The My Company Policy Copilot Agent - Honest Notes on Policy Q and A at Work

Every Australian company over about two hundred staff has the same problem. Somebody in payroll, or HR, or the finance team, spends a measurable chunk of their week answering questions that are already answered in writing. Can I salary sacrifice my super through this fund. How does our parental leave top-up work if my partner is the primary carer. What is the cap on the work from home allowance. The policies exist. They are sitting on a SharePoint site nobody bookmarks.

The My Company Policy agent template, which Microsoft ships as part of its Copilot extensibility starter set, is a direct attempt at fixing this. I want to walk through what it does, where it works in practice, and the things I would flag to any HR or operations director before they roll it out.

What the template actually is

The My Company Policy agent is a declarative Copilot Studio agent that you ground on your internal policy documents. You point it at one or more SharePoint sites, or a document library, or a OneNote that holds your handbook content. Staff then ask it questions in plain English through the Microsoft 365 Copilot app, or inside Teams, and it answers from those documents, with citations back to the source.

The template ships with a default set of instructions that do a few things you would otherwise have to write yourself. It refuses to make policy up. If the answer is not in the grounding content, it says so rather than hallucinating a policy from training data. It cites the document and section it took the answer from. It avoids giving personal advice, which matters because HR policies often need to be interpreted in context.

You can deploy the template more or less as-is and have something useful within a day. The work that takes longer is tuning the source content and the agent personality so it sounds like your company, not a generic HR bot.

The places it has actually paid off

We have helped four Australian clients deploy variants of this pattern over the last twelve months, with three of those being on the My Company Policy template specifically once it became available. The places it has earned its keep are pretty consistent.

The first is anywhere the HR inbox is a known bottleneck. One of our clients, a national professional services firm, had a small people operations team answering about four hundred policy questions a week. The same fifty questions, asked over and over, by different staff. We pointed the agent at their handbook, their leave policy, their travel and expense policy, and their code of conduct. Within a month the inbound HR queries dropped by roughly forty percent. The questions that remained were the ones that needed human judgement, which is what the team should have been spending their time on anyway.

The second is during big policy changes. Earlier this year a mining services business we work with updated their fatigue management policy. Normally that triggers a flurry of misinterpretations on the floor. Site managers reading the policy slightly differently. Supervisors making up their own rules. We deployed the agent grounded on the new policy two weeks before the change went live, and let supervisors ask it questions through Teams. By go-live, the questions arriving at the head office had been answered already, and the rollout was the smoothest one they have had.

The third is the long tail of forms and templates. Most policy questions are not really policy questions, they are about how to do the associated thing. Which form is the leave application. Where does the expense claim go. Who approves a work from home request for an offsite worker. The agent handles those well because they are in the policy documents already, even if nobody reads to the bottom of page eleven to find them.

What the template does well out of the box

A few things in the default template that I would call out as actually good.

Source citations are the single most important feature. The agent links back to the document and the section it pulled from, every time. Staff can click through and read the original. That builds trust quickly because anyone who is suspicious of the answer can verify it in one click. We tested this with a sceptical audience at a financial services client and within a week the questions stopped being "is that right" and started being "ok so does the form get sent to me or to my manager".

The refusal behaviour is solid. If you ask the agent something not covered in the policy, it tells you to contact HR directly. It does not try to be helpful by guessing. That is the right call for a policy bot. You want the staff member to talk to a human when the situation is genuinely ambiguous, not to take guidance from a model that does not know your specific circumstances.

The integration with Microsoft 365 Copilot is also a real advantage compared with building a custom chat tool. The agent shows up in the same place as everything else. Staff do not have to remember a separate URL or install a new app. For an HR rollout where adoption is fragile, this matters. We have seen first-week usage two to three times higher than the bespoke chatbots we used to build before Copilot existed.

The bits that need real care

Now the honest part. The My Company Policy template will only ever be as good as the policy documents you point it at. If your policies are out of date, ambiguous, or contradictory, the agent will surface that with painful clarity. I have watched it happen at three different clients now. The policy doc says one thing on page two and something different on page nine. Staff never noticed because nobody actually read both. The agent reads both, picks one, and now your inconsistency is going through Teams as gospel.

Plan for a content audit before you deploy. We typically spend the first two weeks of any policy bot project reading the actual policies and writing up a list of contradictions, gaps, and unclear sections for the client to fix. That part of the work is unsexy and inescapable. Nobody wants to do it. You have to.

Watch out for permissions on the source content. SharePoint policy libraries are often a mix of "everyone can read" and "only HR can read". The agent respects whatever permissions are on the source. If the agent is configured to use a service account, it will see all of it and surface all of it. If it is configured to use the user's own identity, it will only see what they can see. That second option is usually what you want, but it changes the rollout. You need to make sure the SharePoint permissions actually match the policy on who can see what.

Be careful with policy that has legal weight. Things like enterprise agreements, modern slavery policies, work health and safety law. The agent's answer is a paraphrase with a citation, but staff will treat it as authoritative. For anything with legal exposure, the right pattern is to make the agent quote the source verbatim rather than paraphrase, or to have it answer with "the policy says, in full, the following" and then drop in the relevant clause. We have had to add custom instructions to several of our deployments to get that behaviour reliably.

The other thing to think about is when the policy itself does not have an answer. Most company handbooks were written for the median case. Anything edge-case will return a refusal from the agent, which is correct, but it will also frustrate staff who were hoping not to have to email HR. That is a flag to update the policy, not to weaken the agent. The temptation is always to make the agent more "helpful" and let it speculate. Do not do this. The first time it tells someone something that turns out to be wrong, you will lose six months of trust.

How to set this up without regretting it

If you are going to deploy the My Company Policy template at your organisation, the path I would recommend looks something like this.

Start with one policy domain. Leave and entitlements is usually a good first one because it has clear documents and high question volume. Get that working before you add anything else.

Audit the source content before deployment. Read it. Fix the contradictions. Update the dates. Remove the references to systems you migrated away from. This is the work.

Choose user-identity grounding rather than service-account grounding unless you have a very specific reason. Let SharePoint permissions do the access control.

Run a two-week pilot with a single business unit before opening it to everyone. Watch the questions that get refused. Those are your roadmap.

If you want to think this through with somebody who has shipped a few of these, the Copilot training and business AI training practices at Team 400 cover exactly this kind of rollout. For organisations that want to take the policy bot pattern further and have the agent start triggering workflows, like initiating a leave request rather than just describing how to do it, the agentic automation work is where that conversation goes next.

The My Company Policy template is not the most exciting thing in the Copilot extensibility catalogue. But it is one of the highest-value-per-day-of-effort agents you can ship, and for most Australian companies it is a better first project than something more ambitious.

Original Microsoft documentation: My Company Policy agent template