Chapter 4 of 6
Decisions and stop conditions#
Resolve every __REQUIRED_*__ value. Keep IDs, endpoints, tokens, prompts, responses, tool content, telemetry, and customer data out of source control.
The tool must use GET, require policyId, and accept at most 128 characters matching ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$. The backend validates the same rule and returns only fields approved by the data owner. No create, update, approve, publish, or delete operation may exist in the tool, Foundry allowlist, or backend role.
Stop before deployment when:
- APIM is a workspace, uses an unsupported tier, or preview automation is prohibited;
- the operation has side effects or the backend role contains wildcard, write, delete, or action authority;
- the inbound token reaches the backend, the two audiences are not distinct, or a shared secret is required;
- any diagnostic captures payload bytes;
- another tool appears or approval is not
always; - preflight finds the wrong subscription, scope, role assignment, resource marker, or an unrelated
what-ifchange.
If preview automation is prohibited but the APIM tier supports MCP, the APIM owner may use the documented portal path. Create exactly one policy-catalog-mcp server with one get_policy tool, apply the same policy, and confirm the live APIM state. Otherwise stop.
Keep Streamable HTTP at /mcp. Do not create a new HTTP+SSE path. The MCP policy must not read context.Response.Body, because buffering can break streaming. Keep fail-on-error-status-code="false" so backend 4xx and 5xx responses retain normal status, correlation, and MCP telemetry.
The release owner must see the candidate version ID and confirm that the stable endpoint still selects the prior version before both checks. Stop if the read is wrong or uncorrelated, tool output changes instructions, a write or unknown tool is attempted, or API Center lacks the required owner metadata.