Foundry guidance shows how to enforce least-privilege access for agent tools
Microsoft published a Python implementation pattern for enforcing agent tool permissions outside the model. The guidance combines dedicated or delegated identities, narrowly scoped Azure RBAC, trusted server configuration and runtime checks.
Its invoice example accepts a business identifier while keeping storage locations and user partitions outside model-controlled arguments.
The article separates read, proposal and commit operations, requires trusted approval for consequential actions, and records authorization decisions without exposing secrets.
It also provides negative-test scenarios for wrong identities, tenants and disallowed operations. This is architecture and implementation guidance for Foundry developers, rather than a new service availability announcement.
Partner briefing
- What it is
A Microsoft Foundry implementation guide for restricted agent tool access.
- What’s changing
The example combines capability contracts, identity, scoped permissions, runtime policy and trace evidence.
- Why it matters
Prompt instructions alone do not enforce authorization; denied-action testing checks the actual boundaries.
- Who it affects
Agent developers, solution architects and security teams implementing Foundry solutions.