Assay / Solutions / Azure AI Foundry
Platform · Azure AI Foundry

Agent Trust for Azure AI Foundry

Entra ID knows who your Foundry agent is inside your tenant. It has nothing to say about the agent on the other side of a handoff. Assay gives both sides a verifiable answer that neither Microsoft nor AWS has to broker.


The problem

Entra governs your tenant. Delegation crosses tenants.

60%
of enterprises are scaling AI agents
4%
have agent governance in place
97%
reported an agent identity incident

Source: 2025 industry surveys of enterprise AI agent adoption.

Azure AI Foundry plus Entra Agent ID is a strong story inside the tenant: the agent gets a first-class directory object, conditional access applies, and access reviews work. That covers identity and permission.

It does not cover competence. Entra can tell you an agent is exactly who it claims to be and still leave you with no evidence it has ever completed the task you are about to hand it. Identity and track record are different problems, and only one of them has an incumbent.

The gap widens the moment work leaves the tenant. B2B guest access grants an external agent permission; it transfers no history. Your Foundry agent ends up delegating to a counterparty whose reliability is a blank page.


The solution

Portable trust that crosses the tenant boundary

Register your Foundry agent with platform: "azure" and it gets an identity that does not live in anyone's directory. Assay computes trust per capability from attested outcomes, so “good at work-order creation” and “good at parts procurement” stay independent claims rather than one blurred score.

Your agent calls /v1/verify before it delegates and gets back verified, a trust score, and the capabilities the counterparty has actually proven. The counterparty needs no Entra presence, no guest account, and no prior relationship with your tenant.

Run it from a Foundry tool definition, an Azure Function, or Logic Apps. It is one HTTPS call and it composes with the conditional-access policy you already enforce.

platform: azureFoundry tool definitionAzure FunctionsLogic Appsper-capability scoringno guest tenant

Why it holds up

What you actually get

Complements Entra Agent ID

Entra answers who and whether-allowed inside the tenant. Assay answers whether-proven across tenants. Run both; they gate different questions and neither replaces the other.

Per-capability trust

A score per capability, not one blended number. An agent strong at scheduling and untested at procurement reads exactly that way, so you can gate the two differently.

No guest accounts to provision

Verifying an external agent takes no B2B invitation, no directory object, and no onboarding. You verify a public identity, not a tenant member.

Bedrock ⇄ Foundry, one trust graph

An Azure agent and a Bedrock agent attest to each other's work and both scores move. The graph is cloud-neutral because it belongs to neither cloud.


Live API

Verify a counterparty from an Azure agent

Registration runs verbatim against production. The verify call — the one you put in the delegation path — needs the key registration hands back.

# 1. Register the agent — no key needed, no card. Returns its portable ID + API key. curl -s https://assay.foundrynet.io/v1/agents/register \ -H 'Content-Type: application/json' \ -d '{"name":"foundry-workorder-agent", "owner_org":"your_org", "platform":"azure", "capabilities":["work_order_creation", "parts_procurement", "maintenance_scheduling"]}' { "agent_id": "agt_4411f10541d0e3af7f47f6e5c75bcdeb", "api_key": "asy_live_…", // shown once "agent_card": { "trust_score": 0.5, "attestation_count": 0, … } } # 2. Verify it before you delegate. This is the allow/deny call. curl -s https://assay.foundrynet.io/v1/verify \ -H 'X-API-Key: YOUR_ASSAY_KEY' \ -H 'Content-Type: application/json' \ -d '{"agent_id":"agt_4411f105…", "claimed_capabilities":["equipment_monitoring", "predictive_maintenance"], "min_trust_threshold":0.6}' { "verified": true, "trust_score": 0.8, "capabilities_confirmed": ["equipment_monitoring", "predictive_maintenance"], "attestation_count": 8, "last_attestation_age_seconds": 41 } # Gate on BOTH fields. `verified` reflects the trust threshold and account # status only — an unproven capability comes back absent from # capabilities_confirmed, not as verified:false. if verified and "equipment_monitoring" in capabilities_confirmed: dispatch()
Read the gate carefully. verified reflects the trust threshold and account status. It does not fall to false because a claimed capability is unproven — an unproven capability simply does not appear in capabilities_confirmed. Gate on both fields.

Questions

Frequently asked

How is this different from Entra Agent ID?

Entra Agent ID is directory identity and access governance for agents in your Azure tenant — authentication, conditional access, lifecycle. Assay is behavioural trust across organizations: a score earned from counterparty-verified outcomes that a party outside your tenant can check. Different layer, complementary.

Do both organizations need Assay accounts?

Only the agent being verified needs to be registered. Verification itself is a read against a public identity — the verifier calls with its own key, and the two orgs need no prior relationship or shared credential.

Can we run our own trust model?

Yes. Assay ships six industry presets and each is parameter-tunable per organization — recency half-life, failure penalty, counterparty bonus, verification ceiling and more. Enterprise plans support fully custom models.

Where does the verify call belong in a Foundry agent?

Directly in the delegation path, as a tool the agent calls before handing off. Treat a deny as a hard stop or an escalation to a human, not a warning to log and ignore.


Related

Keep reading