Plan and manage an Azure AI solution 1.4 Implement responsible AI across generative AI and agentic systems
An agent connects to a remote MCP server that exposes 25 tools, several of which write…
Study guide skill: Govern agent behavior with oversight modes, constraints, and tool-access controls
Question B1-011
An agent connects to a remote MCP server that exposes 25 tools, several of which write data. You want the agent to use only three read tools plus one write tool, and a human must approve every tool call. Which two settings should you configure? (Choose two.)
Select 2 answers.
Answer: C, E
The MCP tool guidance recommends allow-listing tools with allowed_tools and requiring approval for high-risk operations, and require_approval = always makes the run pause for an approval response before any tool runs. Temperature, content filters and custom headers don't control which tools the agent may call.
Deep dive
How it works
The MCP tool connects a Foundry agent to a remote Model Context Protocol server, so the agent's model can use tools hosted by others. Two settings on the tool control what the agent can do:
- allowed_tools is an optional list of the tools this agent can access and use. If you leave it out, the agent gets every tool on the server, so for a 25-tool server you'd list just the four you want.
- require_approval decides whether a developer must approve calls. Its default is always, meaning every call needs approval. You can also set never, or give a list of tool names that do or don't need approval.
When approval is required and the model tries to call a tool, the response contains an mcp_approval_request item showing the server, tool and arguments. Your app reviews it and sends back an mcp_approval_response with approve set to true or false to continue the run.
The docs' best practices line up with the question: allow-list tools with allowed_tools, require approval for high-risk operations (especially tools that write data or change resources), and treat tool descriptions and results from remote servers as untrusted input, since they can contain indirect prompt injection.
The other options, and when you'd use them
- A custom header listing blocked tools: The MCP tool lets you pass custom headers, such as authentication keys or schemas, that a remote server might need. Tool access is controlled by
allowed_tools, not by a header. - A content filter with violence set to low: Content filters act on harmful content in prompts and completions across hate, sexual, violence and self-harm. They don't choose which tools an agent may call.
- A higher temperature: Higher temperature makes output more random. It isn't an access control.
Exam tip
"Limit which tools" means allowed_tools. "A human must approve" means require_approval set to always, which is also the default.
References
Last reviewed: