RVAP logo

AI Governance Co-implementation · Session 03

Model governance, data residency, quota, and lifecycle

330 minutes · Record the approved model, deploy it, and apply the matching policy controls

Why it matters

Problem. An unreviewed model version or deployment type can move data to the wrong processing
location, burn quota, or expose the workload to retirement without warning.

Solution. Check those choices against live Azure state, deploy the approved version, then
assign the built-in policy controls from the same approval register.

By the end of the session:

  • Git records the approval reference and exact deployment settings.
  • Preflight checks scope, access, lifecycle, processing location, quota, and what-if.
  • Bicep deploys the listed child resources.
  • The live model coordinates, SKU, capacity, and approval tag match the profile.
  • Azure Policy reads the approved publishers and asset IDs from the approval register.

Architecture and control boundary

The decision system authorizes the model.

The repository owns the deployment profile and Bicep.

Azure owns live availability, quota, lifecycle, and deployment state.

Other templates, the portal, CLI, and APIs can bypass this path. They need a separate control.

An approved model choice moves through preflight, deployment, review, and a keep, replace, or retire decision.

Implementation tradeoffs

Decision Required answer
Model Exact name, version, format, deployment name, and approval ID
Deployment SKU, capacity, Responsible AI policy, and NoAutoUpgrade
Processing global, a US/EU/APAC data zone, or region:<azure-region>
Operation Review date, lifecycle owner, change route, and quota headroom

DeveloperTier is outside this path. A model version change needs a new external decision and profile update.

Processing location follows the SKU

Requirement Supported SKU family
Global GlobalStandard, GlobalProvisionedManaged, GlobalBatch
US, EU, or APAC data zone DataZoneStandard, DataZoneProvisionedManaged, DataZoneBatch
Regional Standard, ProvisionedManaged, where supported

The Foundry resource location alone does not define the inference processing boundary.

Implementation path

Total session: 330 minutes. Guided implementation: about 255 minutes.

  1. Complete deployment-profiles.json and sandbox.bicepparam.
  2. Run preflight against the exact Foundry resource and operator.
  3. Complete any named lifecycle, quota, or data-zone manual check.
  4. Inspect the scoped FullResourcePayloads what-if.
  5. Deploy the listed child models.
  6. Assign the approved-model and eligibility policies in Audit.
  7. Review results, confirm the live policy assignment, and hand off lifecycle ownership.

The remaining time covers the briefing, required decisions, and restore guidance.

Stop before the change when

  • A __REQUIRED_*__ value remains or a JSON integer is still quoted.
  • The subscription, resource group, Foundry resource, or operator role is wrong.
  • The review date has passed or the model or SKU is deprecated.
  • Processing location, capacity, or quota headroom fails.
  • The named Responsible AI policy is missing.
  • Azure omits required lifecycle, quota, or data-zone facts and the operator has not completed the named manual check.
  • What-if contains another resource, a deletion, or an unsupported change.

Confirm and operate

Confirm once

  • Provisioning state is Succeeded.
  • Model name, version, and format match.
  • SKU and capacity match.
  • modelApprovalId matches the profile.
  • Both policy assignments match the approval register.

Keep in operation

  • Platform team: live capacity and deployments
  • Lifecycle owner: review and replacement
  • Decision authority: approval history
  • Platform engineering: profiles, Bicep, and preflight

Restore or remove safely

To restore an earlier approved version:

  1. Restore its profile through the approved change process.
  2. Rerun preflight and inspect what-if.
  3. Redeploy the child resource.

Remove one deployment only after the workload and platform owners confirm that no consumer uses it.
Check for implementationSession=03-model-governance-lifecycle. Leave the parent Foundry resource
and every other deployment in place.

Thank you!

Notes: The decision system keeps the full approval and review history.

Notes: Do not describe these files as a platform-wide allowlist.

Notes: These values must be settled before the team starts preflight.

Notes: Preflight checks regional matches. Data-zone membership needs a manual check because Azure CLI lacks a stable mapping.

Notes: The implementation guide contains paired PowerShell and Bash commands.

Notes: A manual switch records a completed check. It does not claim Azure supplied missing data.

Notes: The governed-agent deployment consumes the approved deployment name and model coordinates.

Notes: Other deployment methods still need a policy, permission, inventory, or change-control design.