It inspects the theme references and visible formatting, then applies the modifications it may well validate regionally. Something it can’t confidently change ought to stay for evaluation. The loop repeats the obtain and audit work for every report in scope.
• Steps 19 and 20, document the outcome and ask for approval: After working via the reviews, the agent creates a brand new timestamped audit log and presents its abstract. That is the place I verify what modified, what was left unresolved, and which reviews want extra consideration. I’ll ask for one more native cross earlier than contemplating a publish, which is what occurs later with the Gross sales report.
• Steps 21 to 26, publish the accredited modifications: If I approve publishing, the agent follows the administration ability to replace the report definitions in Material. Material returns the outcome, and the agent reviews the result again to me. The publish hook provides a affirmation checkpoint to this a part of the method; we are going to take a look at its behaviour later within the walkthrough.
• Steps 27 and 28, end with out publishing: If I don’t approve, the agent stops with the native information and audit log accessible for evaluation. That is the choice to steps 21 to 26. The report content material in Material stays unchanged by the audit, and I can come again to the native modifications later.

Now let’s create the agent in VS Code:

1. Open GitHub Copilot Chat in VS Code
2. Make sure the chat mode is about to Agent
3. Choose your required mannequin
4. Within the chat, kind /create-agent adopted by the agent identify, its scope, and the way it ought to do the job. I exploit the next immediate:

   identify: "workspace-theme-audit".
   description: Audit and standardise Energy BI report theming in a Material workspace.
   instruments:
   - powerbi-report-management
   - powerbi-report-authoring
   
   The agent should audit Energy BI report themes in a Material workspace.
   It should use the powerbi-report-management ability to record workspaces, record reviews, and obtain report definitions into ./reviews//.
   It should learn ./docs/report-definition-fallback.md when a legacy report can't be downloaded via the traditional PBIR technique.
   It should use the powerbi-report-authoring ability to audit and replace downloaded reviews towards the Energy BI report theme saved right here: ./pbi-theme/biinsight.json.
   It should create new audit logs on every run in ./docs/logs/report-governance-.md, the place  makes use of the format YYYYMMDD-HHmmss.
   It mustn't ever overwrite or append to an current audit log.
   It should not publish something again to Material till the customers explicitly approves the ultimate abstract.
   

5. Press “Enter” or click on the “Ship” button

In my case, the mannequin created the agent and likewise advisable two additional steps:

• Making a hook to request human approval earlier than publishing.
• Creating an instruction doc so different report authoring work can reuse the identical theme steering.

Each recommendations make sense for my setup. I need these information to use to this repository, so I exploit the next immediate to elucidate the scope and the behaviour I anticipate:

Sure, implement each suggestions, however hold them scoped to this repository.

1. Create a workspace-level Copilot hook that blocks any Material or Energy BI publish, add, replace, or overwrite motion except I've explicitly accredited publishing within the present chat transcript.

The hook should block actions associated to:
- publishing a report again to Material
- updating a Material report merchandise
- importing a report definition
- calling any Material REST API that writes report content material

It should enable read-only actions reminiscent of itemizing workspaces, itemizing reviews, downloading report definitions, studying native information, auditing PBIR information, and writing native audit logs.
If this VS Code or Copilot model doesn't help the required hook format, don't guess. As a substitute, create a transparent TODO be aware within the agent file explaining the meant publish-approval guardrail.

2. Create a workspace-level instruction file at: ./.github/directions/powerbi-theme.directions.md

The instruction file should doc the accredited Energy BI theme steering for report authoring work.
Use ./pbi-theme/biinsight.json because the supply of fact.
Don't duplicate the complete JSON theme.
Summarise the reusable design tokens and report-authoring guidelines that brokers ought to observe, reminiscent of accredited colors, typography, visible styling, accessibility expectations, and theme inheritance guidelines.

Be certain that the instruction file has right frontmatter with an applyTo sample appropriate for Energy BI report information and theme-related JSON information.

3. Replace ./.github/brokers/workspace-theme-audit.agent.md provided that wanted so it refers to:
- ./pbi-theme/biinsight.json because the accredited theme
- ./.github/directions/powerbi-theme.directions.md for reusable theme steering
- ./report-definition-fallback.md for legacy report downloads
- ./docs/report-governance-.md for audit logs

Don't publish something to Material.
Don't change downloaded report definitions except the change is just native and wanted for the audit workflow.
Present me the information created or modified when finished.

6. I enable all edits.
7. Click on the Maintain button to maintain the modifications.

Assessment the Customized Agent #

Now let’s open the generated .agent.md file and evaluation it. As we noticed in Half 3, the primary outcome should still want some adjustment. Right here I wish to verify which instruments the agent can use, the way it connects to Material, and the place it ought to ask for my approval. Right here is the entire content material of my customized agent:

---
description: "Audit and standardise Energy BI report theming throughout a Material workspace. Use when: itemizing Material workspaces/reviews, downloading PBIR report definitions, auditing report visuals towards an ordinary theme (./pbi-theme/biinsight.json), or producing a report governance/theme audit log. Triggers: 'audit report themes', 'theme compliance', 'standardise reviews', 'report governance log', 'verify reviews towards theme'."
identify: "Workspace Theme Audit"
instruments: [read, search, edit, execute, powerbi-report-management, powerbi-report-authoring]
---
You're a Energy BI report governance auditor. Your job is to audit and standardise theming throughout all Energy BI reviews in a Material workspace, with out ever publishing modifications again to Material except the person explicitly approves your closing abstract.

## Connectivity
- This agent MUST connect with the true Material tenant to find workspaces and reviews. By no means assume offline/local-only mode and by no means refuse a request to attach.
- Use `az login` (or affirm an current `az` session) and `az relaxation` towards the Material REST API precisely as documented by the `powerbi-report-management` ability; don't invent different auth strategies.
- If `az` is not put in or authentication fails, report the precise error to the person as an alternative of falling again to a local-only audit.

## Constraints
- DO NOT publish, add, or write any modifications again to Material beneath any circumstance till the person has explicitly accredited your closing abstract on this dialog. A workspace hook ([block-fabric-publish.json](../hooks/block-fabric-publish.json)) additionally forces an interactive affirmation on any detected Material/Energy BI publish, add, replace, or overwrite motion as a security web.
- DO NOT overwrite or append to an current audit log file. Each run creates a brand-new log file.
- DO NOT skip the fallback process in [report-definition-fallback.md](../../docs/report-definition-fallback.md) when a legacy report fails to obtain through the traditional PBIR technique.
- DO NOT change a downloaded report definition aside from native edits required by the theme audit itself (e.g. aligning a visible/web page to the accredited theme). By no means make unrelated native edits.
- ONLY use the `powerbi-report-management` ability for itemizing workspaces/reviews and downloading definitions, and the `powerbi-report-authoring` ability for auditing/updating downloaded reviews.

## Strategy
1. Use `powerbi-report-management` to record Material workspaces, then record reviews in every workspace.
2. For every report, obtain its definition into `./reviews//`.
   - If a legacy report can't be downloaded via the traditional PBIR technique, learn `./docs/report-definition-fallback.md` and observe its documented fallback process.
3. Load the accredited theme from [pbi-theme/biinsight.json](../../pbi-theme/biinsight.json). That is the only supply of fact for colors, typography, and visible styling.
4. Apply the reusable design tokens and authoring guidelines in [powerbi-theme.instructions.md](../directions/powerbi-theme.directions.md) along with `biinsight.json` when judging compliance.
5. Use `powerbi-report-authoring` to audit every downloaded report's pages/visuals/theme references towards `biinsight.json`, and apply local-only file updates to deliver reviews into compliance.
6. Report findings (workspace, report, compliance standing, deviations discovered, modifications utilized regionally) as you go.
7. On the finish of the run, create a brand new audit log at `./docs/report-governance-.md`, the place `` makes use of the format `YYYYMMDD-HHmmss` primarily based on the precise run time. By no means reuse or modify a previous log file.
8. Current a closing abstract of findings and proposed modifications to the person and explicitly ask for approval earlier than taking any motion that may publish outcomes again to Material.

## Output Format
A concise run abstract itemizing: workspaces/reviews scanned, reviews needing fallback dealing with, theme deviations discovered per report, native modifications utilized, the trail to the brand new audit log, and an specific request for approval earlier than any Material publish step.

Let’s undergo the sections on this file. The identical construction could also be helpful for different duties, however the directions listed below are particular to our report theme audit.

Frontmatter

The frontmatter, as proven within the following picture, defines three fields:

• description: Summarises the agent’s goal so VS Code and customers can establish when it’s applicable to make use of.
• identify: Units the agent’s identifier, which VS Code makes use of to show and reference the customized agent.
• instruments: Provides the agent entry to information, command execution, and the 2 Energy BI expertise wanted for this workflow.

In my setup, execute permits the agent to run the Azure CLI instructions used for authentication and Material REST API calls. The 2 Energy BI expertise present the directions for managing report definitions and auditing their content material, as we lined in Half 4. We will additionally use the Config instruments… CodeLens hyperlink to evaluation or change the accessible instruments, which is sort of helpful.

Agent’s Function

The opening paragraph provides the agent its position as a Energy BI report governance auditor. It additionally units the scope: audit the reviews, make the required native modifications, and ask for my approval earlier than publishing. I need that expectation to be clear from the start of the file.

How the Agent Is Instructed to Work

The Connectivity part tells the agent to hook up with Material utilizing the Azure CLI course of documented within the administration ability. That is vital as a result of an audit of information already on my machine might miss reviews or modifications within the workspace. If authentication fails, I wish to see the error so I can resolve it earlier than persevering with.

The Constraints part accommodates the foundations for publishing, creating separate audit logs, following the legacy fallback, and protecting native edits throughout the theme audit. It additionally tells the agent which ability to make use of for every activity. These are directions for the agent to observe. I nonetheless have to evaluation the outcomes and take a look at the publish hook, which we are going to do later on this submit.

The Strategy part places the work so as. The agent ought to uncover the workspaces, obtain the reviews, deal with legacy definitions, examine them with the accredited theme, and document the findings. As soon as the audit log is prepared, it ought to present me the outcome and ask for approval earlier than publishing.

The Output Format part describes what I want for that evaluation: which reviews had been scanned, the place the fallback was wanted, what modified regionally, and what stays unresolved. It also needs to give me the audit log path so I can verify the element earlier than deciding what to do subsequent.

Utilizing the Customized Agent #

There are a number of ways in which we are able to use a customized agent. We will use it immediately within the VS Code Chat view, choose it when beginning a Copilot CLI session, and even let one other agent name it as a subagent when the configuration permits that. For this weblog, I hold it easy and use it immediately in VS Code. I wish to see the interplay and evaluation what it’s doing.

We will present a number of workspace names to restrict the audit, or ask the agent to find the Material workspaces we have now entry to. For this run, I wish to verify all accessible workspaces, so I open a brand new chat and use this immediate:

Audit and standardise report theming throughout all Material workspaces I can entry. Apply modifications regionally and don't publish something.

Open a brand new Copilot Chat, then:

1. Choose the Agent drop-down
2. Choose Workspace Theme Audit
3. Enter a immediate
4. Click on the Ship button

After round 8 minutes, I bought the outcomes. I used Claude Sonnet 5 with the Low effort stage, and the run consumed 102.9 credit. The agent linked to Material via Azure CLI, discovered 4 workspaces and 4 reviews that I’ve entry to, and downloaded the 2 reviews from the SalesAndMarketing workspace. It additionally used the fallback technique for the legacy Contoso report, which was one of many primary issues I wished to check.

For the trendy Gross sales report, the agent changed the customized theme useful resource with the accredited theme and created the audit log.

Trying on the log, there was fairly a bit extra to deal with. The primary findings had been:

• Gross sales, report theme: It used an unapproved crimson, blue, and teal theme. The agent changed its contents with BIInsight, protecting the present filename so the report reference remained legitimate.
• Gross sales, visible formatting: Roughly 40 visuals throughout six pages had hardcoded backgrounds, font colors, and information colors overriding the theme. These wanted a separate re-theming cross and Energy BI Desktop validation.
• Contoso Q2 Division Gross sales: It had no theme reference, and its pie chart used the default Energy BI palette. The agent left it unchanged as a result of it couldn’t confirm the best way to register the theme within the legacy definition.
• Operations Analytics: It had no theme utilized and intensive formatting overrides throughout greater than 40 visuals on three pages, together with title bars, card backgrounds, and chart colors. These additionally remained unchanged.
• Client Web site visitors: It had no theme reference, and its useful resource packages contained customized visuals solely. The agent checked its construction however didn’t full a page-by-page audit, so this report nonetheless wanted additional inspection.

The log marked Gross sales as partially compliant and the three legacy reviews as non-compliant. Solely the Gross sales theme useful resource had been modified regionally; nothing had been revealed to Material.

After reviewing the audit log, I made a decision to proceed with the Gross sales report. It was already in trendy PBIR format, and the log advisable a devoted re-theming cross for its remaining overrides. That gave me a manageable subsequent step on this setup: apply the modifications regionally, then evaluation the report in Energy BI Desktop earlier than publishing. The legacy reviews wanted a separate investigation. So I despatched the next immediate to my customized agent:

Decide the Gross sales report and apply all establish modifications captured within the @file:report-governance-20260801-174808.md file

This second run took round three minutes and consumed about 63 credit. Trying on the outcome, I need to say that I’m fairly happy with how the report seems to be like now. It’s not straightforward to indicate each formatting change in a single screenshot, however the distinction between the earlier than and after variations is sort of substantial.

Most Deterministic Guardrail: The Hook #

Earlier, I requested the agent to create a hook that requires approval earlier than publishing. I wish to spend a little bit of time on it as a result of the instruction within the agent file and the hook do totally different jobs. The instruction tells the mannequin when to cease. The hook runs a script earlier than a device name and returns a permission choice to Copilot. For an identical motion, that call comes from the script’s guidelines outlined in a JSON file. The hook’s configuration format is:

{
  "model": 1,
  "hooks": {
    "sessionStart": [
      {
        "type": "command",
        "bash": "string (optional)",
        "powershell": "string (optional)",
        "cwd": "string (optional)",
        "env": { "KEY": "value" },
        "timeoutSec": 30
      }
    ],
  }
}

In easy phrases, this JSON is an inventory of guidelines for when Copilot ought to run a command. The model tells Copilot which format the file makes use of, and hooks teams the foundations by occasion. Within the previous instance the sessionStart means: “run the command when a session begins”. Bash and PowerShell are the supported methods to begin the hook, however that command can then run a program written in one other language, reminiscent of Python. It will possibly even have an elective folder, settings, and time restrict. The next exhibits the rule I exploit in my hook:

{
  "model": 1,  
  "hooks": {
    "PreToolUse": [
      {
        "type": "command",
        "bash": "pwsh -NoProfile -File ./.github/hooks/block-fabric-publish.ps1",
        "powershell": "pwsh -NoProfile -File ./.github/hooks/block-fabric-publish.ps1",
        "timeoutSec": 10
      }
    ]
  },
  "_todo": [
    "TODO(publish-approval-guardrail): This hook cannot read the chat transcript, so it cannot verify that the user already gave explicit approval earlier in the conversation.",
    "As a safe substitute, it forces an interactive confirmation ('ask') on every detected Fabric/Power BI publish, upload, update, or overwrite action instead of a silent allow/deny based on transcript history.",
    "If a future VS Code/Copilot hook schema exposes conversation/approval state to PreToolUse, update block-fabric-publish.ps1 to check for that instead of always asking.",
    "Verify this hook actually fires in your VS Code/Copilot version — hook support and the exact stdin schema (tool_name/tool_input field names) may vary by release. If hooks are not supported, this file has no effect and the guardrail falls back to the agent-file constraints only."
  ]
}

• PreToolUse, the occasion: That is the entry inside hooks that tells Copilot when to run the hook. It runs earlier than Copilot executes a proposed device name.
• The PreToolUse, the handler: That is the configuration contained in the sq. brackets. The kind identifies it as a command. bash offers the command to make use of on Unix-like techniques, whereas powershell offers the command to make use of on Home windows. Retaining each makes the hook moveable. The timeoutSec limits how lengthy the command can run. The script then accommodates the circumstances to verify.
• The _todo, the notes: This isn’t an occasion or a handler. Copilot added it to document the present limitations and doable future enhancements. It’s only documentation and doesn’t have an effect on what the hook does. There’s a element right here that differs from my authentic immediate. I requested for publishing to rely on approval within the present chat. The generated hook can’t learn that approval historical past, which the JSON file already documented this limitation. As a substitute, it requests a contemporary affirmation for each write motion it detects. So, it doesn’t completely block publishing. It asks me earlier than letting the detected motion proceed which positive in my setup.

Right here is the powershell script that Copilot generates:

# Blocks Material/Energy BI publish, add, replace, or overwrite actions.
# Learn-only actions (record, get, obtain, learn) are all the time allowed.
# This hook can't examine the chat transcript, so it can't confirm that the
# person already gave specific approval earlier within the dialog. To honor
# the "specific approval" requirement safely, it asks for interactive
# affirmation on each matching write motion as an alternative of silently permitting it.

$ErrorActionPreference="Cease"

$uncooked = [Console]::In.ReadToEnd()
$deny = {
    param($motive)
    [Console]::Out.Write((@{
        hookSpecificOutput = @{
            hookEventName            = "PreToolUse"
            permissionDecision       = "ask"
            permissionDecisionReason = $motive
        }
    } | ConvertTo-Json -Depth 6))
    exit 0
}
$enable = {
    [Console]::Out.Write((@{
        hookSpecificOutput = @{
            hookEventName      = "PreToolUse"
            permissionDecision = "enable"
        }
    } | ConvertTo-Json -Depth 6))
    exit 0
}

if ([string]::IsNullOrWhiteSpace($uncooked)) { & $enable; return }

attempt  ConvertFrom-Json -ErrorAction Cease
 catch {
    & $enable
    return
}

$toolName  = "$($payload.tool_name)$($payload.toolName)$($payload.device)"
$toolInput = ($payload.tool_input | ConvertTo-Json -Depth 10 -Compress -ErrorAction SilentlyContinue)
if (-not $toolInput)  ConvertTo-Json -Depth 10 -Compress -ErrorAction SilentlyContinue) 
$haystack = "$toolName $toolInput".ToLowerInvariant()

# Secure read-only patterns short-circuit to permit, even when a write key phrase
# additionally occurs to seem close by (e.g. "obtain report definition").
$readOnlyPatterns = @(
    'getdefinition', 'record workspaces', 'listworkspaces', 'record reviews', 'listreports',
    'listitems', 'record gadgets', 'obtain', '/getdefinition'
)
$isReadIntent = $false
foreach ($p in $readOnlyPatterns) {
    if ($haystack -like "*$p*") { $isReadIntent = $true; break }
}

# Write/publish patterns that mustn't ever proceed with out specific affirmation.
$writePatterns = @(
    'publish', 'updateitemdefinition', 'replace merchandise definition', 'updatedefinition',
    'uploaddefinition', 'add report', 'uploaddefinition', 'createitem', 'overwrite',
    'updatereport', 'replace report', 'savereport', 'publishreport'
)
$isWriteIntent = $false
foreach ($p in $writePatterns) {
    if ($haystack -like "*$p*") { $isWriteIntent = $true; break }
}

# Specific HTTP verbs towards Material merchandise/report write endpoints (az relaxation calls).
$httpWritePattern = '(--methods+(submit|patch|put)).*(gadgets|reviews)'
$isHttpWrite = [regex]::IsMatch($haystack, $httpWritePattern)

if (($isWriteIntent -or $isHttpWrite) -and -not $isReadIntent) {
    & $deny "This seems to be like a Material/Energy BI publish, add, replace, or overwrite motion. Verify explicitly earlier than it proceeds."
    return
}

& $enable

The meant rule is straightforward: studying reviews can proceed, however altering or publishing them requires affirmation. The script seems to be on the device name for phrases suggesting both kind of motion. For a recognised write motion, it returns ask, so Copilot pauses and asks me to verify. For a recognised learn motion, or something it considers secure, it returns enable and lets the motion proceed.

Copilot documented the script with feedback and clear names, so we don’t must be PowerShell specialists to evaluation its meant behaviour. We will nonetheless, and we should always, verify which actions it treats as secure or delicate, and whether or not that matches our approval guidelines. Nonetheless, deeper scripting or safety data could also be wanted to confirm each edge case, so the hook needs to be examined earlier than counting on it.

Trying on the precise behaviour, there are a number of limitations on this model. A request containing each a learn phrase, reminiscent of obtain, and a write phrase, reminiscent of replace, could be allowed as a result of the script treats the learn phrase as secure first. It additionally permits a request it can’t learn, and it can’t ask for affirmation for a write motion it doesn’t recognise. The hook is helpful, however this model doesn’t assure that each doable Material write will probably be caught.

I left these enhancements out of this walkthrough to maintain the weblog from turning into overly lengthy and to make it simpler to observe. They’re comparatively easy modifications that we are able to ask Copilot to make, reminiscent of denying invalid enter and giving write patterns precedence. For an actual undertaking, I STRONGLY advise everybody to evaluation the patterns towards the instruments and instructions you employ, then alter the hook to observe the approval and safety guidelines applicable to your setup.

For this walkthrough, I don’t want to check each doable write motion. As a substitute, I wish to take a look at the publish motion the agent will truly use and make sure that Copilot masses and runs the hook. At this level, I may publish the report manually from Energy BI Desktop, however I ask the agent to publish it to Material and verify whether or not the hook pauses for affirmation.

On this take a look at, the hook paused the publish motion and requested me to “Verify explicitly earlier than it proceeds”. I had intentionally set Copilot’s permission stage to Autopilot, so I used to be fairly happy to see the affirmation nonetheless seem. That confirms the hook caught the publish motion used on this run. I might take a look at it once more if I modified the publishing technique or hook configuration.

Be taught extra about hooks right here.

Prices #

Now let’s take a look at what this train price. The whole run session consumed roughly 605 credit. Together with the agent creation, a few take a look at runs, and the ultimate run, I used round 1,100 credit in whole. Utilizing the GitHub pricing on the time of authoring this weblog, I estimated the associated fee at roughly $11 USD, or $18.70 NZD.

For one small report, I might in all probability do the formatting modifications manually. The setup turns into extra helpful after I have to repeat the audit, as a result of the agent and directions are already there for the subsequent run. I nonetheless have to account for the time spent reviewing the output, although. I additionally wish to attempt totally different fashions and energy ranges to see how a lot they have an effect on the associated fee and the outcome.

Remaining Ideas #

I’m fairly proud of how the Gross sales report takes care of the modifications. We additionally now have a customized agent that may reuse the theme steering and legacy fallback from Half 4, examine reviews, and document its findings. The audit was not full for each report. Formatting overrides throughout roughly 40 Gross sales visuals wanted one other cross, and the legacy reviews nonetheless wanted additional investigation. The log made these gaps seen and helped me determine what to do subsequent, which is helpful by itself.

We will make this work extra deterministic by giving the agent a slim job, one accredited theme, documented fallback steps, and clear checks for the outcome. When a rule could be checked in code, a examined script or hook provides us extra predictable behaviour than asking the mannequin to interpret the rule every time. Our publish hook returned a affirmation request for the motion I examined, even with Autopilot enabled. It additionally had gaps in its matching guidelines, so these want consideration earlier than counting on it extra broadly. As we discover these points, we are able to enhance the directions and scripts for the subsequent run.

I might encourage everybody to take a look at the associated fee financial savings right here as nicely. The credit are one a part of the associated fee, however so is our time spent downloading reviews, checking the identical formatting guidelines, making use of modifications, and documenting what we discovered. For repetitive work like this, particularly throughout many reviews and repeated audit cycles, the financial savings can add as much as tons of of hours. We spend time making ready the customized agent and testing the method at the start, then reuse that work. That’s the place I see quite a lot of worth on this method.

Don’t get me fallacious right here although. We positively have to spend time staying within the loop of each motion, so we are able to catch costly errors early within the course of. We additionally have to evaluation all of the modifications, together with checking the reviews in Energy BI Desktop earlier than publishing. These are two separate elements of the job. Following the agent as it really works helps us right the course early, whereas reviewing the modified information and reviews tells us whether or not the outcome is definitely acceptable. Each must be included once we calculate the time saved.

In my expertise with real-world situations, relying on the complexity of the work and the standard of the customized agent, time financial savings someplace within the ballpark of 30% to 50% are achievable whereas nonetheless permitting for supervision and evaluation. That is my expertise throughout initiatives, relatively than a measured saving from the small instance on this weblog. Some jobs want extra intervention than others, and we should always truthfully account for that.

If you happen to discovered this handy, you’ll be able to observe me on LinkedIn, subscribe to BI Perception on YouTube, or observe the BI Perception podcast on Spotify. I additionally share updates on Bluesky and X, masking Energy BI, Microsoft Material, AI, and the real-world information and analytics issues I come throughout alongside the way in which.

Associated