Letting AI Agents Use the Azure CLI Safely — A Defense-in-Depth Design with Managed Identity, a Command Broker, and Resource Locks

Hand an AI agent a shell and Azure credentials at the same time, and a single prompt injection can turn into a stray az command that deletes resources or exfiltrates secrets. Short-lived credentials and least privilege, as Microsoft recommends, is the right direction. But a service principal's client secret is highly persistent once leaked, and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are RBAC, organization policy, and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a single input never reaches production.