Validate tool arguments at the execution boundary
Treat model-generated tool arguments as untrusted input even when they satisfy the generated schema and bind successfully to the expected C# types.
Security
Treat CORS as a browser boundary, not API authorization
Use CORS to control browser-script access across origins, while enforcing API permissions with authentication and authorization.
Set request body limits intentionally
Choose global and endpoint-specific request body limits instead of inheriting accidental defaults for uploads and APIs.
Treat uploaded files as untrusted
Keep uploads quarantined until required metadata, content, and resource checks succeed, while treating client filenames as untrusted.
Cache GET responses only when user context is clear
Do not cache a GET response unless the cache key matches the user, tenant, and permission boundary that shaped it.
Assign least-privilege Azure roles, not broad contributor rights
Give workloads and people the narrow Azure role they need instead of defaulting to Contributor.
Separate prompts from authorization
Do not let prompt instructions decide what data or actions a user is allowed to access.
Use managed identity before connection strings
Prefer Azure-managed identities over long-lived secrets in deployed applications.