An agent must read the signed-in user’s calendar and create events only as that user—not as a shared daemon with access to every mailbox. Which authentication approach is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Answer A. Multi-agent auth flows include user impersonation, on-behalf-of, API keys, and OAuth 2.0. For user-scoped calendar actions, use delegated OBO-style flows so tokens carry the user’s permissions. Tenant-wide app permissions overreach. Shared passwords in git and anonymous access fail security basics.
Full Explanation
Correct answer: A. Design authentication flows for multi-agent solutions carefully: when the business action is user-contextual, prefer OAuth 2.0 delegated/OBO patterns so Graph (or other APIs) authorize as the user. Manage token acquisition in secure middleware, not in free-form prompts.
B is incorrect for this requirement: application permissions to all mailboxes violate least privilege and the “as that user” constraint.
C is incorrect: credential stuffing into git is a critical secret-management failure.
D is incorrect: anonymous access is not acceptable for personal calendar data.
Document which agents use delegated vs application permissions and why.