Plan and manage an Azure AI solution 1.4 Implement responsible AI across generative AI and agentic systems

An agent uses a third-party MCP server with require_approval set to always for its write…

Study guide skill: Implement auditing through trace logging, provenance metadata, and approval workflows

Question B8-013

An agent uses a third-party MCP server with require_approval set to always for its write tools. Auditors want to be able to reconstruct later what each tool call did and who approved it. Which MCP best practice addresses this?

Select one answer.

  • A Treat the server's tool descriptions as trusted so that approvers don't need to review arguments
  • B Route the connection through a proxy instead of the provider's own server so that traffic is centralized
  • C Log approvals and tool calls for auditing and troubleshooting ✓ Correct answer
  • D Approve automatically whenever the requested tool is on the allowed_tools list

Answer: C

The MCP best practices include logging approvals and tool calls for auditing and troubleshooting, and reviewing all data shared with remote servers and logging it for auditing. Approvers should review the requested tool name and arguments before approving, rather than approving automatically. The guidance also prefers servers hosted by trusted providers over proxies and treats tool descriptions and results as untrusted input.

Deep dive

How it works

Approval answers "should this call run?". Auditors also need "what ran, and who said yes?" afterwards. Foundry's MCP best practices include exactly that: log approvals and tool calls for auditing and troubleshooting. With require_approval set to always, every write call already goes through an approval step, so logging both the approval decision and the call gives auditors a reconstructable record.

The rest of the MCP best-practice list is relevant to this agent too:

  • Use an allow list of tools with allowed_tools.
  • Require approval for high-risk operations, especially tools that write data or change resources.
  • Treat tool descriptions, annotations and results from remote MCP servers as untrusted input.
  • Rely on servers hosted by trusted service providers themselves rather than proxies.

For the approval itself, the documented step is to review the requested server, tool and arguments, and approve only the expected call.

The other options, and when you'd use them

  • Trust tool descriptions: The guidance says to treat tool descriptions and results from remote servers as untrusted input.
  • Route through a proxy: The guidance prefers servers hosted by trusted providers themselves rather than proxies.
  • Auto-approve tools on allowed_tools: allowed_tools is the allow list of tools, not an approval setting. With always, a developer needs to approve every call, after reviewing the requested tool and arguments.

Exam tip

Audit trail for MCP = log approvals and tool calls. Allow list = allowed_tools. Write tools = require approval. Remote server content = untrusted.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Plan and manage questions · AI-103 study guide

Thanks for your feedback!