A regulated healthcare provider is deploying a multi-agent clinical documentation system on Azure. Security architects mandate Zero Trust for agentic systems: each agent must have its own identity, tool access must be least privilege, and a compromised summarization agent must not be able to move laterally into the e-prescribing tool path. Which design best meets these requirements?
Select an answer to reveal the explanation.
Short Explanation
Zero Trust for multi-agent means per-agent identity and least privilege — not one super identity. Option A gives each agent its own managed identity or app registration, scopes RBAC/tools tightly, and walls off e-prescribing so a hijacked summarizer cannot call it. Shared Owner principal (B) is lateral-movement fuel. Static keys in images (C) fail rotation and attribution. VNets alone (D) do not stop an authorized-looking agent identity from abusing tools it should never have.
Full Explanation
AI-500 Zero Trust multi-agent guidance emphasizes per-agent identity scoping, lateral movement prevention, and compliance control mapping. Option A implements distinct identities, least-privilege tool scopes, and isolation between high-risk capabilities.
Option B violates least privilege and creates a single blast radius across every agent and tool.
Option C lacks individual accountability, complicates rotation, and is incompatible with modern Azure identity practices for production agents.
Option D is incomplete: network controls are necessary but insufficient. Without identity boundaries, any agent process inside the VNet that can reach a tool endpoint may invoke it.
Exam tip: Pair private networking with per-agent Entra identities and tool-level authorization for Zero Trust agent systems.