Chapter 1 of 6
Session scope#
What we will do#
Objective. Configure one MCP read path for get_policy. APIM validates the candidate Foundry agent, checks the input, and calls the backend with its own read-only managed identity. Application Insights keeps tool and correlation metadata without payloads.
The stable endpoint stays on the prior governed agent version until the release owner observes an approved read and a blocked prohibited write.
Why it matters#
Problem. A model can refuse to call a write tool, but that refusal is not a security boundary. Prompt injection or a bug can still make the agent try.
Solution. This session removes the write tool from what the agent can request and gives APIM's backend identity read-only access, so the boundary holds even when the model's judgment fails.
Boundaries#
This session adds policy-catalog-mcp to the existing APIM AI gateway guide APIM service and creates an unpinned candidate in the existing Governed agent baseline guide Foundry project. APIM owns the live MCP policy and outbound identity, Foundry owns the candidate binding and stable version selector, and Application Insights holds payload-free telemetry. API Center and MCP inventory guide holds the separate design-time inventory entry.
The backend call is application-only: APIM never forwards the inbound MCP token to the backend. Delegated user access, write tools, backing-API changes, production release, MCP resources or prompts, APIM workspaces, and payload logging all need separate approval.
Session preparation
Who should join
- API platform and Microsoft Foundry engineers
- Identity and security engineers
- The release owner for agent tool access
What you need
- An approved nonproduction MCP foundation is in place: a pinned Foundry policy assistant, an APIM-managed GET operation over synthetic policy records with no side effects, the private network paths required by the approved topology, and an API Center metadata update process. The gateway owner checks that GET returns approved fields without changing state; the platform, network, and inventory owners confirm the remaining resources and configurations. (Sessions 02, 04, 06, and 07.)
- Use a supported API Management tier, not a workspace. The approved APIM service must have a system-assigned identity and an Application Insights logger with request and response body logging set to zero bytes.
- Give the deployment operator a time-bound Contributor role assignment on the exact resource group that contains the approved APIM service.
- Give the agent operator Foundry User on the exact Foundry project.
- Approve an Entra application audience and app role for the Foundry agent-to-APIM call.
- Assign the approved backend role definition ID to the API Management system-assigned identity at the exact backend resource scope. The role must contain only the read Actions or DataActions required by get_policy. Preflight rejects wildcard, write, delete, and action permissions.
- Record the release owner, data owner, security owner, prohibited write action, and API Center metadata update process.