Six months after deploying a Copilot agent, the underlying model is upgraded by GitHub, two new tool integrations are added, and the agent's task scope is expanded to include writing release notes. The security team has not performed a review since the initial deployment. At which point in this lifecycle should a security review have been triggered?
Select an answer to reveal the explanation.
Short Explanation
An agent's security profile isn't just its code—it's the model, the tools, and the scope of what it can affect. You should trigger a review at each significant change: the model upgrade, each new tool integration, and the scope expansion. Think of it like re-certifying a pilot every time they switch aircraft type, add new avionics, or fly new routes.
Full Explanation
Agent lifecycle security reviews should be event-driven, not just time-based. Each of the following events in the scenario represents a meaningful change to the agent's security attack surface:
1. Model upgrade: The new model version may have different capability levels, respond differently to adversarial inputs, have updated tool-use behavior, or interpret instructions differently. The security properties of the previous model may not carry over.
2. New tool integrations (two): Each new tool expands what the agent can do if compromised or manipulated. Each tool integration requires its own threat model: What can this tool read? Write? Delete? What happens if it receives a malicious response?
3. Scope expansion (release notes): The agent now has access to additional context (release information) and creates content that goes into product communications. This introduces new risks around information leakage and content manipulation.
The view that reviews are needed only when the agent's code changes is incorrect because the threat model encompasses the model, tools, and scope—not just the agent's source code. The view that reviews should occur on a fixed annual schedule regardless of changes is better than nothing, but event-driven reviews catch issues as they are introduced rather than months later. The view that reviews should occur only when a security incident occurs, using the incident as evidence to justify the review effort, is reactive rather than proactive—by the time an incident occurs, the damage is already done. Responsible AI lifecycle management requires reviews at change events.