Question

A Copilot Studio agent for a financial services firm grounds its answers on a SharePoint site that contains both public policy documents and a restricted folder holding confidential client portfolios. During testing, some employees discover the agent surfaces snippets from the restricted folder even though they lack direct SharePoint permissions to those files. The architect must design access controls on grounding data so the agent never returns content the requesting user is not authorized to see. Which approach best enforces this requirement?

Accepted Answer

Enable end-user authentication on the agent and rely on SharePoint's document-level permissions so retrieval honors each requesting user's identity and existing access rights

Answer

Add a post-response content filter topic that scans generated answers for keywords associated with confidential portfolios and redacts them before display

Answer

Move all grounding documents into a single Dataverse table and grant the agent's service principal broad read access so retrieval is faster and centrally managed

Answer

Instruct the agent in its system prompt to only answer from public policy documents and to refuse questions about client portfolios