RVAP, Real Value Acceleration Program

Chapter 1 of 6 · Scope and outcomes

CI/CD, policy as code, and controlled promotion

Runtime assurance 4 hours in a non-production POC
View implementation files

Chapter 1 of 6

Session scope#

What we will do#

Objective. Move exactly one verified release through nonproduction and production without losing track of which commit is actually live.

An authorized operator supplies workflow_dispatch.release_sha. The workflow proves that the full SHA belongs to the protected default branch, then ties every gate, approval, deployment, route, and release record to that one SHA before promoting it.

Why it matters#

Problem. Code, AI configuration, gate results, approvals, and routing can drift apart across pipeline stages, so a gate that passed somewhere doesn't guarantee what's actually running in production.

Solution. Tying every stage to one commit SHA stops that drift, and the workflow reruns Session 09's known blocked tool-process case before Azure sees a preview or approval.

Boundaries#

GitHub Actions controls this promotion path across four environments that separate preview from apply; Microsoft Entra validates the workload identities. Azure Resource Manager holds deployment state, API Management holds routing state, and the approved release store holds the release record. The enterprise agent inventory stays authoritative for agent records. The control definition keeps only the framework decision, the duplicate-review outcome, and a reference to the reviewed inventory record. The workflow consumes the Governed agent baseline guide agent, APIM AI gateway guide route, Foundry evaluation gate guide release gate, Threat-defense guide security-release attestation, and Observability and cost operations guide smoke check as inputs, and those systems stay authoritative for their own state.

The control covers changes made through these workflows; it does not make an out-of-path deployment safe or trigger automatic restore. The multiregion rehearsal tests moving the resulting selector across regions.

Session preparation

Who should join

  • AI application, platform, and release engineers
  • GitHub, Microsoft Entra, Azure, and API Management administrators
  • Quality, security, routing, production-approval, and delivery owners

What you need

  • An approved release control set can be inspected: release metadata binds one commit to the immutable agent, APIM policy, evaluation inputs, and Bicep parameters; the quality owner can retrieve a passing release-gate result; the security owner can retrieve the matching adversarial result; and the observability owner can run the smoke check. (Sessions 04, 06, and 08-12.)
  • Release metadata binds the prompt, agent, model, APIM policy, evaluation inputs, and Bicep parameters to one commit. Supply the approved full SHA through the protected workflow input, never inside that commit.
  • The approved Session 09 release policy is enabled. Its temporary external baseline and candidate records match the policy run IDs, the callable gate passes the candidate, and the generated tool-process self-test returns BLOCK.
  • The approved temporary workspace contains a confirmed, payload-free Session 10 security-release attestation for the same immutable agent and versions. It records external authorization and report locations, lower aggregate attack success, per-risk non-regression, and blocked prohibited actions. SOC delivery remains separate.
  • The Session 11 PowerShell and Bash smoke executables verify the release commit, live Application Insights workspace binding, distinct normal and failure trace IDs, stable ingestion, separated tool and model failures, no sensitive input, and no retained payload.
  • The unit-check, routing, release/security-store, and environment-parameter owners have accepted their files. The delivery owner has recorded those decisions.
  • GitHub environments nonproduction-preview, nonproduction, production-preview, and production are configured. Both apply environments require reviewers and prevent self-review; production also restricts deployment refs and disables administrator bypass.
  • Native secret scanning and push protection are enabled. The protected nonproduction environment holds the Session 11 URLs, Application Insights resource ID, Log Analytics workspace ID, bearer-token secret, and optional timeout and retry overrides.
  • The nonproduction and production workload service principals each trust their exact preview and apply GitHub OIDC subjects. Each principal has only Contributor (role ID b24988ac-6180-42a0-ab88-20f7382dd24c) at its environment resource-group scope.
  • GitHub and Entra administrators use temporary access for configuration and preflight. The preflight operator has temporary Directory Readers at tenant scope and Contributor at both exact environment resource-group scopes. Remove or expire human access after the ready check.
  • The approved release/security-store interface retrieves temporary Session 09 and 10 records, and stages, approves, or retrieves a release record by exact release ID and SHA-256. Promotion approves the record only after routing; restore consumes an approved record.
  • The agent owner has approved the framework and runtime path for the release agent: its native platform path, Microsoft Agent Framework, Semantic Kernel, or another framework with an approval reference and a named runtime support owner.
  • The portfolio owner has compared the release agent against the enterprise agent inventory and decided whether it is a new capability, an approved overlap, or a duplicate of an agent that should be promoted instead. Record the reviewed inventory record and the deciding role.
  • Release, quality, security, production-approval, routing, platform, observability, and delivery authorities are named and available for live decisions.

Session 12

CI/CD, policy as code, and controlled promotion slide deck

Open in a new tab