PoC → Prod in one page · companion to the Sphera Azure AI Blueprint Handbook
| Component | Production home |
|---|---|
| Claude / Anthropic | Azure AI Foundry · direct API = failover |
| nginx | Front Door+WAF → APIM; nginx only internal |
| AI-DLC | Stage gates G1–G6 in Azure DevOps |
| Hermes agents | Azure Container Apps · Managed Identity · MCP |
| Git | Azure DevOps/GitHub · PR gates · secrets scan |
| RAG | Azure AI Search (hybrid) + Jina emb/rerank |
| Pendo | Keep → feedback feeds eval set |
| Juno* | Verify vendor → fold into agent/copilot layer |
| Jina | Embeddings-v3 + reranker-v1 (or Azure OpenAI emb) |
| Databricks | Lakehouse + Unity Catalog → indexer → AI Search |
| MS Teams | Adaptive Cards = human-in-the-loop approvals |
| Azure core | Entra ID · Key Vault · App Insights · budgets |
| # | Rule | Guardrail |
|---|---|---|
| 1 | Secrets → Key Vault + Managed Identity | gitleaks in CI · purge history |
| 2 | LLM calls via gateway wrapper only | retry · fallback · budget · trace |
| 3 | Package by layer (retrieval/ llm/ agents/ api/) | 80% coverage gate |
| 4 | Validate I/O with Pydantic/structured output | retry-on-parse · safe degrade |
| 5 | Retrieved data = untrusted, never instructions | injection filter · tool allowlist |
| 6 | Trace every call: prompt hash/tokens/cost/latency | App Insights + tracing |
| 7 | Pin prompt & model versions in a registry | deploy = release · rollback < 5 min |
| 8 | Golden-set evals in CI (50→200 Q/A) | no eval delta → no deploy |
| 9 | Model tiering + caching + token caps | Azure budget alerts 50/80/100% |
| 10 | Entra ID auth + APIM JWT + RBAC roles | per-tenant data isolation |
| Decision | Call |
|---|---|
| Model access | AI Foundry primary · direct = failover |
| Gateway | APIM (auth, quotas, analytics) |
| Compute | Container Apps · Functions for ingestion |
| Vector search | AI Search serving · Databricks = curation |
| Embeddings | Jina vs Azure OpenAI — let evals decide |
| Secrets | Key Vault — non-negotiable |
| Tracing | Managed tracing (Langfuse / Azure GenAI tracing) |
| Phase | Weeks | Exit |
|---|---|---|
| Foundation | 1–2 | IaC landing zone deploys from one command |
| Harden | 3–6 | CI green + eval baseline recorded |
| Migrate | 7–10 | Parallel-run parity ≥ 95% |
| GA | 11–12 | Canary → 100% · AIDLC G1–G6 signed |
.env in repojson.loads() on raw model output| Security | Reliability | Quality | Ops |
|---|---|---|---|
| ☐ Key Vault + MI everywhere ☐ Entra SSO + RBAC ☐ Private endpoints + WAF ☐ PII redaction + injection filters ☐ Pen test / threat model |
☐ Retry/fallback chains ☐ Health checks + scale-to-zero ☐ Rollback < 5 min ☐ Load test at 3× peak ☐ Error rate < 2% |
☐ Golden set ≥ 50 Q/A ☐ Groundedness ≥ 99% ☐ Citations in answers ☐ Evals in CI gate ☐ Pendo feedback loop |
☐ Dashboards + alerts ☐ Cost budgets 50/80/100% ☐ Runbooks tested ☐ Trace per request ☐ AIDLC G1–G6 sign-off |