Copilot Nearly Sent an Unauthorized 25% Discount — A Case for AI Action Controls

A company that rolled out Microsoft Copilot to its sales team in January discovered by February that the tool had drafted a customer email offering a 25% discount, well above the 10% leadership-approved cap. No policy was intentionally bypassed — a sales rep simply instructed Copilot to draft a follow-up offer, and the AI acted on that instruction without any awareness of internal discount rules. The incident was caught only because the rep still sent most emails manually, a safeguard that may not hold as AI adoption grows. The author argues that prompt guidelines and acceptable-use documents are insufficient, and that enforcement must be built into the systems where AI actions actually occur — spanning both M365 and CRM platforms. The recommended approach centers on three operational controls: manager approval for above-threshold discounts in outbound emails, logged and gated CRM field changes, and a hold on communications involving unverified contact data.