Pass Your Microsoft AI-901 Exam Easy!

The model can propose updateOrder, but a proposed tool call is not evidence that inventory or order records changed. Showing success before the response is deceptive.

A global administrator identity bypasses record ownership and least privilege. The application must bind the authenticated user’s allowed operations to the tool request.

A string-format check can identify malformed IDs but cannot establish that the user owns or may edit the referenced order. Record authorization must happen at the business service.

Development credentials can be scoped differently and should not be reused broadly for production. Shared identities undermine least privilege and audit attribution even if the two deployments use similar model names.

Choosing an arbitrary available model on startup makes behavior, cost and compliance nondeterministic. An approved environment binding must identify the intended revision and deployment.

A model may read an alias in instructions, but prompt text cannot route the SDK request to another resource. Environment-specific endpoint, identity and deployed model settings must change in actual client configuration.

Writing a generated refundAmount before validation could create an incorrect financial transaction. Complaints after the fact are not an acceptable deterministic approval control.

Curly braces do not establish complete JSON syntax, valid currency amounts or a permissible status. Parse and validate the full object instead of trusting appearance.

A language model’s assertion that an object looks right is not a schema validator or authorization decision. The receiving service needs enforceable typed checks.

Individual backoff may reduce a single caller’s load but does not preserve fairness or place in line across simultaneous clients. No shared queue or truthful pending state is maintained.

Transport success is not a completed model answer. Without a tracked queued operation or explicit unavailability state, users may believe a request was processed when it was not.

A longer internal timeout does not satisfy the visible deadline; without a queue identity or pending response, the customer cannot tell whether work is progressing or lost.

Masking names alone does not remove diagnoses, dates or other identifying clinical details. Keep minimal authorized diagnostics and set access and retention limits.

At-rest encryption does not control every authorized reader, sharing path or retention period. Medical details should be minimized even when encrypted storage is used.

Granting all developers raw transcript visibility broadens the audience for protected records and increases accidental disclosure risk. Debug access needs a defined purpose and authorization.

A system prompt cannot undo data already mixed into one shared thread. Other customers’ records may still appear in model context or traces despite a verbal instruction to hide them.

A variable name has no effect on who owns the referenced conversation object. Security boundaries depend on effective IDs, access policies and isolation, not descriptive wording.

Allowing more tokens makes the shared-history leak worse by preserving additional unrelated customer data. Context size cannot replace tenant/session separation.

Local cached tokens belong to a developer identity and cannot establish a durable, least-privilege runtime authorization model. The hosted identity must have its own approved resource roles.

Copying personal tokens to hosted source creates secret exposure and ties production reliability to an individual account. Use workload-scoped identity with auditable least privilege instead.

An effective role denial is not transient throttling; indefinite retry cannot create permissions and hides the actual deployment configuration issue.

Capitalized SYSTEM in customer text is still customer text. Elevating strings that resemble role delimiters would let any user impersonate the application’s governing instructions.

Hidden application instructions are not automatically authorized for disclosure just because a model might output them. The application should protect confidential configuration and access tokens.

Quotation marks do not authenticate an administrator or transform untrusted text into higher-priority instructions. This is a role-separation problem, not a punctuation problem.

Model confidence is not proof of a permitted CRM update and cannot confer administrative authority. Even a correct suggested address must pass the customer’s actual permissions.

Past-tense language in chat describes a proposed outcome, not a durable database operation. A model can say “updated” when the tool was never called.

Storing the assistant’s sentence in a note does not modify the address field or establish the change requested by the customer. The system must verify the actual target record.

A deployment alone is not a configured agent. Ordinary user content cannot define enduring privileged instructions or the approved tools available to future sessions.

Model deployment supplies inference capability but does not automatically create a task-specific agent with approved instructions, tools or business permissions.

Administrator rights are not needed for ordinary product support and would enlarge the damage of incorrect or injected tool calls. Start from least-privilege task scope.

Retrieving the internal draft already exposes it to the model and possible traces. UI-only removal occurs too late to enforce source confidentiality.

Guessing public policy from conflicting drafts cannot establish the approved current rule and can accidentally promote unpublished decisions.

Vector score ranks semantic relevance, not legal authority or visibility. A highly relevant internal HR draft must still be excluded from public answers.