Security — an agent is an access amplifier

The security card, and it opens with a sentence that governs the whole area.

An agent is an access amplifier, not an access boundary

It surfaces what someone could already reach — instantly, and by asking. It does
not grant new access; it removes the friction that was doing the protecting.

So permissions get fixed before rollout, not after. Obscurity stops protecting
you on launch day, and everything that was technically reachable becomes actually
reachable that morning.

Acting identity — the highest-value control

Two options, and the difference is large.

User context means the agent inherits that user's entitlement. What they can
see, it can see, and no more.

Service identity means it bypasses user entitlement entirely. Whatever the
service account can reach, any user of the agent can effectively reach through it.

Choose deliberately and document why. This is the single control with the most
leverage on this card.

Access controls to design

On grounding data — who may read what.
On model tuning — who may change behaviour.
On connections — what the agent may reach at all.

Data residency has three questions, not one

Where is it stored. The easy one, and the only one most answers cover.

Where is it processed. Inference may not run where storage sits.

Where does it go at the moment of use. Connectors, MCP and web grounding are
live egress. And regional is not national — an EU boundary is not a UK one, which
matters a great deal if your obligations are national.

Audit trails must cover four things

Actions — what the agent did, and on whose behalf.
Changes to agents — definition, instructions, topics, actions.
Changes to content and models — because both change behaviour silently.
Changes to permissions — who widened what the agent can reach, and when.

That last one is the one most often missing, and it is the one that explains how
an agent came to see something it should not.

Exam trap. Residency answers that only address storage are incomplete. The
exposure people miss is egress at the moment of use — a connector, an MCP server
or web grounding sending prompt-derived data outside the boundary while the data
at rest never moves.

The one line to carry: the data can sit still and still leave, so ask where it
goes at the moment of use rather than only where it lives.

Goes with: card 42, which names the four Microsoft control planes that put
this principle into practice — Entra Agent ID, Agent 365, Purview and Defender.