Pass Your Microsoft AI-901 Exam Easy!

Retrieving the internal draft already exposes it to the model and possible traces. UI-only removal occurs too late to enforce source confidentiality.

Guessing public policy from conflicting drafts cannot establish the approved current rule and can accidentally promote unpublished decisions.

Vector score ranks semantic relevance, not legal authority or visibility. A highly relevant internal HR draft must still be excluded from public answers.

Model deployment recency does not identify which configured agent revision the evaluation intended to exercise. Agent tools and instructions can change independently of the underlying model.

Display-name length is unrelated to the revision’s active status or configuration. Similar names can reference different instructions and tool permissions.

HTTP 200 confirms a request was served, not that it targeted the intended revision. Two agents can return text successfully while implementing different policies.

Masking the output does not prevent unauthorized data from being read into the model and logs. Access checks must precede the lookup.

The connector’s own identity establishes permission for the service, not the human caller’s entitlement to an arbitrary customer record. Account authorization must be checked against the requesting user at the lookup boundary.

Prompt instructions are not access-control enforcement. The agent can be manipulated or make errors, so the service must reject unauthorized IDs independently.

Access to a chat interface is not necessarily access to modify sensitive CRM fields. The write action may require different scopes from viewing a record.

Nightly review is too late if unauthorized writes already altered customer data. Authorize the transaction at the execution boundary, not after damage.

A valid chat session does not mean the user may edit this CRM record or protected fields. The transaction service must independently enforce effective permissions.

Valid configuration fields prove only that an agent was created, not that it behaves safely when source retrieval fails or evidence conflicts.

Repeating the same successful case does not reveal whether the agent invents answers during a dependency outage. Negative-path coverage is required.

Chat bubble latency measures interface performance, not whether the source-backed answer was correct or whether the agent disclosed uncertainty.

Reading the invoice total does not show whether a malicious embedded command can redirect a refund. The risk is untrusted document text entering tool control.

A stronger adjective in a prompt cannot prevent a privileged refund operation. The backend must validate identity, payee, amount and independent authorization.

Uploading a PDF to storage does not make its text a system instruction. Promoting it would hand an attacker authority over financial actions.

Model expectation cannot substitute for server confirmation. Leaving the success message conceals a failed customer task and creates false reliance.

Escalating from the caller’s denied rights to administrator privileges circumvents authorization and can cancel orders without consent.

Invented receipt identifiers cannot be reconciled with the order database. They would falsely represent a business transaction that did not happen.

Unrecorded overwrites prevent reliable comparisons and later reconstruction of which refund rules the agent applied to customers.

Changed instructions may cause old cases to fail even if previously approved. Regression coverage must include unaffected and safety-critical behavior.

Prompt edits can alter tool selection and refund approval language without changing model weights. Financial actions still require explicit release checks.

Removing authentication for a test changes the security contract and can conceal the very permission problem that would affect production users.

A text completion checks only model inference, not whether the configured appointment agent can invoke approved tools, handle missing evidence or fall back safely. A smoke test must target the actual agent and its expected workflow.

An agent name in the portal is metadata, not evidence of valid tool bindings, resource access or successful appointment creation.

A longer context window does not change which tenant’s cached result was retrieved. More room for mixed records can increase exposure, not fix cache-key isolation.

Hiding Customer A’s name cannot remove confidential values, terms or identifiers already taken from their cached answer. Authorization must happen before retrieval from the cache.

A prompt is not an access policy and cannot guarantee safe reuse of responses from a globally shared cache. The cache service must enforce tenant-aware keys and expiry.

A well-formed citation identifier can still be invented or point to an unrelated passage. Grounding QA must resolve the identifier and verify the actual support for each claim.

Model confidence is not proof that a cited policy exists, is current or contains the quoted rule. Actual retrieval records are required.

Fluent writing cannot establish source authority or factual correctness. The evaluation must verify source provenance, not presentation style.