A program manager is deploying a Copilot agent that drafts vendor emails and updates procurement issues, but it must never expose API keys, email external vendors alone, or edit finance records. Which guardrail configuration should the manager implement to enforce safe agent boundaries?

Limiting file and tool scope, blocking secret access, and requiring human approval for external sends creates layered boundaries that address each prohibition. Scope keeps the agent within procurement issues and authorized drafting actions; blocking secret access prevents API keys from being exposed through retrieval or summarization; and approval ensures no vendor email is sent autonomously. Allowing masked secret retrieval fails because masking is not isolation: retrievable secret material may still leak through prompts, logs, or transformations, so it does not meet the no-exposure requirement. Enabling auto-send for approved vendor templates fails because approving message content is not the same as approving the external action; the agent could still email a vendor without human review of that send. Granting scoped write access to finance lists fails because even scoped access gives the agent permission to edit finance records, expanding its authority beyond procurement. An exam caveat is that masking, template approval, or audit logging may look like safeguards, but they do not replace blocking secret access or requiring approval for each external send. As a practical check, test in a tenant by trying to retrieve a secret, initiate an external send, and edit a finance record; confirm access is denied, approval is required, and the finance edit is blocked.