This design creates a governable and secure agent. Declarative agent instructions (B) allow for behavior to be centrally defined and managed across environments. A Microsoft Graph connector with Access Control List (ACL) trimming (D) securely surfaces existing policy documents without copying data, while respecting user permissions. An action allowlist with an approval policy (F) provides granular control over the agent's capabilities, enforcing separation of duties for high-risk actions as required.

C: Allowing users to override the system prompt would completely undermine central governance and create a significant security vulnerability.

A: Topic-only prompts are insufficient for an extensible agent that must initiate complex, approved actions beyond simple conversation flows.

E: Granting org-wide delegated permissions for any plugin request is a direct violation of the principle of least privilege and is highly insecure.

1. Microsoft 365 Copilot Documentation. (2024). Extend Microsoft Copilot for Microsoft 365. Microsoft Learn. Section: "Microsoft Graph connectors".

2. Microsoft Power Platform Documentation. (2024). Manage Copilot plugins in Integrated Apps. Microsoft Learn. Section: "Allow or block plugins".

3. Microsoft AI Builder Documentation. (2024). Create a custom prompt. Microsoft Learn. Section: "Best practices for prompt engineering".