01 / Principal and identity
Who acts, and what can the platform identify?
A published agent may act through a user or maker-provided connection.
Copilot Studio supports user authentication and agent-author connections for tools.
- 01Originating task
- 02Agent or workload
- 03A connector action updates a service ticket or customer record.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Place an action check in the connector-backed API or flow before mutation.
Distinguish the signed-in user, connection owner and authorized task.
Delegation constraint
A maker connection can make an action technically possible for many users without granting each task the same authority.
03 / Worked denial
Test a request outside the grant.
An agent attempts to close a high-severity incident using a maker connection.
Adversarial verification
Run one high-severity incident closure with user authentication and one with an agent-author connection. Verify the downstream workflow requires the case owner in both modes.
04 / Review and responsibility
What should the audit trail prove?
Agent/session reference, connection mode, user, incident, approval, connector call and resulting state.
ProofGrid provides downstream authority control without claiming a certified Copilot Studio connector or vendor endorsement.
Platform primary source