Chapter 1 of 6
Session scope#
What we will do#
Objective. Give operators a way to find a failing request, and its cost and security context, without collecting prompt or tool content.
Deploy a workbook, three alert rules, and a subscription budget for one governed service, and keep the telemetry, retention, and incident definitions that keep it operating. the controlled promotion workflow runs the paired smoke check against this deployment and gets one payload-free pass or fail result.
Why it matters#
Problem. A gateway, agent, model, or tool failure looks the same from outside the system, and a cost or security signal can go unnoticed until it's already an incident.
Solution. Joined runtime spans separate where a request failed, alerts route the signal to an owner, and the budget and runbook give the cost and incident owners a working signal, all without capturing prompts or tool payloads.
Boundaries#
Application Insights stays authoritative for runtime telemetry, Cost Management for billed cost, and Defender and the SOC system for security and incident records. Standard telemetry excludes prompts, responses, tool payloads, credentials, and personal data; APIM token metrics only estimate usage, and a budget notifies rather than stops resources.
Production content logging and user-level cost allocation stay outside this session's default scope and need separate approval. The controlled promotion workflow consumes the paired smoke check's payload-free result before it promotes a release.
Session preparation
Who should join
- Microsoft Foundry agent and platform engineers
- Azure Monitor, API Management, security operations, and FinOps operators
- Observability, AI quality, data-protection, and service owners
What you need
- An approved governed runtime can be inspected: the platform owner identifies the immutable agent and project, the gateway owner identifies the versioned APIM policy and tool path, the quality owner can retrieve the current evaluation result, and the security owner can retrieve the payload-free adversarial result and Defender route check. (Sessions 04, 06, and 08-11.)
- Record the agent type's tracing status before implementation. Foundry tracing is generally available for prompt and hosted agents. Workflow and external agents remain preview and need an approved preview-use decision.
- The Session 04 nonproduction policy assistant and Session 06 API Management route support an approved read-only request and a separate handled failure for a nonexistent synthetic policy. The failure route returns a tool failure while the model keeps its own result.
- A workspace-based Application Insights resource, Log Analytics workspace, action group, and approved data-retention boundary exist.
- Application instrumentation is deployed. The application, gateway, agent, and tool preserve W3C trace context plus one non-sensitive correlation ID. The gateway owner has merged correlation and bounded token metrics into the customer-owned API Management policy source.
- Baseline telemetry has been reviewed before alert thresholds are chosen.
- The deployment operator has Monitoring Contributor at the exact deployment resource-group scope and Log Analytics Reader at the exact workspace scope. If Application Insights or the action group is outside that group, the operator also has Monitoring Reader at each exact resource scope.
- The same operator has Cost Management Contributor at the exact subscription scope. Human access lasts through preflight, deployment, and confirmation, then expires or is removed through the approved access process.
- The observability, application, gateway, tool, security operations, AI quality, data-protection, cost, and service owners are present or have delegated decisions.