Tag: agent-security

On container protocol 2.0.0, Foundry hosted agents isolate conversations and sessions per Entra caller by default. When your own backend fronts many end users, you delegate with x-ms-user-identity, grant a custom impersonation role, and key everything your container stores by session ID plus user ID. Here is the C# for each layer and the traps that leak data between users.

Since Claude Code v2.1.295, a command or HTTP hook can set onFailure to "block" so a guard that crashes, times out, cannot start or prints invalid JSON stops the tool call instead of waving it through. Here is the config, what counts as a failure, the events where it does nothing, and the exit-0 trap no setting can catch.

By default a local Cursor SDK agent runs every tool call without asking. Set local.autoReview to route Shell, MCP, and Fetch calls through the classifier, then steer it with the autoRun block in permissions.json. With code, the three-step evaluation order, and why none of it is a security boundary.