Chapter 2 of 6 · Architecture

Regional failover rehearsal for a governed AI service

Operate at scale 3 hours in a non-production POC

Chapter 2 of 6

Architecture at a glance#

The customer health control checks the active path against the regional contract. It reports agent version, Entra identity, API Management policy version, endpoint, required trace fields, and whether sensitive input appeared.

The routing control previews the move to the secondary selector. The delivery owner approves the move. The wrapper checks the active secondary path, previews the return, restores the primary selector, and checks the primary path again.

The team checks the primary path, moves one selector to the secondary path, checks it, then restores and checks the primary path.
One approved selector directs traffic between primary and secondary API Management and Foundry paths.

Design choices and tradeoffs#

DecisionChosen approachBenefitCost and limitation
Change boundaryMove one named traffic selectorThe rehearsal avoids infrastructure and policy changesThe customer routing control must expose that selector
Path checkCompare health output with the regional contractOperators check all required path values togetherThe health control must return the documented fields
RestorePreview and approve the return moveThe team checks the primary path before closing the rehearsalThe delivery owner approves a second traffic move

Architecture guidance#

Session 13

Regional failover rehearsal for a governed AI service slide deck