Plan and manage an Azure AI solution 1.4 Implement responsible AI across generative AI and agentic systems
An agent reads data from a third-party MCP server and can issue refunds through a…
Study guide skill: Govern agent behavior with oversight modes, constraints, and tool-access controls
Question B6-012
An agent reads data from a third-party MCP server and can issue refunds through a function tool. Which two practices reduce the security risk of this tool usage? (Choose two.)
Select 2 answers.
Answer: C, E
Tools send and receive data outside the model, so tool outputs should be treated as untrusted and critical values validated before acting. Structured outputs should be validated against a schema, limited to known fields and operations, and consequential actions such as refunds should need user approval. The guidance also says not to put credentials in prompts, not to log secrets in traces, and to send only the information a task needs.
Deep dive
How it works
Microsoft's tool best-practice guidance starts from one fact: tools send and receive data outside the model. A third-party MCP server can return anything, and a refund tool moves money. The guidance lists these practices:
- Treat tool outputs as untrusted input and validate critical values before acting on them. - Validate structured outputs against an expected schema, allow only known fields and operations, and require user approval before consequential actions. A refund is a consequential action.
- Don't include keys, tokens or other credentials in prompts.
- Avoid logging secrets in traces or application logs.
- Send only the information required to complete the task.
The two correct options are the first two bullets. The three wrong options each break one of the last three.
The other options, and when you'd use them
- Put the MCP API key in the agent instructions: Instructions are part of the prompt, and the guidance says not to include keys, tokens or other credentials in prompts.
- Send the full customer record with every call: The guidance is the opposite: send only the information required to complete the task.
- Log full arguments, including tokens: Avoid logging secrets in traces or application logs. Auditing doesn't need the token values.
Exam tip
Tool security in one line: outputs untrusted, validate against a schema, approval before consequential actions, no secrets in prompts or logs, minimum data.
References
Last reviewed: