A school district is designing an agent that can call student information system APIs. Which architecture control is most appropriate?

School-district agents that call student information system APIs inherit the blast radius of whatever credentials and operations those connectors allow. The most appropriate architecture control is least-privilege connectors scoped only to the specific SIS operations the agent needs—read the fields required for the task, deny broad write/delete/admin capabilities, and keep secrets off the client. Least privilege limits damage from prompt injection, agent loops, or stolen connector credentials affecting student records.

Assigning the agent a shared SIS integration role limited to attendance and gradebook read operations fails because it grants standing shared access broader than the specific operations required, and unused shared privilege becomes attacker privilege when the agent is abused. Configuring the agent with long-lived SIS refresh tokens to maintain continuous gradebook synchronization fails by exposing persistent credentials to theft and reuse across cases instead of binding each call to a short-lived, scoped credential. Routing SIS requests through a central logging gateway that retains full payloads for compliance review fails as the primary control because logging only detects misuse after the fact and retaining full payloads over-collects sensitive student data; agents are untrusted automation and need preventive least-privilege authorization, not just logging.

Exam caveat: Agentic civic architectures are scored on least-privilege tool connectors; shared integration roles, long-lived refresh tokens, and logging-gateway-only routing are classic anti-patterns.

Operational check: Issue short-lived, scoped service credentials for only required SIS operations, mediate calls server-side, log agent tool use, and never configure the agent with long-lived SIS refresh tokens to maintain continuous gradebook synchronization.