In the group-travel team of Nordlicht Reisen GmbH, the planer reads requests from strangers, the unterkunft reads replies from suppliers, and the texter writes what a customer sees. M-12 lists ten malicious cases with hidden instructions in attachments and supplier replies. Suppose one of them succeeds: An agent follows a stranger's instruction. The question of this lesson is not how to prevent that (guardrails do that, lesson 4.4), but what that agent can do at all and how far the damage spreads.
Prior knowledge. Keyless sign-in, the Foundry roles (Foundry User, Foundry Agent Consumer) and the sign-in types for tool connections: "AI-103, lesson 1.4". Rights per tool in two levels and read, write, act outward: "AI track, lesson T8.3". Managed identity and least privilege: "K3, lessons 3.3.1 and 3.3.5". Hard rules in code: "AI track, lesson T6.4". None of that is repeated. New is the view of a team: one identity per role, paths from agent to agent and the mapping of threats to controls.
New in this lesson. (1) The tools of the MCP servers (M-04), as far as this lesson needs them: buchungen: buchung_lesen (from AI-103); lieferanten: verfuegbarkeit_lesen (A0) and vorreservieren (A2, M-05); rechner: preis_berechnen (A0). (2) Every agent role gets its own identity, the orchestrator app-gruppenreisen its managed identity (M-10); the two are different things. (3) The permission matrix is data in the repository with tests (below).
The requirement
All numbers are assumptions of the task.
| No. | Requirement | Type | Measure | Weight | Source |
|---|---|---|---|---|---|
| 1.5-01 | Every role has its own identity; none is shared. | R | 7 roles, 7 identities | Must | Security |
| 1.5-02 | A role calls only tools in its matrix. | R | 0 calls outside the matrix in the test | Must | Security |
| 1.5-03 | No agent has A3; A2 only with approval (M-05). | R | 0 hits in the check of the matrix | Must | Business unit |
| 1.5-04 | A compromised agent reaches no data of another customer (M-07). | R | 0 hits in the test set | Must | Data protection |
| 1.5-05 | Every call can be attributed to an identity. | F | 100 % of calls in the log or trace | Should | Auditors |
Cost frame. By our reading, identities and role assignments cost nothing in themselves; costs arise at the services behind them (Application Insights for traces, logs from Entra). Prices: the pricing pages of the services.