# Topic
3 articles on this subject.
When an agent acts on behalf of a user it inherits that user's access, so your half-governed pile of human permissions becomes agent attack surface. Why agent blast radius starts upstream, with people, and how to right-size both sides of the identity ledger.
Every Microsoft Graph, Entra SDK and Agent 365 SDK call needed to give a containerized LangChain agent its own identity, access control and audit trail, in the order they have to be made, and why.
The AWS, Microsoft Graph, Entra SDK and Agent 365 SDK calls that give an agent on Amazon ECS and Amazon Bedrock a Microsoft Entra identity, access control and an audit trail in Purview and Defender, in the order they have to be made, and why.