The previous article, Microsoft Foundry Agent Identity Governance: Agent Identities, Blueprints, and Managed Identities mapped the relationships among User Identity, Agent Identity, Agent Identity Blueprint, and Project Managed Identity. This article turns that identity model into a permission ledger, a publish-time migration plan, and a set of negative tests. It uses one scenario to answer three practical questions: When should an agent use On-Behalf-Of (OBO), and when should it use Ag...