An AI agent combines a model with instructions, state, tools, and a control loop. Production agents must be bounded by authorization, tool schemas, budgets, timeouts, approval policy, observability, and durable recovery. The model can propose an action; trusted application code decides whether the action is allowed and executes it.
The loop needs maximum steps, wall-clock time, token/tool budget, and cancellation. “Continue until done” without bounds is not an enterprise control.
A tool should have one purpose, a strict input schema, server-side validation, narrow identity, timeout, idempotency key where relevant, and structured output. Prefer domain tools like create_support_draft over raw shell, SQL, or arbitrary HTTP.
Separate tools into risk classes:
Never trust model-generated parameters. Re-check tenant, object ownership, allowed ranges, and target resource in code.
Memory is data storage and must obey authorization, retention, deletion, residency, and purpose limits. Do not store a whole conversation forever because the SDK makes it easy.
Current Microsoft Foundry agent capabilities can provide model/tool integration, hosted agents, workflows, memory, tracing, evaluation, and governance. Feature names, availability, and APIs change. Build around your own identity, policy, audit, and business state so the system is not dependent on a playground configuration.
Create the same read-only test agent through the Portal or the SDK. In either method, use an approved model deployment, one narrow read-only tool, synthetic data, fixed step/token/time budgets, and a non-production project.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Open the Foundry project → Agents → Create agent. Name it northstar-readonly, select the approved model deployment, add bounded instructions, and allow only the approved read-only knowledge/tool connection. Configure current safety and tracing options, test an allowed and denied request with synthetic data, inspect the trace, then save/version it for a controlled release.
SDK/CLI options should follow the current Foundry agent quickstart. Pin API/package versions and record agent version with every trace.
The approval screen must show:
Approval is not “the agent asked are you sure in chat.” Trusted backend code must cryptographically bind approval to the exact proposed action and reject changed parameters.
Model Context Protocol can standardize discovery and invocation of tools/resources. Treat every MCP server as code with authority. Allowlist servers and tools, authenticate connections, validate outputs as untrusted data, restrict network/file access, log invocations, and isolate high-risk servers. A tool description is not a security boundary.
Use durable workflow state, idempotency keys, compensating actions, circuit breakers, and replay-safe steps. Escalate when the state is ambiguous.