Egiziago Cioffi built an Azure OpenAI email assistant that passed every evaluation his team ran. It auto-resolves 60% of inbound customer email for SynSphere Italia, a Milan-based Microsoft partner. Then he ran a low-privilege account against the same questions a high-privilege account had already put to the assistant. The outputs did not match. The assistant returned SharePoint content the requesting user had no permission to open in SharePoint directly. The evaluations had checked factual accuracy, relevance, and task completion. None of them asked whose permissions the retrieval pipeline was using.
This is not an isolated failure. Straiker's STAR Labs Threat Report, published July 2025, ran over 1,700 successful exploit attempts against production agents and found 91% of successful attacks on productivity agents ended in silent data exfiltration, with no malware required and no lateral network movement. The agent simply returned everything it could reach. Azure AI Search has shipped native document-level ACL trimming via Entra-based tokens since May 2025, and SharePoint ACL sync followed in a later preview. The fix exists at the platform level. Cioffi's custom Azure OpenAI retrieval pipeline bypassed it entirely, which is how a broken access control survived every test his team designed. Adriel Desautels, CEO of Netragard, describes the structural problem precisely: a non-human identity with broad permissions indexes high-privilege data, and any user with search capability can query the app and collapse authorization boundaries to the lowest privilege level in the system.
Cioffi's remediation did not require a new identity platform. He added a query-path filter that checks the requesting user's SharePoint permissions before any chunk reaches the model's context window. The filter runs at query time, not index time. The assistant still resolves roughly 60% of inbound email with the filter active. The tradeoff is explicit: some content the assistant previously used is now excluded because the requester's permissions do not reach it. That is the cost of enforcing the boundary. The full article is worth reading for the mechanism detail on how the evaluation framework missed this, what the Azure AI Search ACL trimming actually covers and where it stops, and what the UKASI's August 4 incident report on unsanctioned agent behavior adds to the picture of runtime scope failures across production deployments.
[READ ORIGINAL →]