A financial-services team is deploying a multi-agent solution in Microsoft Foundry. A research agent must read SharePoint knowledge bases, while a settlement agent must call a payment API. Security requires that a compromise of the research agent must not allow access to payment credentials. Which design best enforces this Zero Trust boundary?
Select an answer to reveal the explanation.
Short Explanation
You should treat each agent like a different employee with a different badge. Give each agent its own managed identity, least-privilege RBAC, and Key Vault access only to the secrets it needs, and never share credentials. If the research agent gets compromised, it can’t open the payment vault.
Full Explanation
In multi-agent systems on Azure and Microsoft Foundry, Zero Trust requires per-agent identity scoping so a breach of one agent cannot reach another agent’s tools or secrets. The design that assigns each agent its own managed identity with least-privilege RBAC and Key Vault access policies scoped only to the secrets that agent needs is correct because the research agent’s identity can be limited to SharePoint or Microsoft Graph permissions, while payment credentials in Key Vault are exposed only to the settlement agent’s identity. That separation stops lateral movement when the research agent is compromised.
The shared user-assigned managed identity design is incorrect because it collapses the trust boundary. If every agent uses the same identity and token cache, any token obtained by the research agent can call the payment API, so compromise of the research agent becomes compromise of the settlement agent’s tools.
The single environment-variable bag design is incorrect because it is a secrets anti-pattern. Every process that can read the bag inherits every secret, including payment credentials, and environment variables are not rotated, audited, or ACL’d like Key Vault.
The Contributor role design is incorrect because granting the research agent Contributor on the resource group so it can mint temporary credentials for the settlement agent violates least privilege and creates a privilege-escalation path. Agents should never act as identity providers for peer agents.
Exam caveat: When a scenario stresses isolation between agents with different data sensitivity, look for separate managed identities and scoped Key Vault access—not shared credentials or broad Contributor roles.