Chapter 2 of 6
Architecture at a glance#
The customer repository deploys the Foundry resource, child project, and observability resources into the approved resource group. Operations records the resulting live resources in the customer inventory system.
Azure Policy evaluates resource changes in the same group. A subscription-level initiative groups the allowed-location and required-tag built-ins. Its resource-group assignment moves from DoNotEnforce to Default after review and approval.
Design choices and tradeoffs#
| Decision | Chosen approach | Tradeoff |
|---|---|---|
| Foundry resource model | Current AIServices resource with one child project | Confirmed classic assets need separate migration work |
| Network pattern | Select public, public-private-inbound, or byo-vnet before account creation | BYO VNet needs the approved subnet and route before the baseline deploys |
| Tracing authentication | Stable ApiKey project connection, resolved inside Bicep | The connection remains key-based until an approved preview upgrade |
| Policy rollout | Assign to the exact sandbox group in DoNotEnforce, then promote the same assignment | Evaluation takes time, so stale findings delay enforcement |