Building an agent in Foundry: five times adding something human

An empty agent has no character, no hands, no memory, no conscience and no mirror. Five steps in the Foundry portal give it all five, and each one shows exactly what AI-901 is testing in domain 2.

Most people click through those five steps in the order the portal suggests, and when everything is filled in it feels done. But “clicking” and “understanding” are not the same thing, and it is the second one you need when a colleague asks later why the agent said something that turned out not to be right. This article walks through the five layers in the order you set them up in Foundry, with a concrete check for each one that you can run on your own agent.

Character: the system prompt

The system prompt defines who the agent is, what it talks about and what it does not do. For an agent that answers Power BI report questions, that means concretely: it only responds about published workspaces, it never mentions client names, and it says explicitly when it is not certain. You write those three things in plain language, not in code.

The test for a good system prompt is straightforward: can a colleague who reads only that prompt figure out what the agent is and is not allowed to do? If the answer is no, the prompt is too vague. “Answer questions about Power BI” is too vague. “Answer only questions about reports in published workspaces in the production tenant of our organisation, and refer users to the team lead when questions are about authorisations” is concrete enough.

Hands: the tools

Tools are what the agent can actually do in the real world: query a Fabric semantic model, read a SharePoint list, call an API. In Foundry you wire those in via MCP. The practical rule: read permissions when that is enough, and no more access than the job requires.

There is a distinction worth seeing deliberately at least once: turn off its tools, and its capability disappears while its character stays. It still knows who it is and what it is allowed to say, but it can no longer retrieve anything. Character and hands are two separate layers, even if they appear to amount to the same thing in a working agent.

Memory: the grounding

Grounding is where the agent draws its knowledge from when it answers. Foundry IQ offers three options: SharePoint, Fabric and Bing. Alongside those, the Fabric data agent in Copilot Studio is currently in Public Preview, which lets an agent use a Fabric semantic model as its grounding source.

Each source has its own scope, and that scope is the boundary of what the agent is allowed to know. A SharePoint library of onboarding documents covers onboarding questions but not contract details, and a semantic model covers numbers but not the narrative behind those numbers. Grounding is not an on-off setting but a design decision: which source, with which scope, for which question?

Conscience: the guardrails

Content Safety, Prompt Shields and Groundedness Detection detect what can go wrong. Prompt Shields monitors for jailbreak attempts and indirect prompt injection in source documents, Groundedness Detection flags when the agent speaks outside its grounding. They do not prevent these things: they detect them, and human judgment is always needed on top of the technical detection.

That raises a design question that lives outside the guardrail settings and inside the design of the agent itself: what does it do when it is not certain? Does something fall back to a person, or does it talk on as if nothing is wrong? That question does not ask itself when you click through the portal.

Mirror: the trace

Microsoft is clear about this: Copilot outputs are nondeterministic, even with the same prompt and the same grounding. The trace shows, for each answer, which sources, tools and intermediate steps the agent used, and that is where “it works” and “it is correct” become two different things.

If the agent gives a different answer to the same question twice, you need to be able to explain why in the trace. Which source did it use the first time, which the second? Which intermediate step produced a different result? If you cannot explain it, the agent may be ready for a demo but it is not ready for a process where people rely on its answers.

Getting the five layers to stick

Five layers, five human words. Flip the cards and see whether you already have the Foundry setting and the matching check ready for each one.

The five layers as a checklist

AI-901 tests these five in domain 2, but the questions behind them belong on every agent you put to work tomorrow, certification or not. If one layer is missing, something gets left with the person who has to work with it later. Walk through them on your own agent and tick off what is in order.

If you want to work through this checklist for your own Foundry agent, or find out how it connects to the AI-901 study path, visit trainerbjorn.nl or reach out on the contact page.