A manufacturing group is deploying an agent that drafts maintenance work orders from operational data, but only a subset of supervisors can submit…

The best design is Entra group-based Role-Based Access Control (RBAC) per environment. This approach directly meets the requirements by allowing the creation of a specific security group in Microsoft Entra ID for the supervisors. This group can then be granted permissions to use the agent's submission capabilities only within the production environment. This enforces the principle of least privilege, supports environment separation (dev/test/prod), and contains the governance to the specific solution without imposing tenant-wide restrictions, as requested.

B. Environment Admin role for agent identity: This violates the principle of least privilege by granting excessive permissions to the agent's service principal.

C. Delegated user token for tool calls: While useful for auditing, this doesn't enforce the rule that only supervisors can submit; it relies on the tool's permissions, which is better managed by RBAC.

D. Tenant-wide connector allowlist with conditional access policies enforced: This is a tenant-level control that would create the "tenant-wide friction" the requirements explicitly forbid.

1. Microsoft Power Platform documentation, "Environment strategy for ALM." This guide emphasizes using distinct environments for development, testing, and production to isolate changes and manage access.

2. Microsoft Power Platform documentation, "Security concepts in Microsoft Power Platform," Section: "Microsoft Entra security groups." It states, "Using security groups is a best practice for securing user access to Power Platform resources."

3. Microsoft Power Platform documentation, "Share a bot with security groups." This page details the specific mechanism for using Entra ID (formerly Azure AD) security groups to control access to bots (agents) on an environment-by-environment basis.