Retail: Customer service agent with tools on Microsoft Foundry

A single agent on Foundry Agent Service combines two kinds of knowledge: the order system through an OpenAPI tool for current order status, and return policy through a RAG connection to Azure AI Search for policy questions. The agent decides for itself which tool is needed based on the question, instead of an agent having to know which system applies to what. The deployment uses serverless capacity because volume varies strongly throughout the day, with prompt caching so repeated context parts are not reprocessed every time.

One agent with tools and grounding replaces the separate scripts with a single point of maintenance: return policy is updated in one place and works through immediately in every answer. Serverless capacity fits the strongly variable volume of a service channel, where fixed capacity for peak moments would cost unnecessarily outside those peaks.

Extending the existing collection of scripts with even more separate rules was possible, but would have increased the maintenance problem instead of solving it. A fully human service team for all repeat questions remained an option, but did not address the core problem (inconsistency, slow turnaround under volume).

• One agent with multiple tools requires careful tool-selection logic; a wrongly chosen tool gives an answer that sounds convincing but is wrong.
• Serverless capacity fits variable volume, but gives less predictable latency than Provisioned Throughput during unexpected spikes.
• Prompt caching speeds up repeated interactions, but requires attention at policy changes: a stale cache must never produce a stale answer.

Microsoft Foundry (Foundry Agent Service, OpenAPI tools, content safety), Azure AI Search (grounding on return policy), Microsoft Entra ID (Entra Agent ID and access control).

• Give the agent least-privilege tool scopes: access to order data is not the same as access to modify an order.
• Turn on prompt shields against prompt injection through customer input, since customer messages are an untrusted source.
• Give the agent an Entra Agent ID and audit every tool action, so a disputed order can be traced to the exact agent step.

In the first version, a customer could, through a carefully worded message, coax the agent into reasoning outside return policy. After turning on prompt shields and tightening the system instruction to answer exclusively from the linked policy, this behavior disappeared without degrading legitimate questions.