A company built a custom Apex action invoked by an Employee Agent to fetch data...

The correct answer is C because external API authentication should not depend on the current user’s UI session ID. Agent execution contexts can differ from interactive UI contexts, so session-based authentication is brittle and can fail silently or violate security expectations. A Named Credential centralizes the endpoint URL and authentication parameters, allowing Salesforce to manage secure callout authentication consistently. Option A does not solve the authentication architecture problem; profile access affects Apex execution permissions, not external API credential management. Option B is also wrong because an Employee Agent is not fixed by assigning a Service Agent permission set group, and permissions alone do not authenticate the external system. Salesforce Apex callout documentation states that a named credential specifies the callout endpoint and required authentication parameters in one definition.