Operation SENTINEL

Objective: make the design decisions before you touch the canvas — the exam asks these as scenario questions constantly.

• Audience: decide internal (analysts) vs external (clients) surfaces. SENTINEL is internal-facing for triage, external only for the final advisory — note how that splits your design.
• Identity strategy: how does the agent authenticate to the CVE API (public) vs to your ticketing system (OAuth)? Who is the end user and what can they see? Write it down.
• Channels & deployment: Teams for analysts; decide whether the advisory goes out via a separate channel.
• Responsible AI: this is security — groundedness is non-negotiable. Plan guardrails so it never invents a CVSS score or fabricates remediation. Note moderation + the "don't answer ungrounded" stance.
• Governance: DLP — the agent must not leak one client's data into another's advisory. Note environment strategy.

Objective: stand up the triage agent and make it answer from your docs, not the base model.

• Create the Sentinel Triage agent. Give it instructions (your prompt-engineering muscle — keep it tight).
• Add a knowledge source: upload a few of your methodology / remediation-pattern docs. For the grown-up version, wire Azure AI Search as the source so grounding runs on a real vector index.
• Author a topic with trigger phrases (new finding, triage this, remediation for…).
• Use the generative answers node grounded on that knowledge so "how do we usually remediate X" pulls from your corpus.

Objective: give the agent hands — pull live external data. This is your home turf wearing a wizard.

• REST API tool / custom connector → the public NVD CVE API. Input a CVE ID, get back CVSS + description. Build it as a custom connector, or use a Send HTTP request action if you want the raw route. Do both once to feel the difference.
• MCP tool → stand up (or reuse) a small MCP server that returns internal exposure/asset context, and connect the agent to it. You already run MCP servers — this stage is a 10-minute win that the exam weights heavily.

Objective: compute something with a formula, store it, and render it — three of the most "un-dev" skills on the exam, knocked out together.

• Use Power Fx to compute an internal risk rating from CVSS × asset_exposure × client_criticality. Wrestle with the syntax on purpose — it's Excel-flavored and the exam expects you to read it.
• Store results in variables — deliberately use one global (client criticality, needed everywhere) and one topic-scoped (this finding's score). Feel the scope difference.
• Render a adaptive card: CVE, CVSS, computed risk, recommended action. Edit the card JSON so the structure sticks.

Objective: nothing leaves the building without a human. Build the flow that gates the advisory + ticket.

• Create an agent flow that, on trigger, drafts the advisory and files a ticket (a connector to a Dataverse table works as your mock ticketing system).
• Insert a human-in-the-loop approval — an analyst must approve before the advisory sends / ticket is created.
• Wire input parameters (CVE, risk score in) and output parameters (ticket ID out).
• Add error handling — CVE API down or bad input → graceful message, not a crash.

Objective: stop building one god-agent. Delegate — exactly like your opencode sub-agents, in a GUI.

• Create a connected / child agent — an Advisory Writer specialized in drafting client-facing bilingual (EN/ES) advisories. The triage agent delegates the writing to it.
• Define the hand-off cleanly: what context passes to the child, what comes back. This is the core multi-agent skill.

Objective: prove SENTINEL behaves. This is the domain pure devs skip — don't.

• Build a test set of ~8–10 intake messages: a valid CVE, an unknown CVE, malformed input, an out-of-scope request ("write me malware" → must refuse), a Spanish-language finding, a low- and a critical-severity case.
• Choose an evaluation method and run the set.
• Review results: did it score correctly, ground its answers, refuse out-of-scope, handle both languages? Log what failed.

Objective: move SENTINEL dev→test→prod like a professional, with nothing hardcoded. This single stage is worth disproportionate exam points.

• Package everything into a solution. Add your existing agents + flows to it.
• Replace every hardcoded value (CVE API base URL, ticketing endpoint, client-criticality lookup) with environment variables — dev points at a test API, prod at the real one.
• Promote the solution through a Power Platform Pipeline: dev → test → prod, no manual rebuild.
• Wire Application Insights so you can monitor the deployed agent.