Chapter 1 of 6
Session scope#
What we will do#
Objective. Deploy one controlled Azure API Management route to the Governed agent baseline guide policy assistant, built from an agreed gateway design record. APIM validates the client token and product subscription, applies approved limits and Content Safety, then uses its own managed identity to call the pinned Foundry agent. Confirm the result by sending a synthetic request with an invalid bearer token: APIM must reject it before Content Safety or Foundry ever sees it.
Why it matters#
Problem. An AI gateway change that isn't recorded before deployment can drift from what stakeholders approved, and forwarding the caller's own credential to Foundry would let a compromised client reach the agent directly.
Solution. This session locks the design record before any change and routes the backend call through APIM's own managed identity, so client access stays separate from the Foundry call.
Boundaries#
This session changes child resources in the approved nonproduction APIM instance. APIM is authoritative for the live route, product, backends, and policy. Foundry is authoritative for the agent. The repository holds the design record and deployment definitions.
The design record describes the Foundry Agent Service policy-assistant variant used here. Production ingress, semantic caching, regional failover, and write-capable agents need separate design work. API Center and MCP inventory guide records this route in API Center. MCP tool security guide adds the MCP tool boundary.
Session preparation
Who should join
- AI platform and API Management engineers
- Identity, network, application security, safety, and operations owners
- The delivery lead for the target AI workload
What you need
- The approved nonproduction scope and change record name the delivery owner.
- The target Foundry Agent Service policy assistant has a pinned Entra-authorized Responses endpoint. The Foundry platform owner confirms the endpoint and network path. (Sessions 02 and 04.)
- An existing supported API Management instance has a system-assigned managed identity. The gateway owner confirms its tier and network path.
- The API product, identity, network, safety, operations, and delivery owners can record decisions and resolve readiness gaps.
- The deployment operator has time-bound Contributor on the exact APIM resource group.
- The APIM identity has Foundry Agent Consumer, role ID eed3b665-ab3a-47b6-8f48-c9382fb1dad6, on the individual agent. It has Cognitive Services User, role ID a97b65f3-24c7-4388-baec-2e87135dc908, on the approved Content Safety resource.
- The approved Content Safety backend and Application Insights logger use managed identity. The product owner has issued one workload-specific APIM subscription and stored its key in the approved secret store.