In a hub-and-spoke multi-agent design, the research subagent only n…

Question

In a hub-and-spoke multi-agent design, the research subagent only needs read access to a knowledge index, while the payment subagent needs to initiate refunds. Security requires preventing lateral movement if the research agent is compromised. What identity design should you apply?

Accepted Answer

Give each agent its own identity with least-privilege RBAC and tool permissions scoped only to required resources; deny the research agent any refund or payment APIs. — Correct answer: C. Per-agent identity with least-privilege RBAC stops lateral movement. Research gets index read only; payment alone can call refund APIs. Shared Contributor (A) or shared dbowner strings (B) mean one compromise owns everything. Turning off RBAC (D) is indefensible. Map tools to identities the same way you map network paths—default deny.

Answer

Assign both agents the same broad Contributor role on the entire resource group.

Answer

Use one shared connection string with full database dbowner rights for every agent.

Answer

Disable Azure RBAC and rely on security through obscurity of agent names.

In a hub-and-spoke multi-agent design, the research subagent only needs read access to a knowledge index, while the payment subagent needs to initiate refunds. Security requires preventing lateral movement if the research agent is compromised. What identity design should you apply?

Short Explanation

Full Explanation