Ansvar AI docs
    ansvar.eu →

    Connect Copilot Studio

    Copilot Studio lets you build an agent that calls Ansvar through the gateway and publish it to Teams, web, or M365 Chat — same citation contract, M365-native UX. The connection rides Power Platform connector infrastructure at tenant level, so there are more steps than for a personal client. There are two ways to authenticate: per-user (the default — each user signs in with their own Ansvar account) and the team rollout (one shared connection, no per-user sign-in in Teams).

    Prerequisites

    • A Copilot Studio license (any tier with custom-connector permission).
    • An Ansvar account — Free is enough to evaluate, and carries one STRIDE threat-model run a month; Solo unlocks multi-source fan-out and a second run; Premium adds case law, preparatory works, and agency guidance, plus the LINDDUN and TARA families. Workflows on your own documents require Team or Company.
    • Tenant admin permission to register a custom connector — or an admin who will sign off at publish time.

    Per-user setup (default)

    Each user keeps their own tier, quota, and audit trail. Copilot Studio supports MCP Dynamic Client Registration, so there is nothing to provision on our side:

    1. Create a new agent (Copilot Studio → Create → New agent) and name it — for example, "Ansvar Compliance".
    2. From the agent's Tools tab, add an MCP connection with https://gateway.ansvar.eu/mcp as the server URL.
    3. Pick OAuth 2.0 with dynamic discovery — Copilot Studio reads the gateway's OAuth metadata and registers itself; no client ID to paste.
    4. Authorize the connection: a pop-up opens sign-in at auth.ansvar.eu, and after consent the connection shows Connected.
    5. Verify tools appear. On a Premium connection you should see the research tools (search, provision lookup, coverage) and the workflow tools (Premium runs the described-system threat-model family — STRIDE, LINDDUN, TARA — metered monthly; Free and Solo see the same tools but may start STRIDE only). Document-upload tools and the rest of the workflow catalog appear only on Team and Company subscriptions — their absence on Premium does not mean the connection failed.
    6. Give the agent instructions, then run the test questions — answer quality depends on the instructions, not just the connection.
    7. Publish from Channels to Teams, Web, or M365 Chat. Tenant-admin approval may be required by your environment policies.

    Team rollout — publish to Teams without per-user sign-in

    If the agent should run under one organisation account instead — no sign-in prompts for end users in Teams — use maker-provided credentials on a pre-provisioned OAuth client:

    Step 1 — request an OAuth client

    The shared connection needs a client ID and secret we issue for your tenant — the same model as the Gemini Enterprise and Azure AI Foundry paths. to request one, and tell us which Ansvar plan the connection should run on.

    Step 2 — add the MCP connection with manual OAuth

    In the MCP onboarding wizard, set the server URL to https://gateway.ansvar.eu/mcp, pick OAuth 2.0 as the authentication type and Manual as its mode, then enter the values we sent:

    Client ID:          <from us>
Client secret:      <from us>
Authorization URL:  https://auth.ansvar.eu/realms/ansvar/protocol/openid-connect/auth
Token URL template: https://auth.ansvar.eu/realms/ansvar/protocol/openid-connect/token
Refresh URL:        https://auth.ansvar.eu/realms/ansvar/protocol/openid-connect/token
Scopes:             openid profile email offline_access

    The token and refresh URLs are the same endpoint. offline_access is what keeps the shared connection refreshing itself after the short-lived access token expires.

    Step 3 — send us the callback URL

    After you select Create, Copilot Studio shows a callback URL (on a consent.azure-apim.net or consent.azure-apihub.net host). Send it to us and we register it on the client — sign-in fails until that URL is on the allowlist.

    Step 4 — create the connection as your service account

    Sign in with the Ansvar account the agent should run under — typically a service account on your organisation's plan, not a personal login. This one sign-in is the only OAuth prompt anyone sees.

    Step 5 — switch the tool to maker-provided credentials and publish

    In the tool's authentication settings, choose maker-provided credentials so every end user runs on the connection you just created, then publish to Teams. Users get answers immediately — no sign-in card.

    Two things to know before picking this mode. Usage, quota, and audit attribution all run under the one service account — right for evaluations and small teams, while per-user audit trails need the per-user flow above. And your Power Platform admin controls whether maker-provided credentials are allowed at all (the Control maker credential options environment setting) — if your environment restricts tools to end-user credentials, the per-user flow is the only option.

    Instruct the agent

    A connected agent without instructions answers badly, and it fails in a misleading way. Copilot passes the user's whole question, verbatim, as the search query; the gateway matches strictly (so relaxed matches are never dressed up as law) and finds nothing; the agent then answers from its own model knowledge — fluent, uncited, and usually in English. The result looks like "the connection doesn't work" or "only English works" when the real gap is four lines of instructions.

    Paste this into the agent's instructions and adapt the jurisdictions to yours:

    You are a compliance research assistant. Answer legal, regulatory,
and security-standards questions only from Ansvar tool results,
never from your own knowledge.

For every legal, regulatory, or standards question:
1. Call the search tool, always with a scope: jurisdictions=["SE"]
   (adapt to your market; add "EU" for EU regulation - GDPR, NIS2,
   the AI Act), or frameworks=["GDPR"] for one EU framework across
   the board. On the Free plan, pass exactly one jurisdiction or
   framework per call.
2. Never pass the user's whole question as the query. Reduce it to
   1-3 legal key terms in the language of the law you are searching
   - Swedish terms for Swedish law. Try alternative terms as separate
   searches. If a multi-concept query returns nothing, split it into
   one search per concept.
3. If a search returns nothing, retry once with a synonym or a
   broader term, then retry with allow_broadening=true and label
   any relaxed matches as such.
4. Cite every answer: law, article, and source URL from the
   results. If the results do not contain the answer, say which
   searches you ran and that you will not answer from memory -
   never invent a source.

    A Dutch variant for a Dutch-facing agent — shorter than the English block, carrying the core scope, query and grounding rules:

    Je bent een juridisch assistent. Beantwoord juridische vragen
uitsluitend op basis van de Ansvar-zoekresultaten, nooit uit eigen
kennis.

Bij elke juridische vraag:
1. Roep het tool search aan met jurisdictions=["NL"]. Voeg "EU" toe
   bij Europese regelgeving (AVG/GDPR, NIS2, AI Act).
2. Gebruik als query nooit de hele vraag van de gebruiker. Vertaal de
   vraag naar 1 à 3 Nederlandse juridische kerntermen - bijvoorbeeld
   "rechtsbijstand", "meldplicht datalek", "aansprakelijkheid
   verzekeraar". Probeer alternatieven in aparte zoekopdrachten.
3. Levert een zoekopdracht niets op: probeer een synoniem of een
   bredere kernterm, of herhaal de zoekopdracht met
   allow_broadening=true.
4. Vermeld bij elk antwoord de bron uit de resultaten: wet, artikel en
   URL. Staat het antwoord niet in de zoekresultaten, zeg dat dan
   expliciet - verzin nooit een bron.

    The instructions encode three rules. Scope: the gateway never guesses — search requires a jurisdiction or framework scope on every call. Keyword queries in the corpus language: the corpora are full-text indexes of the law as published — Dutch statutes index Dutch terms, so a whole English sentence matches nothing. Grounding: cite the returned source, or say the answer was not found. When a search finds no strict match, the response says so and names how many relaxed matches were withheld — but Copilot's orchestrator follows your instructions, not hints inside tool responses, so the retry rule has to live in the instructions.

    Test the connection

    Ask questions whose answers must come from the corpus, and check that the answer carries citations:

    • "Using Ansvar: what does Article 5(1)(c) GDPR say about data minimisation? Cite the source." — should return the article text with an EUR-Lex reference.
    • "Using Ansvar: welke regels gelden voor rechtsbijstandverzekeraars in Nederland?" — a well-instructed agent searches rechtsbijstand with NL scope and returns Wft conduct rules plus Hoge Raad case law.

    To confirm which plan the connection runs on, ask the agent to call get_my_capabilities and show the result — it reports the tier, limits, and remaining quota. On Premium and above, case law and preparatory works arrive inside ordinary search responses (court decisions cite ECLI identifiers and link to the court's own site); those rows are the premium layer working.

    Troubleshooting

    OAuth auto-discovery fails

    Copilot Studio looks for OAuth discovery metadata at the server URL you enter — the gateway serves it directly, so auto-discovery works out of the box. If it fails, the URL is almost always the problem: check you entered https://gateway.ansvar.eu/mcp exactly, with no extra path segments.

    Token refresh under tenant restrictions

    Conditional Access policies that block third-party OAuth apps will silently fail token refresh on the connection. If your agent suddenly returns 401 errors mid-session, ask your IdP admin to allowlist auth.ansvar.eu.

    Tenant-admin OAuth versus user-level OAuth

    Some tenants disallow per-user OAuth grants for custom connectors. In that case the publish flow surfaces a "requires admin approval" prompt; the admin must complete the OAuth flow themselves to authorise the connector at tenant scope.

    "Invalid parameter: redirect_uri" at sign-in

    The connector is sending a callback URL we have not registered. This appears on first setup before the callback exchange (step 3 above), and again whenever the connector is renamed, recreated, or imported into another environment — each of those produces a new callback URL. Copy the exact URL from the connector's Security tab (or from the redirect_uri parameter in the browser's address bar on the error page) and send it to us. Keep the client ID and secret you have — they are not the problem.

    Searches return nothing, or only one language "works"

    Almost always missing agent instructions: the agent is passing whole sentences as search queries, and answering from its own knowledge when the corpus returns nothing. Add the instructions above; the test questions should then return cited answers in both languages.

    "Premium doesn't seem enabled"

    Ask the agent to call get_my_capabilities — it reports the tier the connection actually runs on. Two things are commonly misread: document-upload tools and document-grounded workflow types are Team and Company features, so their absence on a Premium connection is expected (the workflow tools themselves are on every tier — what Premium adds is the LINDDUN and TARA families, the rendered exports, and a 5-run monthly allowance); and premium content does not arrive as extra tools — case law and preparatory works appear inside ordinary search results (look for ECLI-cited court decisions).