Egiziago Cioffi, an IT architect, discovered a critical security flaw in an AI agent he built using Azure OpenAI. The agent successfully passed all its evaluations, demonstrating factual accuracy and task completion. However, when tested with a low-privilege account, the agent retrieved information that the user should not have had access to. This revealed that the agent was operating with the indexing job's broader permissions, not the requesting user's entitlements.This type of failure, where agents use indexer permissions instead of user permissions, is not isolated. While Azure AI Search has introduced native document-level access control (ACL) trimming, it is not universally implemented or fully functional across all deployment paths. Custom pipelines, like Cioffi's, often bypass these native security features. Furthermore, independent research indicates that a significant percentage of successful attacks on productivity agents result in silent data exfiltration, highlighting a broader class of security vulnerabilities.These security gaps are often missed by standard evaluations, which focus on answer quality rather than the permissions used for data retrieval. The native Azure AI Search ACL trimming, when properly configured with Entra-backed principals and SharePoint indexers, can enforce these boundaries, but Cioffi's custom pipeline circumvented this. The core issue is a broken access control, where authorization boundaries collapse to the lowest privilege level with search capabilities.Cioffi implemented a fix by integrating a query-path filter that checks the requesting user's SharePoint permissions before data is sent to the model. This ensured that content a user cannot directly access in SharePoint is not included in the agent's context window. While this narrowed the scope of accessible content, the assistant continued to auto-resolve about 60% of inbound emails. The trade-off for enhanced security is a potentially reduced ability to answer questions if the necessary content is blocked by permission filters.Identity governance platforms, which manage service account lifecycles and credentials, operate at a different layer than retrieval permission boundaries. Both layers of control are essential for comprehensive AI agent security. A simple test involving two accounts, one high-privilege and one low-privilege, can expose retrieval permission boundary enforcement issues within thirty minutes. This test, comparing outputs against direct system access, reveals whether an assistant is incorrectly returning data beyond the user's granted permissions.