Chapter 4 of 6
Decisions and stop conditions#
Complete sandbox.json and agent-api-definition.json. Resolve every __REQUIRED_*__ value.
| Decision | Continue when | Stop when |
|---|---|---|
| Inventory and APIM scope | API Center is the approved inventory, and every imported API has a metadata owner | Another inventory is authoritative, or the APIM link would import ownerless assets |
| Plan and region | The live provider advertises the region, and Free or Standard is approved | The region, support position, eligibility, or cost is unresolved |
| Access | The deployment operator has Contributor on the API Center resource group and User Access Administrator on the exact APIM service | Either assignment is broader than approved, or the API Center identity would receive APIM write access |
| Deployment preview | what-if changes the marked API Center scope and exact reader assignment | It replaces or removes unrelated resources, targets another APIM instance, or broadens the role assignment |
| Synchronization | The source is healthy and the APIM gateway API appears once | Initial sync is pending or failed; do not create a duplicate API |
| MCP server | The endpoint is approved HTTPS Streamable HTTP, read-only, and owned | It uses stdio, embeds credentials, permits writes, or lacks a runtime owner |
Every in-scope entry needs these properties:
| Property | Required decision |
|---|---|
| Business owner | Accountable role or group |
| Technical owner | Operating role or group |
| AI asset kind | ai-api, agent-api, or mcp-server |
| Data classification | public, internal, confidential, or restricted |
| Permitted consumers | Approved groups or workload classes |
| Model/provider | Provider, or not-applicable for a non-model MCP server |
| Residency profile | Approved processing and storage boundary |
| Risk tier | low, moderate, high, or critical |
| Evaluation results URL | Owned evaluation record or backlog |
| Last review and expiry | ISO dates, with expiry after review |
| Implementation session | 07-api-center-ai-mcp-inventory |
The API program owner defines the schema. Business owners approve consumers and lifecycle. Technical owners maintain runtime locations and review dates. Data and risk owners maintain classification, residency, risk, and evaluation destinations.
At expiry, the technical owner has one business day to renew after review, retire and remove the entry from discovery, or quarantine it from approved use.