A developer built a Copilot Studio agent that connects to enterprise data via Microsoft Graph connectors. The security team wants to ensure that the agent cannot retrieve or output content from SharePoint sites where the calling user does not have read access. Which foundational design principle ensures this?

B is correct because Microsoft Copilot Studio agents built with Microsoft Graph connectors operate under the principle of user-delegated permissions. When an authenticated user invokes the agent, the Graph API calls are made using that user's identity and their existing permissions. The agent therefore cannot retrieve SharePoint content that the user cannot access directly—it cannot bypass SharePoint permissions or access content the user is not authorized to see. A is wrong because content moderation plugins filter for inappropriate content (like profanity or harmful content), not for access control enforcement based on user permissions. C is wrong because DLP policies restrict the sharing or output of sensitive classified content; they do not enforce SharePoint access control boundaries. D is wrong because PIM manages privileged role activation for identities; it does not govern Copilot Studio agent data access permissions.