A2A connects independent agents; MCP connects tools and resources. Understand tasks, identity, and trust across delegation, then follow a complete Python example to deploy and call an A2A agent in Microsoft Foundry, with RBAC and explicit preview limitations.
A vector index is a copy, and a copy inherits no permissions: the Databricks AI Search documentation states that row and column level permissions are not supported. The two routes an agent takes to the data — RAG and text-to-SQL —, where the access rule lives on each one, the Genie Agent’s two credentials, and the metric layer that stops the number from changing.
A private endpoint controls ingress; it authenticates nobody and does not decide where the agent writes afterwards. The three boundaries of an AI workload — entrance, identity, and exit —, the three DNS zones Foundry requires, the roles that were renamed, and the egress control almost every project leaves open.
Guardrails contain at runtime; evaluation measures over time — and neither does the other’s job. Content Safety, Prompt Shields, evaluators that see the tool call and not just the answer, red teaming with PyRIT, and the maturity signal that separates a demo from a system: a deployment blocked by a number.
Federating, mirroring, and ingesting are not synonyms — and in Fabric “mirroring” already means three different mechanisms. When to use Lakehouse Federation, when to mirror a catalog or a database into Microsoft Fabric, when to ingest with Lakeflow Connect, what is actually free, and why source permissions do not cross the OneLake boundary.
Prompt caching solves reuse, but it does not decide when to run, how to buy capacity, or which model should answer. A practical framework for combining Batch, PTU, pay-as-you-go, and Model Router around cost per approved task.