A book about restraint

Most books on AI agents promise autonomy. This one is about boundaries, and that is where it is strongest. Hugo Herrera is a solutions architect with more than 15 years on Dynamics 365, Power Platform and Azure, and the author of Packt’s Power Platform Solutions Architect’s Handbook. His thesis, stated in the preface, is that an agent needs “clear boundaries, controlled access to information, evaluation, and a workflow that leaves important decisions with the people accountable for them.” The rest of the book builds on that sentence.

Scope and structure

The book is aimed at developers, solution architects, AI engineers and technical decision-makers working with Microsoft technology. It follows one scenario throughout: an insurance claims system called Claims 365, delivered through three agents, each on a different tier of Microsoft’s stack.

• Frontline (Copilot Studio): a low-code, customer-facing agent grounded in Dataverse and published to a website with Entra External ID sign-in.
• Triage (Microsoft Foundry): a multimodal agent that assesses a damage photo and a repair quote, then returns a typed verdict against a strict schema.
• Fraud Desk (Microsoft Agent Framework): a code-first workflow that follows connections across the claims book to spot possible fraud rings and pauses for a human decision.

Chapter 1 sets up the tenant, Chapters 2 to 5 build the agents, and Chapter 6 traces one claim through the whole system and compares the three tiers.

What the book does well

Tier selection. Herrera calls choosing the right stack “the most useful skill this book teaches,” and he starts with a question many vendor-adjacent books skip: does a ready-made SaaS agent already do the job? His rule is to begin at the lowest tier that works and move up only when you hit a structural limit. Chapter 6 backs this with a table explaining why each agent sits where it does. Copilot Studio can return JSON, for example, but you can’t edit the generated schema or pin the model version, so Triage moved to Foundry.

Grounding. Early on, the Frontline agent gives a confident, cited, wrong answer about money: it reports the amount claimed as the payout. The book makes its point by letting this happen. “Grounding improves relevance; it does not replace verification.”

Fraud Desk. The workflow runs through four stages (intake, investigate, challenge, refer) and keeps deterministic code apart from model reasoning. A Challenger agent gets no data tools and exists only to question the Investigator’s evidence. Typed messages define every edge of the graph, so you can test the structure without calling a model. The principle of separating process from reasoning should outlast any particular SDK.

Cost. One passage traces how the workflow was optimized. The first version used 16 model round trips and about 43,000 tokens. Removing a tool call made it slightly more expensive. Restructuring the traversal brought it down to five round trips and about 9,000 tokens. Few books show tuning like this, or tie it to OpenTelemetry tracing.

Testing. The setup instructions are full of hard-won detail: licensing errors that don’t mention licensing, Dataverse environments that look healthy but can’t register flows, and security roles that you have to check as a non-admin because admin rights hide misconfigurations. This material was clearly run before it was written down.

Limitations

Shelf life. Large parts of the book are click-paths through Copilot Studio, Foundry and the Power Platform admin center, with pinned Python versions (“3.12 or 3.13… Not 3.14”). These products change monthly, so the step-by-step chapters will age faster than the architectural ones.

Barrier to entry. You need an administrable work tenant, Copilot Studio& Copilot Credits licensing, an Azure subscription, several role assignments and about an hour just to import the setup pack. The book says so openly, but readers without tenant admin rights may be locked out of most exercises.

Security. The production-readiness section admits that the exercise has no rate limiting against brute-force verification attempts. The book does not cover prompt injection, though, which is arguably the main security risk for agents that read untrusted customer input and documents. Evaluation in Copilot Studio is also limited to single-response test sets, with little on multi-turn or adversarial testing.

Microsoft only. Comparisons with LangGraph, other semantic vector search services, MCP-centric designs or other clouds are out of scope. That is a fair choice for this book, but it narrows the readership.

My Verdict

A compact, disciplined practitioner’s guide. Chapters 5 and 6 are the most useful: they give a clear decision framework for Microsoft’s three agent tiers and show how to combine deterministic workflow with bounded agent reasoning and a human gate that cannot be skipped.

The book’s hands-on exercise has you build “Claims 365,” an insurance claims system with three cooperating agents: a customer-facing Copilot Studio agent that answers through access-controlled tools, a multimodal Foundry agent that turns a damage photo and repair quote into a typed routing verdict, and a code-first Agent Framework workflow that investigates possible fraud rings and pauses for a human decision. What makes it so valuable is that it deliberately exposes real failure modes, such as a grounded agent confidently giving the wrong payout amount or weak evidence that needs challenging, and then fixes them with production patterns like constrained tools, entitlement checks, strict schemas, measured token costs, and human-in-the-loop gates. Because all three tiers solve a real business problem, readers leave with more than working demos: they learn when to choose low-code, Foundry, or code-first, and how to keep agents bounded, testable, and accountable.

• Solution architects and technical leads on the Microsoft stack: highly recommended.
• Power Platform makers moving into agents: recommended. Chapters 2, 3 and 6 are the core.
• Developers outside the Microsoft ecosystem: read Chapter 5 for the patterns and skip the rest.
• Readers looking for agent theory or broad security coverage: look elsewhere.

Rating: 5 / 5

Author: Hugo Herrera · Publisher: Packt, 2026 · ISBN: 978-1-80882-217-9 · Length: ~140 pages of core content plus code bundle (Python and C#)

Get this Book at Packt Publishing or Amazon (Affiliate) – or support your local bookstore.