Skip to content

Open-source Copilot agent management: where the config, the review and the model live

Kortix is the open-source AI Operating System, and it keeps the agent layer in a git repo the team owns. Managing Copilot agents means deciding where an agent is defined, who reviews its work before it counts, and which model runs it, and the comparison here puts Microsoft Copilot Studio and Kortix side by side.

The agent, its grants and its policy, in one file

kortix.yaml
# kortix.yamlkortix_version: 2default_agent: supportagents:  support:    file: agents/support.md    connectors: all    secrets: all    skills: all    kortix_permissions: allpolicy:  default_mode: allow_all
Source https://kortix.com/docs/project/manifest

The kortix.yaml at the root of the repo declares which agents run, what each may reach, and the default mode for tool calls. Kortix is open source, so the file is yours to read and diff.

Where the agent layer lives in each

One column states what Microsoft documents; the other is Kortix, the open-source option we recommend.

Kortix

Open source
Yes
Where the agent's configuration lives
Files in a git repo you own
How a change is reviewed
A change request a person approves
Who approves an agent's work
A person reviews the diff before it lands
Model choice
Any model provider with your own keys
How far agents reach
3,000+ apps in a click, plus MCP, OpenAPI, GraphQL, raw HTTP
Where it runs
Kortix Cloud, your VPC or on-prem
Self-host
Yes, self-host is free

Microsoft Copilot Studio

Open source
No
Where the agent's configuration lives
In the studio, in a Power Platform environment
How a change is reviewed
A publish from the studio, with admin approval for the app catalog
Who approves an agent's work
Makers publish; admins govern with data policies
Model choice
Microsoft's models, with admin-gated external models
How far agents reach
Power Platform connectors, REST APIs, MCP servers
Where it runs
Microsoft's cloud, in a Power Platform environment
Self-host
No

Kortix facts come from kortix.com/docs; Copilot Studio facts come from Microsoft Learn's Copilot Studio overview, security and governance, publishing and agent-management pages, checked October 2026.

What managing Copilot agents means in the Microsoft stack

Microsoft Copilot Studio is a graphical, low-code studio for building and managing AI agents and workflows on Microsoft's platform. A maker describes an agent in plain language, connects it to organizational knowledge, tests it, and publishes it to channels such as Microsoft Teams, a website, or Microsoft Copilot (the Copilot Studio overview). Agents run on Microsoft's cloud inside a Power Platform environment, and they reach other systems through Power Platform connectors, REST APIs and MCP servers.

Managing those agents is a set of controls spread across Microsoft's admin surfaces. Admins use the Power Platform admin center to govern connector use with data policies, to enable customer-managed encryption keys, and to review connector dependencies before deployment. Microsoft Agent 365 acts as a central control plane that represents Copilot Studio agents as identities in Microsoft Entra, where admins apply conditional access and access-governance workflows (the Copilot Studio security and governance page). Publishing is the release step: each update is published from within the studio and applies to every connected channel, and an admin can turn publishing off for the tenant. Microsoft's own governance guidance places agents in development, test and production environments and requires admin approval before an agent is published to the organization's app catalog (Microsoft's Copilot Studio governance guidance).

What a team keeps when it owns the agent layer

Kortix is the open-source AI Operating System, and it puts that layer in a git repo the team owns. An agent is agents/<name>.md (behavior) plus an agents.<name> block in kortix.yaml (governance), so the definition, what the agent may reach, and the grants sit in files a person can read, diff and review (Read the docs). Each session runs on its own cloud computer and its own branch, and session work reaches main through a change request. Merge is default-deny for agents, so a person reads the diff before it lands.

The model stays a choice the team keeps: any model provider with your own keys, or the ChatGPT plan you already pay for (Read the docs). Reach is not bounded by one vendor's connector catalog, because Kortix connects 3,000+ apps in a click, plus MCP, OpenAPI, Postman, GraphQL and raw HTTP, and connector credentials are brokered server-side and never enter the machine. Kortix sets each tool to Allow, Ask or Block, down to the arguments of each call. Approval gates you set. Off until you set them. Run it on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free.

How the review works

An agent that changes something works on its session branch and opens a change request against the project's default branch. The change request is the review surface: a person reads the diff, and the merge stays default-deny for agents until someone with the merge grant approves it. An agent can edit its own configuration on its session branch and propose the change. A person approves it.

That is the difference from a publish button. In the Microsoft stack the studio publishes to every channel at once, and an admin's controls sit in the Power Platform and Microsoft 365 admin centers. In Kortix the change is a file in a repo the team owns, and the review happens on the diff before it merges. If the agent layer has to run where the team decides, Kortix also runs on Kortix Cloud, in a VPC, or on-prem, and self-host is free.

The wider switching case is on the Copilot Studio alternatives page, and the direct product comparison is on the Kortix vs Copilot page. For the definition of Microsoft Copilot itself, see what Microsoft Copilot is. The full argument is on the Kortix blog.

FAQ

Copilot agent governance, answered

  1. Q1

    Who approves an agent's work before it counts?

    In Kortix, a person does. Session work reaches main through a change request, and merge is default-deny for agents, so the diff is read before it lands. An agent can edit its own configuration on its session branch and propose the change, and a person approves it. Approval gates you set. Off until you set them. In Copilot Studio, makers publish from the studio and admins govern publishing and connectors through the Power Platform admin center.

  2. Q2

    Where does the agent's configuration live?

    In Copilot Studio it lives in the studio, in a Power Platform environment, and admins govern it from the Power Platform admin center. In Kortix it lives in a git repo you own: agents/<name>.md for behavior and an agents.<name> block in kortix.yaml for governance. Microsoft's own ALM guidance has teams export the agent as a package and store it in source control; Kortix starts from the repo.

  3. Q3

    Which model runs the agents?

    In Kortix, any model provider with your own keys, or the ChatGPT plan you already pay for. In Copilot Studio the model is Microsoft's and is chosen per agent from a list Microsoft controls; admins can allow or block preview, experimental and external models from the admin centers. In Kortix the model is a project-level choice you can change without asking a vendor.

  4. Q4

    Can the open-source option be self-hosted?

    Yes. Kortix runs on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free. The stack starts with kortix self-host start, one Docker Compose stack on a server you control. Copilot Studio runs on Microsoft's cloud inside a Power Platform environment, and Microsoft documents no self-host edition.

Move the agent layer into a repo you own

Start with one agent and one job.