Apply zero trust to a Microsoft Foundry multi-agent workflow

Why it matters

Every agent handoff is an authorization decision; an agent that may call any agent or see any field widens what one compromise reaches.

What to practise

Implement tenant matching beside a supplied call-graph policy in which only the orchestrator may call the security scanner and compliance agent, and in which the compliance agent receives metadata but no source code. Review how the code selects managed identity, on-behalf-of, OAuth 2.0 with PKCE, or a Key Vault fallback per operation. Check that Foundry and Cosmos DB disable local auth and that the two Cosmos DB role assignments stop at container scope. Then run the three agents and confirm in Foundry traces that each input holds only the fields it needs and that the mismatched tenant never reaches an agent.

How it fits

Container-scoped roles and the agent identity separate from the project’s managed identity are 4.1.1. The call allowlist is 4.1.3, and the flow selection is 4.1.4. The exercise records public network access as residual sandbox trust, which 4.1.2’s private networking closes.