Chapter 4 of 6
Decisions and stop conditions#
Resolve every __REQUIRED_*__ value before a state change. Use team aliases, not personal data. Keep subscription IDs, resource IDs, endpoints, credentials, connection strings, and customer data out of source control.
| Gate | Continue when | Stop when |
|---|---|---|
| Scope | Azure CLI targets the approved nonproduction subscription, deployment group, Application Insights component, workspace, action group, and budget scope | Any target is production, shared without approval, or outside the recorded scope |
| Telemetry | W3C context is continuous, correlation is non-sensitive, and gateway, agent, model, and tool results remain separate | A hop is missing, a field carries sensitive data, or a dimension is unbounded |
| Privacy | Filtering and redaction happen before export; standard content logging is disabled | Content capture is the default, cannot be filtered before export, or an exception lacks purpose, scope, owner, retention, expiry, and data-protection approval |
| Sampling | Metrics remain unsampled; approved error and security signals bypass normal trace sampling | The sampler breaks complete selected traces or a daily cap is treated as normal control |
| Alerts and cost | Thresholds come from baseline telemetry and approved SLOs; dimensions stay within APIM's limit of five custom dimensions, 100 values each, and 1,000 active series per metric | A threshold lacks an owner, dimensions contain users or free text, or a budget is presented as spend enforcement |
| External export | Export is disabled, or the customer records the destination, owner, payload filter, and restore reference | A SIEM route receives prompts, responses, credentials, personal data, or an unowned event stream |
| Preview | Both Bicep what-if results contain only the workbook, three alerts, and exact budget | A preview replaces unrelated resources, removes an action route, or targets the wrong subscription |
The gateway owner changes the APIM policy through its own repository. Do not replace an API-scope policy that contains gateway authentication, safety, routing, quota, token-limit, and rate-limit, or backend controls.