Implementation | Session 04: Governed Microsoft Foundry agent baseline

Chapter 5 of 6

Implement#

1. Complete the definitions and runtime scope#

Populate the three implementation files. The OpenAPI manifest must contain get_policy and no POST, PUT, PATCH, or DELETE operation.

PowerShell

$approvedSubscriptionId = $env:AZURE_SUBSCRIPTION_ID
$resourceGroup = "approved-session-04-resource-group"
$foundryAccount = "approved-existing-foundry-resource"
$projectName = "approved-existing-foundry-project"
$readApiBaseUrl = $env:session04_READ_API_BASE_URL
$applicationInsightsResourceId = $env:session04_APP_INSIGHTS_RESOURCE_ID

Bash

approved_subscription_id="${AZURE_SUBSCRIPTION_ID:?Set AZURE_SUBSCRIPTION_ID.}"
resource_group="approved-session-04-resource-group"
foundry_account="approved-existing-foundry-resource"
project_name="approved-existing-foundry-project"
read_api_base_url="${session04_READ_API_BASE_URL:?Set session04_READ_API_BASE_URL.}"
application_insights_resource_id="${session04_APP_INSIGHTS_RESOURCE_ID:?Set session04_APP_INSIGHTS_RESOURCE_ID.}"

2. Run preflight#

PowerShell

.\scripts\preflight.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -ResourceGroupName $resourceGroup `
  -FoundryAccountName $foundryAccount `
  -ProjectName $projectName `
  -ReadApiBaseUrl $readApiBaseUrl `
  -ApplicationInsightsResourceId $applicationInsightsResourceId

Bash

./scripts/preflight.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --resource-group-name "$resource_group" \
  --foundry-account-name "$foundry_account" \
  --project-name "$project_name" \
  --read-api-base-url "$read_api_base_url" \
  --application-insights-resource-id "$application_insights_resource_id"

Foundry has no data-plane what-if for agent creation. Preflight uses read-only resource and agent lookups, then prints the exact version, tool, protocol, authorization, and routing changes. Stop on any failed gate or unexpected scope.

3. Create and pin the version#

PowerShell

.\scripts\deploy.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -ResourceGroupName $resourceGroup `
  -FoundryAccountName $foundryAccount `
  -ProjectName $projectName `
  -ReadApiBaseUrl $readApiBaseUrl

Bash

./scripts/deploy.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --resource-group-name "$resource_group" \
  --foundry-account-name "$foundry_account" \
  --project-name "$project_name" \
  --read-api-base-url "$read_api_base_url"

Deployment applies the model, instructions, RAI policy, and OpenAPI tool. It creates a unique instance_identity, configures the stable Responses endpoint with Entra authorization, and pins 100% of traffic to the returned version. It will not update an existing agent unless the agent card contains implementationSession=04-governed-agent-baseline.