Question

A financial services firm is finalizing the deployment pipeline for a Copilot Studio agent that answers customer account questions by grounding on internal Dataverse and SharePoint knowledge. Security requires that every promotion to production be gated by a repeatable check that surfaces known weaknesses — such as susceptibility to prompt manipulation, over-broad connector permissions, and grounding sources exposing sensitive fields — before release. Which approach BEST establishes this gate as part of the ALM process?

Accepted Answer

Integrate an automated adversarial/red-team evaluation suite (including prompt-injection and jailbreak probes) plus a connector-permission and DLP policy scan into the deployment pipeline, and block promotion until results pass defined thresholds.

Answer

Enable Application Insights telemetry on the production agent and review conversation transcripts weekly to identify any manipulation attempts after go-live.

Answer

Require each maker to manually attest in a checklist that they followed prompt best practices before submitting the solution for import.

Answer

Rely on the Power Platform environment's default DLP policy to block non-business connectors and assume grounding data is safe because it is internal.