AI-500 Exam Dumps - Designing and Implementing Multi-Agent AI Solutions

The malicious text is contained in an uploaded email rather than being typed directly as the user ' s prompt. Microsoft classifies malicious instructions embedded in external or retrieved content as an indirect prompt-injection attack. Prompt Shields for documents is designed to detect those attacks in document content before the content can steer the model away from its system instructions. Prompt Shields for user prompts addresses direct attacks originating in the user ' s prompt and therefore targets the wrong attack surface here. Groundedness evaluates whether a response is supported by context; it does not prevent an injected instruction from changing agent behavior. Task Adherence can assess whether an agent follows its task constraints, but it is not the primary control for document-borne prompt injection. Because the source of the attack is the uploaded email, the document-oriented Prompt Shields control is the technically aligned guardrail. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Foundry guardrails - intervention points and indirect attacks

============================================================

Log the start/completion of each specialist run and inspect the final output with Agent run middleware; record each customer-refund-tool call, including function name and arguments, with Function calling middleware.

The two logging requirements occur at different lifecycle boundaries. Agent run middleware surrounds an agent invocation, so it is the appropriate place to capture run start, run completion, exceptions, and the final agent result. Function calling middleware surrounds tool/function execution and can inspect the selected function, arguments, result, and failures. That makes it the correct boundary for an audit record of each customer-refund-tool invocation. Foundry tracing can provide broader distributed observability, but the question asks for reusable Microsoft Agent Framework middleware at the exact execution points. A knowledge store or memory store does not provide execution interception. Separating the two concerns also supports a cleaner audit model: agent-level middleware records specialist behavior, while function-level middleware records tool use. This aligns with Microsoft ' s middleware model, where cross-cutting concerns such as logging, validation, and exception handling can be implemented once and applied consistently rather than duplicated inside every agent or tool.

Official Microsoft reference: Microsoft Agent Framework - Defining middleware

============================================================

The business rule requires human review for refunds above the stated threshold before payment can continue. A workflow therefore needs a user or operator interaction point that pauses progress and obtains an explicit response. In the workflow options provided, Ask a question is the node that introduces that human interaction. Invoke agent simply delegates work to another agent; it does not itself guarantee human approval. Deliver a message sends information without collecting a decision, and Go to changes control flow without obtaining authorization. Microsoft Agent Framework and Foundry workflow guidance treat human-in-the-loop approval as a first-class orchestration requirement for consequential actions. The decisive requirement is not just to notify a reviewer, but to stop automated progression until the reviewer supplies a decision. Therefore the workflow must include an interactive question/approval step before the refund-processing action can proceed for amounts over the threshold. The implementation should also preserve clear inputs and outputs around this step so that later agents receive only the information they require. This improves debuggability and keeps token, permission, and state growth under control as the workflow becomes more complex.

Official Microsoft reference: Microsoft Agent Framework - Human-in-the-loop workflows

============================================================