/flowstudio-power-automate-governance

name: flowstudio-power-automate-governance
description: >-
  Govern Power Automate flows and Power Apps at scale using the FlowStudio MCP
  cached store. Classify flows by business impact, detect orphaned resources,
  audit connector usage, enforce compliance standards, manage notification rules,
  and compute governance scores — all without Dataverse or the CoE Starter Kit.
  Load this skill when asked to: tag or classify flows, set business impact,
  assign ownership, detect orphans, audit connectors, check compliance, compute
  archive scores, manage notification rules, run a governance review, generate
  a compliance report, offboard a maker, or any task that involves writing
  governance metadata to flows. Requires a FlowStudio for Teams or MCP Pro+
  subscription — see https://mcp.flowstudio.app

Power Automate Governance with FlowStudio MCP

Classify, tag, and govern Power Automate flows at scale through the FlowStudio MCP **cached store** — without Dataverse, without the CoE Starter Kit, and without the Power Automate portal.

This skill uses the same `store_*` tool family as `flowstudio-power-automate-monitoring`, but with a different *intent*: governance writes metadata (`update_store_flow`) and reads for *audit and classification* outcomes. Monitoring reads the same tools for *operational health* outcomes. Don't try to memorize which skill "owns" which tool — pick by what the user is doing. For health checks and failure-rate dashboards, load `flowstudio-power-automate-monitoring` instead.

> **⚠️ Pro+ subscription required.** This skill calls `store_*` tools that > only work for FlowStudio for Teams or MCP Pro+ subscribers. > > **If the user does not have Pro+ access:** the first `store_*` tool call > will return a 403/404 error. When that happens: > 1. STOP calling store tools > 2. Tell the user governance features require a Pro+ subscription > 3. Link them to https://mcp.flowstudio.app/pricing > > **Discovery:** load tool schemas via the meta-tools rather than `tools/list` — > call `tool_search` with `query: "skill:governance"` for the canonical bundle, > or `query: "select:update_store_flow"` for a single tool. This skill covers > workflow patterns and field semantics — things `tool_search` cannot tell you. > If this document disagrees with a real API response, the API wins.

---

Critical: How to Extract Flow IDs

`list_store_flows` returns `id` in format `<environmentId>.<flowId>`. **You must split on the first `.`** to get `environmentName` and `flowName` for all other tools:

id = "Default-<envGuid>.<flowGuid>"
environmentName = "Default-<envGuid>"    (everything before first ".")
flowName = "<flowGuid>"                  (everything after first ".")

Also: skip entries that have no `displayName` or have `state=Deleted` — these are sparse records or flows that no longer exist in Power Automate. If a deleted flow has `monitor=true`, suggest disabling monitoring (`update_store_flow` with `monitor=false`) to free up a monitoring slot (standard plan includes 20).

---

The Write Tool: `update_store_flow`

`update_store_flow` writes governance metadata to the **FlowStudio cache only** — it does NOT modify the flow in Power Automate. These fields are not visible via `get_live_flow` or the PA portal. They exist only in the FlowStudio store and are used by FlowStudio's scanning pipeline and notification rules.

This means:

• `ownerTeam` / `supportEmail` — sets who FlowStudio considers the

governance contact. Does NOT change the actual PA flow owner.

• `rule_notify_email` — sets who receives FlowStudio failure/missing-run

notifications. Does NOT change Microsoft's built-in flow failure alerts.

• `monitor` / `critical` / `businessImpact` — FlowStudio classification

only. Power Automate has no equivalent fields.

Merge semantics — only fields you provide are updated. Returns the full updated record (same shape as `get_store_flow`).

Required parameters: `environmentName`, `flowName`. All other fields optional.

Settable Fields

| Field | Type | Purpose | |---|---|---| | `monitor` | bool | Enable run-level scanning (standard plan: 20 flows included) | | `rule_notify_onfail` | bool | Send email notification on any failed run | | `rule_notify_onmissingdays` | number | Send notification when flow hasn't run in N days (0 = disabled) | | `rule_notify_email` | string | Comma-separated notification recipients | | `description` | string | What the flow does | | `tags` | string | Classification tags (also auto-extracted from description `#hashtags`) | | `businessImpact` | string | Low / Medium / High / Critical | | `businessJustification` | string | Why the flow exists, what process it automates | | `businessValue` | string | Business value statement | | `ownerTeam` | string | Accountable team | | `ownerBusinessUnit` | string | Business unit | | `supportGroup` | string | Support escalation group | | `supportEmail` | string | Support contact email | | `critical` | bool | Designate as business-critical | | `tier` | string | Standard or Premium | | `security` | string | Security classification or notes |

> **Caution with `security`:** The `security` field on `get_store_flow` > contains structured JSON (e.g. `{"triggerRequestAuthenticationType":"All"}`). > Writing a plain string like `"reviewed"` will overwrite this. To mark a > flow as security-reviewed, use `tags` instead.

---

Governance Workflows

1. Compliance Detail Review

Identify flows missing required governance metadata.

1. Ask the user which compliance fields they require
2. list_store_flows
3. For each active flow: split id, call get_store_flow, check required fields
4. Report non-compliant flows with missing fields listed
5. For updates: ask for values, then update_store_flow(...provided fields)

Common compliance fields: `description`, `businessImpact`, `businessJustification`, `ownerTeam`, `supportEmail`, `monitor`, `rule_notify_onfail`, `critical`. Ask for the user's policy bef