A public-health GenAI app lets clinicians invoke agents but must stop them from changing foundation-model deployments. Which control applies?

Applying least-privilege RBAC so invoke rights do not include deployment changes is correct because public-health GenAI apps often let clinicians call agents while platform admins alone change foundation-model deployments. Separating application invoke permissions from deployment and project-administration permissions limits blast radius: clinicians can use the agent for care workflows without redeploying, deleting, or reconfiguring foundation models. That IAM split is core GenAIOps hygiene for municipal health.

Granting Cognitive Services OpenAI Contributor for agent invoke operations fails least privilege because that role includes deployment write rights, so clinicians could create, update, or delete foundation-model deployments instead of only invoking the agent. Configuring Azure Policy audit effect to track invoke and deployment actions is only detective, not preventive—it logs activity after the fact but does not stop clinicians from changing foundation-model deployments or enforce the invoke-versus-deploy split. Assigning Cognitive Services OpenAI User at account scope to manage deployments fails as a deployment control because that role grants only data-plane invoke/use, not deployment create, update, or delete rights, so it cannot manage deployments.

Exam caveat: invoke-versus-deploy separation is the teaching point—choose least-privilege RBAC that allows agent use without deployment rights.

Operational check: assign clinicians an invoke/use-oriented role on the health agent, confirm they cannot create or change foundation-model deployments, verify platform admins retain deployment rights, and audit a sample clinician action to ensure it maps to their identity—not a shared Owner account.