Specify an agent: persona, scope, boundary, autonomy

The syllabus asks you to "specify agent personas, scopes, boundaries, autonomy
levels, and behavioral guidelines". Four of those are easy to write down and one of
them is the whole security model, so it is worth being clear about which does what.

The four

Persona is who the agent acts as and in what voice. It sets tone. It sets
nothing else — a persona cannot prevent anything.

Scope is what the agent is for, and, said explicitly, what it is not for. The
second half is usually missing and usually the useful half.

Boundary is what the agent may reach. And this one is not written in the prompt
at all — it is enforced by tools and identity.

Autonomy level is what the agent may do unattended, and where a human has to
approve.

The rule the whole exam leans on

Constrain tools, not instructions.

Or, said more precisely: the model decides what to do; the framework decides
what is allowed to happen.

The test for whether something belongs in the prompt or in the architecture is
simple. If the model ignoring it causes harm, it needs a mechanism — not a
sentence.

"Please do not send external emails without approval" is a sentence. Removing the
send-email tool, or routing it through an approval gate, is a mechanism. The first
works most of the time, which is the problem: it works well enough to feel like a
control, and fails exactly when someone is trying to make it fail.

Behavioural guidelines still matter

None of that makes prompts useless. Defensive guidelines genuinely lower the
success rate of known attacks, and clear behavioural instructions make an agent
more predictable and more useful in the ninety-nine per cent of cases where nobody
is attacking anything.

The distinction is what you rely on them for. Use instructions to shape ordinary
behaviour. Use structure for anything where being wrong is expensive.

The agent types worth recognising

Agent Framework names its direct agent types, and they are worth knowing because
one of them tells you something about the platform's posture:

FoundryAgent — a Foundry-hosted agent.
A2AAgent — another team's agent, reached over A2A.
GitHubCopilotAgent
ClaudeAgent

That last one is not a typo. Non-Microsoft agents are first-class citizens in
Microsoft's own framework. If a question implies you must stay inside one vendor's
model family to use Agent Framework, that is not how it is built.

The trap

An option that begins "instruct the agent never to…" against a requirement that
says must never is the single most common distractor in this exam.

It reads as reasonable. It is the kind of thing a careful person would write. And
it is a heuristic control offered in answer to an absolute requirement — which
means the correct answer is somewhere in tools, identity, or an approval gate,
every time.