A multi-agent claims workflow in Microsoft Foundry uses a Planner agent that decides which tools Specialist agents may call. Security review finds that carefully crafted user messages can persuade the Planner to authorize write tools outside the claim’s allowed systems. You must harden prompt design without removing legitimate tool use. What should you implement first?
Select an answer to reveal the explanation.
Short Explanation
The answer is A. When a Planner decides tools for specialists, attackers will try jailbreaks and tool-scope smuggling through user text. Your first line of defense in the develop phase is prompt-layer policy: put hard allowlists and refusal language in the system prompt, inject the claim-specific policy into context so the model knows what is in bounds for this run, and—critically—validate the Planner’s tool-selection output against that allowlist in code before anything executes. Temperature tricks make abuse worse, not better. User education is not a control. Turning off tools entirely breaks the multi-agent design. Defensive guidelines plus dynamic context plus programmatic gatekeeping is the Foundry-aligned pattern.
Full Explanation
Correct Answer — A
Advanced prompt engineering for multi-agent solutions combines defensive guidelines, dynamic context injection, and lifecycle control of prompts. For a Planner that authorizes tools, you encode allowlisted scopes and refusal rules in the system prompt, inject per-claim policy as dynamic context, and enforce the allowlist in middleware or orchestration code before tool execution. That pairing of prompt policy and deterministic validation is how you harden against tool abuse without removing legitimate function calling.
Why B is wrong: Higher temperature increases variability and can worsen policy-following; it is not a security control.
Why C is wrong: User education does not prevent adversarial or accidental prompt injection through legitimate channels.
Why D is wrong: Disabling tools destroys the value of specialist agents that must act on external systems; the exam expects scoped tool use, not removal.
Exam tip: Defensive prompt design + dynamic policy context + pre-execution tool allowlist validation.