Model governance, data residency, quota, and lifecycle

Chapter 6 of 6

Confirm the result#

Inspect each child deployment listed in the profile:

$profiles = Get-Content .\artifacts\models\deployment-profiles.json -Raw | ConvertFrom-Json
foreach ($profile in $profiles.deployments) {
  az cognitiveservices account deployment show `
    --name $foundryAccount `
    --resource-group $resourceGroup `
    --deployment-name $profile.deploymentName `
    --query "{state:properties.provisioningState,model:properties.model,sku:sku,approvalId:tags.modelApprovalId}" `
    --output json
}

python3 - "$foundry_account" "$resource_group" <<'PY'
import json, subprocess, sys
with open("./artifacts/models/deployment-profiles.json", encoding="utf-8") as handle:
    profiles = json.load(handle)["deployments"]
for profile in profiles:
    subprocess.run([
        "az", "cognitiveservices", "account", "deployment", "show",
        "--name", sys.argv[1], "--resource-group", sys.argv[2],
        "--deployment-name", profile["deploymentName"],
        "--query", "{state:properties.provisioningState,model:properties.model,sku:sku,approvalId:tags.modelApprovalId}",
        "--output", "json", "--only-show-errors",
    ], check=True)
PY

Every deployment must report Succeeded. Its exact model coordinates, SKU, capacity, and modelApprovalId must match deployment-profiles.json.

.\scripts\check-model-policy.ps1 -ResourceGroup $resourceGroup

./scripts/check-model-policy.sh --resource-group "$resource_group"

Both assignments must match the approval register.

After implementation#

The Foundry platform team owns live capacity and deployment changes. The lifecycle owner keeps the review date, replacement work, and notifications current. The decision authority keeps the full approval and review history. The policy owner maintains the approval register and policy assignments. Platform engineering maintains the Bicep, parameters, profiles, and paired preflight scripts.

Use this path for later version changes. Deployments created elsewhere need their own control. Azure Policy can separately deny selected deployment SKU names across other authorized paths.

To restore an earlier approved version, restore its profile through the approved change process, rerun preflight, inspect what-if, and redeploy. To remove a deployment, the workload and platform owners must first confirm that no consumer uses it. Check for implementationSession=03-model-governance-lifecycle, then remove that one child deployment through the approved Foundry or Azure deployment path. Leave the parent Foundry resource and every other deployment in place.