Exam Bundle

In tests the agent proposes an action but no payment executes until a permitted approver confirms it. Such evidence would validate a different change: A generative agent automatically approves vendor payments based on free-form text without human approval. It follows the separate remedy Require a human confirmation checkpoint and deterministic amount verification before authorizing any payment write. The Brookside Manufacturing scenario instead reports A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The decisive observation must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

Responses summarize permitted interactions and excluded confidential records never appear in tool results. Such evidence would validate a different change: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. It follows the separate remedy Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. The Brookside Manufacturing scenario instead reports A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The decisive observation must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

A representative conversation delegates the specialized task and returns a typed result without loss of caller context. Such evidence would validate a different change: A support assistant is built as a generic Foundry agent although its workflows are tightly integrated with Copilot Studio conversations. It follows the separate remedy Choose an integration architecture connecting the Foundry agent and Copilot Studio agent with explicit responsibilities and boundaries. The Brookside Manufacturing scenario instead reports A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The decisive observation must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

Create a representative evaluation dataset with accuracy, tool-use, access-control and refusal tests plus release thresholds. This is a plausible technique for a DIFFERENT requirement: An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The Juniper Media failure described here instead concerns A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. That choice does not establish the required correction; the acceptance result must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. This is a plausible technique for a DIFFERENT requirement: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. The Juniper Media failure described here instead concerns A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. That choice does not establish the required correction; the acceptance result must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

Expose narrowly scoped Microsoft Power Platform MCP server tools with authenticated authorization per operation. This is a plausible technique for a DIFFERENT requirement: A custom Foundry agent must query customer cases through enterprise tools but its developer gives it broad direct database access. The Juniper Media failure described here instead concerns A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. That choice does not establish the required correction; the acceptance result must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

A failing agent trace identifies the specific tool and error without storing sensitive prompt contents. Such evidence would validate a different change: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. It follows the separate remedy Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. The Juniper Media scenario instead reports A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The decisive observation must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure. Such evidence would validate a different change: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. It follows the separate remedy Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. The Juniper Media scenario instead reports A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The decisive observation must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call. Such evidence would validate a different change: A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. It follows the separate remedy Enforce least-privilege authorization at the MCP tool boundary and restrict destructive operations to appropriate identities. The Juniper Media scenario instead reports A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The decisive observation must be: The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping.

Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. This is a plausible technique for a DIFFERENT requirement: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. The Highland Education failure described here instead concerns A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. That choice does not establish the required correction; the acceptance result must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. This is a plausible technique for a DIFFERENT requirement: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. The Highland Education failure described here instead concerns A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. That choice does not establish the required correction; the acceptance result must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Create a representative evaluation dataset with accuracy, tool-use, access-control and refusal tests plus release thresholds. This is a plausible technique for a DIFFERENT requirement: An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The Highland Education failure described here instead concerns A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. That choice does not establish the required correction; the acceptance result must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Regression runs expose failures before deployment and version-to-version quality changes are measurable. Such evidence would validate a different change: An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. It follows the separate remedy Create a representative evaluation dataset with accuracy, tool-use, access-control and refusal tests plus release thresholds. The Highland Education scenario instead reports A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The decisive observation must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure. Such evidence would validate a different change: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. It follows the separate remedy Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. The Highland Education scenario instead reports A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The decisive observation must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

A representative conversation delegates the specialized task and returns a typed result without loss of caller context. Such evidence would validate a different change: A support assistant is built as a generic Foundry agent although its workflows are tightly integrated with Copilot Studio conversations. It follows the separate remedy Choose an integration architecture connecting the Foundry agent and Copilot Studio agent with explicit responsibilities and boundaries. The Highland Education scenario instead reports A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The decisive observation must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Create a representative evaluation dataset with accuracy, tool-use, access-control and refusal tests plus release thresholds. This is a plausible technique for a DIFFERENT requirement: An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. The Eastshore Energy failure described here instead concerns A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. That choice does not establish the required correction; the acceptance result must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Require a human confirmation checkpoint and deterministic amount verification before authorizing any payment write. This is a plausible technique for a DIFFERENT requirement: A generative agent automatically approves vendor payments based on free-form text without human approval. The Eastshore Energy failure described here instead concerns A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. That choice does not establish the required correction; the acceptance result must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Use the supported Copilot Studio client library and its documented authentication/session methods. This is a plausible technique for a DIFFERENT requirement: A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. The Eastshore Energy failure described here instead concerns A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. That choice does not establish the required correction; the acceptance result must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Regression runs expose failures before deployment and version-to-version quality changes are measurable. Such evidence would validate a different change: An agent team declares production readiness after one demonstration without evaluating factual errors or unauthorized tool calls. It follows the separate remedy Create a representative evaluation dataset with accuracy, tool-use, access-control and refusal tests plus release thresholds. The Eastshore Energy scenario instead reports A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The decisive observation must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

The code app opens an authorized session, receives agent responses, and handles connection errors without DOM scraping. Such evidence would validate a different change: A code app consumes a Copilot Studio agent by scraping its web chat DOM and breaks after a client update. It follows the separate remedy Use the supported Copilot Studio client library and its documented authentication/session methods. The Eastshore Energy scenario instead reports A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The decisive observation must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

The agent lists only cases the calling user may view and direct database credentials are not present. Such evidence would validate a different change: A custom Foundry agent must query customer cases through enterprise tools but its developer gives it broad direct database access. It follows the separate remedy Expose narrowly scoped Microsoft Power Platform MCP server tools with authenticated authorization per operation. The Eastshore Energy scenario instead reports A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The decisive observation must be: Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call.

Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. This is a plausible technique for a DIFFERENT requirement: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. The Maplewood Schools failure described here instead concerns A generative agent automatically approves vendor payments based on free-form text without human approval. That choice does not establish the required correction; the acceptance result must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Expose narrowly scoped Microsoft Power Platform MCP server tools with authenticated authorization per operation. This is a plausible technique for a DIFFERENT requirement: A custom Foundry agent must query customer cases through enterprise tools but its developer gives it broad direct database access. The Maplewood Schools failure described here instead concerns A generative agent automatically approves vendor payments based on free-form text without human approval. That choice does not establish the required correction; the acceptance result must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. This is a plausible technique for a DIFFERENT requirement: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. The Maplewood Schools failure described here instead concerns A generative agent automatically approves vendor payments based on free-form text without human approval. That choice does not establish the required correction; the acceptance result must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Read-only users cannot invoke deletion even when the agent constructs a technically valid tool call. Such evidence would validate a different change: A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. It follows the separate remedy Enforce least-privilege authorization at the MCP tool boundary and restrict destructive operations to appropriate identities. The Maplewood Schools scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

The agent lists only cases the calling user may view and direct database credentials are not present. Such evidence would validate a different change: A custom Foundry agent must query customer cases through enterprise tools but its developer gives it broad direct database access. It follows the separate remedy Expose narrowly scoped Microsoft Power Platform MCP server tools with authenticated authorization per operation. The Maplewood Schools scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

A representative conversation delegates the specialized task and returns a typed result without loss of caller context. Such evidence would validate a different change: A support assistant is built as a generic Foundry agent although its workflows are tightly integrated with Copilot Studio conversations. It follows the separate remedy Choose an integration architecture connecting the Foundry agent and Copilot Studio agent with explicit responsibilities and boundaries. The Maplewood Schools scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Expose narrowly scoped Microsoft Power Platform MCP server tools with authenticated authorization per operation. This is a plausible technique for a DIFFERENT requirement: A custom Foundry agent must query customer cases through enterprise tools but its developer gives it broad direct database access. The Brookside Manufacturing failure described here instead concerns A generative agent automatically approves vendor payments based on free-form text without human approval. That choice does not establish the required correction; the acceptance result must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Enforce least-privilege authorization at the MCP tool boundary and restrict destructive operations to appropriate identities. This is a plausible technique for a DIFFERENT requirement: A Foundry tool can delete rows using a tenant-wide service identity even when an end user has read-only Dataverse access. The Brookside Manufacturing failure described here instead concerns A generative agent automatically approves vendor payments based on free-form text without human approval. That choice does not establish the required correction; the acceptance result must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. This is a plausible technique for a DIFFERENT requirement: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. The Brookside Manufacturing failure described here instead concerns A generative agent automatically approves vendor payments based on free-form text without human approval. That choice does not establish the required correction; the acceptance result must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

A prompt-injection test yields a safe report and no credential access or unauthorized data disclosure. Such evidence would validate a different change: A malicious external document instructs an agent to reveal Dataverse credentials while the agent is gathering a report. It follows the separate remedy Treat retrieved document text as untrusted data and restrict tools, secrets and prompt-following privileges at the execution boundary. The Brookside Manufacturing scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

A failing agent trace identifies the specific tool and error without storing sensitive prompt contents. Such evidence would validate a different change: A Foundry agent intermittently fails during a downstream MCP call but telemetry records only the final response text. It follows the separate remedy Capture sanitized tool-call traces, correlation IDs, latency and exception categories in approved monitoring. The Brookside Manufacturing scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.

Responses summarize permitted interactions and excluded confidential records never appear in tool results. Such evidence would validate a different change: An agent is asked to summarize internal service interactions using Work IQ data but its prompt includes pasted sensitive records. It follows the separate remedy Integrate the authorized Work IQ and Dataverse data access path with scoped identity rather than injecting entire datasets into prompts. The Brookside Manufacturing scenario instead reports A generative agent automatically approves vendor payments based on free-form text without human approval. The decisive observation must be: In tests the agent proposes an action but no payment executes until a permitted approver confirms it.