A multi-agent system previously used one shared service principal for the orchestrator and all specialist agents to call Azure resources and tools. A security assessment flags lateral movement risk if any agent is compromised. What should you implement?
Select an answer to reveal the explanation.
Short Explanation
D is Zero Trust for multi-agent systems. Per-agent identity scoping limits blast radius; least-privilege RBAC and network boundaries reduce lateral movement. Shared super-identities and Owner rights are the opposite of the assessment’s goal. Tokens baked into images leak and do not rotate well. Disabling auth increases risk. Design each agent’s identity and access control policies explicitly.
Full Explanation
Correct Answer — D
Security design includes identity-based access, network boundaries, access control policies, and RBAC. Zero Trust multi-agent guidance emphasizes per-agent identity scoping and lateral movement prevention. Separate managed identities with minimal RBAC per agent, enforced at tools and network edges, meet that bar.
Why A is wrong: Shared Owner vastly increases blast radius and violates least privilege.
Why B is wrong: Long-lived tokens in images are secret-sprawl and hard to rotate.
Why C is wrong: Removing authentication removes a core control.
Exam tip: One identity per agent + least-privilege RBAC + boundary enforcement.