Chapter 3 of 6
Confirm these requirements:
- An approved governed runtime can be inspected: the platform owner identifies the immutable agent and project, the gateway owner identifies the versioned APIM policy and tool path, the quality owner can retrieve the current evaluation result, and the security owner can retrieve the payload-free adversarial result and Defender route check. (The governed-agent, APIM, MCP security, threat-defense, and observability controls establish these prerequisites.)
- The nonproduction policy assistant and APIM route support an approved read-only request and a separate handled failure for a nonexistent synthetic policy.
- A workspace-based Application Insights component, its Log Analytics workspace, an action group, and an approved retention boundary exist.
- Application instrumentation is deployed. The customer-owned APIM policy already preserves W3C context and emits bounded token metrics.
- The Foundry agent type is recorded. Prompt and hosted agent tracing is generally available. Workflow and external agent tracing remains preview and requires an approved nonproduction preview-use decision.
- Baseline telemetry has been reviewed before owners set alert thresholds.
- The observability, application, gateway, tool, AI quality, security operations, data-protection, cost, and service owners can make their required decisions.
When prerequisite sessions were implemented elsewhere, verify:
| Control | Required state | Owner check |
|---|---|---|
| Runtime | The deployment record names the Foundry project, immutable agent version, Microsoft Entra agent identity, network path, versioned APIM policy, tool identities and scopes, and data-policy assignment | Platform, gateway, tool, and data owners confirm that one approved read-only request reaches the listed backend and tool |
| Tracing | OpenTelemetry and APIM propagate W3C traceparent and one non-sensitive correlation ID | Observability owner finds joined gateway, agent, model, and tool spans with separate results |
| Evaluation | The evaluation definition, threshold policy, and approved aggregate result name the deployed version | AI quality owner gets the recorded pass or block result from the release gate |
| Security | The payload-free adversarial summary, Defender onboarding state, and security-event route name the protected version | Security operations finds blocked prohibited actions and one expected signal in the listed Defender or SOC record |
The deployment operator needs:
- Monitoring Contributor at the exact deployment resource-group scope;
- Log Analytics Reader at the exact workspace scope;
- Monitoring Reader at the exact Application Insights and action-group resource scopes when either resource is outside the deployment group; and
- Cost Management Contributor at the exact subscription scope.
Human access lasts through preflight, deployment, and confirmation. Remove or expire it through the approved access process afterward.
Implementation files#
| Type | File | Consumer |
|---|---|---|
| Runtime | artifacts/telemetry/telemetry-contract.json | Application developers, the observability owner, and preflight scripts |
| Deployment | artifacts/infra/main.bicep | The Azure deployment pipeline |
| Deployment | artifacts/infra/main.bicepparam | The Azure deployment pipeline |
| Deployment | artifacts/monitoring/workbook.json | Operators and the workbook deployment |
| Runtime | artifacts/queries/request-error-rate-alert.kql | The request-error scheduled-query alert |
| Runtime | artifacts/queries/tool-failure-alert.kql | The tool-failure scheduled-query alert |
| Runtime | artifacts/queries/quality-safety-alert.kql | The quality and safety scheduled-query alert |
| Deployment | artifacts/cost/budget.bicep | The subscription deployment pipeline and cost owner |
| Deployment | artifacts/cost/budget.bicepparam | The subscription deployment pipeline |
| Record | artifacts/cost/cost-allocation.md | The cost owner |
| Record | artifacts/governance/data-retention-decision.md | The observability owner |
| Record | artifacts/governance/prompt-response-logging-decision.md | The privacy and observability owners |
| Record | artifacts/operations/incident-runbook.md | The incident commander and service operators |