A private endpoint controls ingress; it authenticates nobody and does not decide where the agent writes afterwards. The three boundaries of an AI workload — entrance, identity, and exit —, the three DNS zones Foundry requires, the roles that were renamed, and the egress control almost every project leaves open.
Guardrails contain at runtime; evaluation measures over time — and neither does the other's job. Content Safety, Prompt Shields, evaluators that see the tool call and not just the answer, red teaming with PyRIT, and the maturity signal that separates a demo from a system: a deployment blocked by a number.
MCP has become the open standard for connecting AI agents to tools and data. What it is, what changed in detail in revision 2026-07-28 - stateless protocol, no sessions or initialize, subscriptions/listen, no SSE resumability, extensions and OAuth - with a migration checklist and how to host it on Azure.