01 / Principal and identity
Who acts, and what can the platform identify?
An Entra agent identity can represent an agent; a user or owner supplies accountable context.
Tokens and agent identity establish caller and audience, subject to deployment configuration.
- 01Originating task
- 02Agent or workload
- 03An agent invokes an enterprise API to disable an account.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Evaluate account-disable authority at the API, using verified token facts and task evidence.
Require target account, incident assignment, approval and expiry.
Delegation constraint
An agent identity must not imply the agent may use every permission of its sponsor.
03 / Worked denial
Test a request outside the grant.
An incident agent presents a valid token but targets a user outside its case.
Adversarial verification
Present a valid Entra agent token for an account-disable request outside the assigned incident. Confirm token authentication succeeds but the account API denies the target.
04 / Review and responsibility
What should the audit trail prove?
Token issuer/audience validation, agent ID, case, target, decision and account state.
Identity is an input to authority; this page does not assert a ProofGrid–Entra integration.
Platform primary source