Prior claims: memory-store-490; Contact preferences: memory-store-490.

Both requirements describe information that should persist across conversations for the same customer: previous claim information and stable contact preferences. Microsoft Foundry Memory is intended for durable, cross-session facts and summaries that agents can retrieve later, while a knowledge base is for shared reference content rather than user-specific history. The refund-processing and customer-refund tools are operational interfaces, not persistence layers. Using the existing memory store for both categories therefore matches the scenario ' s design objective. In production, the memory search tool should also be scoped to the end user so one customer ' s memory cannot be retrieved for another customer. Microsoft documents scope-based isolation for memory stores and supports a user-derived scope such as `{{$userId}}`. The key distinction is that the same memory store can hold multiple kinds of durable customer memory as long as retrieval is correctly scoped; there is no need to create separate tools or knowledge indexes for these two user-specific memory categories.

Official Microsoft reference: Create and use memory in Foundry Agent Service

============================================================

Provision Test, Acceptance, and Production by using a Bicep file applied through the CI/CD pipeline in Azure Pipelines; block promotion when quality falls below the threshold by using Foundry Agent Evaluator as a pipeline release gate.

The release lifecycle must satisfy two independent requirements: repeatable infrastructure deployment across DTAP environments and an automated quality gate before promotion. Bicep is Azure ' s infrastructure-as-code language, and Microsoft documents deploying Bicep through Azure Pipelines so the same declarative resources can be promoted consistently across subscriptions. For the promotion decision, an automated Foundry evaluation is the appropriate control because response quality is an AI-system property that should be measured against a defined threshold before the next stage is released. A manual portal deployment would weaken repeatability, while a deployment-only gate would not measure model or agent behavior. The important design point is that infrastructure provisioning and AI quality validation are separate controls in the same pipeline: Bicep establishes environment parity, and the evaluation gate prevents a technically deployable but behaviorally degraded agent version from advancing. From a security and governance perspective, the control should be enforced at the narrowest platform boundary that can deterministically block or constrain the action. Relying only on prompt text is weaker because the model can still be induced to behave unexpectedly.

Official Microsoft reference: Deploy Bicep files with Azure Pipelines; AI-500 Study Guide

============================================================

Log the start/completion of each specialist run and inspect the final output with Agent run middleware; record each customer-refund-tool call, including function name and arguments, with Function calling middleware.

The two logging requirements occur at different lifecycle boundaries. Agent run middleware surrounds an agent invocation, so it is the appropriate place to capture run start, run completion, exceptions, and the final agent result. Function calling middleware surrounds tool/function execution and can inspect the selected function, arguments, result, and failures. That makes it the correct boundary for an audit record of each customer-refund-tool invocation. Foundry tracing can provide broader distributed observability, but the question asks for reusable Microsoft Agent Framework middleware at the exact execution points. A knowledge store or memory store does not provide execution interception. Separating the two concerns also supports a cleaner audit model: agent-level middleware records specialist behavior, while function-level middleware records tool use. This aligns with Microsoft ' s middleware model, where cross-cutting concerns such as logging, validation, and exception handling can be implemented once and applied consistently rather than duplicated inside every agent or tool.

Official Microsoft reference: Microsoft Agent Framework - Defining middleware

============================================================

Process structure: A workflow with agent executors; Pause mechanism: A human-in-the-loop (HITL) gate; Interruption recovery: Checkpoints.

The process has a fixed execution order and can run for several hours, so an explicit workflow with agent executors is preferable to free-form agent delegation. The requirement to pause at predefined points is a human-in-the-loop requirement: the workflow must be able to suspend and emit a request for approval or operator input. The requirement to resume after worker restarts is addressed by checkpoints. Microsoft Agent Framework checkpoints persist workflow progress, executor state, pending messages, shared state, and outstanding requests so execution can be restored from the last saved point. A retry policy alone re-executes operations but does not reconstruct the complete workflow state after a process interruption. The three selected mechanisms therefore cover structure, controlled pause, and durable recovery as separate but complementary workflow concerns. In production, add telemetry and regression tests around this behavior so changes to prompts, models, tools, or orchestration do not silently alter the intended contract. The selected approach is the one that best matches the platform ' s native execution semantics.

Official Microsoft reference: Microsoft Agent Framework - Checkpoints and Human-in-the-loop

============================================================

InvoiceValidationAgent and PaymentApprovalAgent: One blueprint and one agent identity per agent role; VendorNegotiationAgent: An independent blueprint, one agent identity, and one agent user account.

Invoice validation and payment approval are distinct finance roles with different ERP permissions, so each should have its own logical agent identity for least-privilege access and audit attribution. They can remain within the same finance trust boundary while using separate identities. The vendor-negotiation agent operates across an external supplier boundary and should therefore use an independent blueprint/trust boundary. Its dedicated Exchange Online mailbox introduces an additional Microsoft 365 requirement: Microsoft Entra Agent ID supports associating an agent identity with an agent user account when the agent needs resources that require a user object, such as Exchange mailboxes or Teams. Sharing a single identity across all roles would blur audit ownership and expand compromise impact. The answer therefore matches Microsoft ' s current agent-identity separation model. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: Microsoft Entra Agent ID - plan agent identity architecture

============================================================

No / No / No

All three consultant-proposal statements should be rejected. Applying the highest sensitivity to every guardrail control is not automatically safer because it can increase false positives and unnecessarily block legitimate clinical interactions; controls should be tuned to the actual risk and tested. Telling the model in a system prompt to ignore hate speech is not equivalent to enabling the platform content-safety controls required for public-facing agents. Finally, repeatedly prompting patients to verify symptoms does not address long-context growth and can worsen token usage and latency. Microsoft guidance separates deterministic safety controls, evaluation, and context-management mechanisms from ordinary prompt instructions. The proposal also hardcodes medical behavior in prompts, contrary to the requirement to avoid embedding new clinical logic in the core prompt. A robust design would use appropriate content-safety/guardrail controls, validated intervention points, and a deliberate memory/compaction strategy rather than relying on increasingly restrictive or repetitive prompt text. The same configuration should be paired with auditable identity, trace, and evaluation data so reviewers can prove which principal acted, which policy was applied, and why a request was allowed or blocked. That is particularly important for production multi-agent systems with external tools.

Official Microsoft reference: AI-500 Study Guide - guardrails, context management, and evaluation

============================================================