Repository navigation
Add network-isolated Foundry IQ recipe for prompt and hosted agents - #53
Draft
Farzad Sunavala (farzad528) wants to merge 5 commits into
Draft
Farzad Sunavala (farzad528) wants to merge 5 commits into
Farzad Sunavala (farzad528) wants to merge 5 commits into
Conversation
Contributor
🔍 PreviewA live preview of this PR is available at: |
A checklist-driven, IT-admin cookbook that proves Foundry IQ (Azure AI Search Knowledge Bases) and the Foundry Agent Service consuming it over MCP run fully inside a customer VNet. Every command and output was executed against a real West US 3 deployment and verified against 9 acceptance criteria (AC1-AC9), including an off-VNet negative test that returns 403 publicNetworkAccess:Disabled. Covers choosing BYO VNet vs. Managed VNet, a Bastion-first developer flow, and an appendix documenting a validated Network Security Perimeter (NSP) pattern that runs with the Azure trusted-service bypass turned OFF. - notebooks/network-isolated-foundry-iq.ipynb - notebooks/data/network-isolated-foundry-iq/ (NERC CIP / grid sample docs) - notebooks/media/network-isolated-foundry-iq/ (screenshot placeholders) - registry.yaml entry (tags: iq, azure-ai-search, security, agents, agent-service, mcp) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Farzad Sunavala (farzad528)
force-pushed
the
farzad528/network-isolated-foundry-iq
branch
from
June 18, 2026 09:53
bb7e674 to
22a0c97
Compare
Co-authored-by: Elisa Piccin <elisapiccin+microsoft@microsoft.com>
Preserve every registry entry and the existing custom-schema notebook change while incorporating current main. Add project-scoped recipe-author and cookbook-review requirements with honest evidence and scoring gates, without automatic execution. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Farzad Sunavala (farzad528)
changed the title
Import revision-pinned private-lab infrastructure and both agent definitions, preserve all live controls as blocked, and add fail-closed classifier, request, and prefix regressions. Record actual clean-kernel outputs, local Bicep compilation, honest scores, unapproved pricing inputs, and a portable SVG architecture. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Provide immutable notebook and helper permalinks plus clone-checkout guidance for draft PR readers. Preserve relative executable data paths, record the tested asset revision, and wrap long prose without site changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Farzad Sunavala (farzad528)
September 23, 2026 14:39
View session
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Critical validation, authorization, and publication blockers remain, and live Azure controls are unverified.
Review effort: Lite
Findings: 4
Open (8)
What changed in this PR
Adds an offline-tested, network-isolated Microsoft Foundry IQ recipe with private networking, prompt/hosted agents, infrastructure, and evidence tooling. Live Azure controls remain blocked.
Changes:
- Adds recipe documentation, fixtures, provenance, and architecture assets.
- Adds private-network Bicep infrastructure, RBAC, monitoring, and hosted-agent configuration.
- Adds offline verification, regression tests, approval gates, and deployment tooling.
| File | Summary |
|---|---|
registry.yaml |
Critical: publication is enabled despite blocked live controls and the stated draft status. |
notebooks/media/network-isolated-foundry-iq/01-private-paths.svg |
Adds the network architecture diagram. |
notebooks/media/network-isolated-foundry-iq/.gitkeep |
Reserves recipe media storage. |
notebooks/data/network-isolated-foundry-iq/verify.py |
Critical: truthy placeholders and malformed evidence can pass verification. |
notebooks/data/network-isolated-foundry-iq/test_offline.py |
Adds offline verifier regressions. |
notebooks/data/network-isolated-foundry-iq/test_assets.py |
Validates recipe assets and infrastructure. |
notebooks/data/network-isolated-foundry-iq/substation-incident-response-runbook.md |
Adds fictional retrieval data. |
notebooks/data/network-isolated-foundry-iq/scada-network-segmentation-standard.md |
Adds fictional retrieval data. |
notebooks/data/network-isolated-foundry-iq/review.md |
Records scoring and readiness blockers. |
notebooks/data/network-isolated-foundry-iq/requirements.txt |
Pins notebook dependencies. |
notebooks/data/network-isolated-foundry-iq/reproduce-original-isolation-classifier.py |
Reproduces baseline classifier behavior. |
notebooks/data/network-isolated-foundry-iq/README.md |
Documents operation and limitations. |
notebooks/data/network-isolated-foundry-iq/provenance.json |
Records source and validation provenance. |
notebooks/data/network-isolated-foundry-iq/original-classifier-reproduction.json |
Stores baseline reproduction results. |
notebooks/data/network-isolated-foundry-iq/nerc-cip-access-control-policy.md |
Adds fictional retrieval data. |
notebooks/data/network-isolated-foundry-iq/LICENSE-foundry-samples.txt |
Preserves vendored sample licensing. |
notebooks/data/network-isolated-foundry-iq/lab.py |
Provides bounded lab operations and receipts. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/vnet.bicep |
Defines the standard VNet. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/validate-search-aad-auth.bicep |
Guards Search authentication configuration. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/validate-existing-resources.bicep |
Validates existing resource references. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/subnet.bicep |
Defines delegated subnets. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/standard-dependent-resources.bicep |
Defines Search, Storage, and Cosmos resources. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/private-endpoint-and-dns.bicep |
Moderate: BYO accounts are reconstructed in the current scope instead of using the cross-scope resource ID. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/network-agent-vnet.bicep |
Selects a new or existing VNet. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/monitor-private-link-scope.bicep |
Defines private monitoring links. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/format-project-workspace-id.bicep |
Formats project workspace identifiers. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/existing-vnet.bicep |
Moderate: cross-subscription VNet references omit the subscription scope. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/cosmosdb-account-role-assignment.bicep |
Adds Cosmos account role assignments. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/cosmos-container-role-assignments.bicep |
Adds Cosmos container roles. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/container-registry.bicep |
Defines the private container registry. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/blob-storage-container-role-assignments.bicep |
Adds scoped Blob roles. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/azure-storage-account-role-assignment.bicep |
Adds the storage account role. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/application-insights.bicep |
Moderate: local authentication is disabled while tracing uses only an ApiKey-backed connection. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/application-insights-role-assignment.bicep |
Adds monitoring role assignments. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/ai-search-role-assignments.bicep |
Critical: the runtime receives Search Contributor rather than the narrower read-only role. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/ai-project-identity.bicep |
Defines project identity and connections. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/ai-account-identity.bicep |
Creates or references the Foundry account identity. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/add-project-capability-host.bicep |
Defines the project capability host. |
notebooks/data/network-isolated-foundry-iq/infra/standard/modules-network-secured/add-account-capability-host.bicep |
Defines the account capability host. |
notebooks/data/network-isolated-foundry-iq/infra/standard/main.bicep |
Moderate: the BYO-account capability-host module lacks the derived cross-scope deployment. |
notebooks/data/network-isolated-foundry-iq/infra/parameters.example.json |
Provides unresolved deployment parameters. |
notebooks/data/network-isolated-foundry-iq/infra/network.bicep |
Defines isolated networking and runners. |
notebooks/data/network-isolated-foundry-iq/infra/main.bicep |
Composes the disposable lab deployment. |
notebooks/data/network-isolated-foundry-iq/infra/knowledge-resources.bicep |
Defines embeddings, Blob, Search, and related links. |
notebooks/data/network-isolated-foundry-iq/hosted/uv.toml |
Enables system certificates for hosted dependencies. |
notebooks/data/network-isolated-foundry-iq/hosted/pyproject.toml |
Defines hosted-agent dependencies. |
notebooks/data/network-isolated-foundry-iq/hosted/main.py |
Implements the hosted Responses agent. |
notebooks/data/network-isolated-foundry-iq/hosted/egress_probe.py |
Moderate: default redirects can forward canary requests to another host. |
notebooks/data/network-isolated-foundry-iq/hosted/Dockerfile |
Defines the hosted image. |
notebooks/data/network-isolated-foundry-iq/hosted/azure.yaml |
Configures hosted deployment. |
notebooks/data/network-isolated-foundry-iq/hosted/.dockerignore |
Restricts image build context. |
notebooks/data/network-isolated-foundry-iq/evidence.schema.json |
Defines the evidence projection schema. |
notebooks/data/network-isolated-foundry-iq/evidence.json |
Stores blocked offline evidence. |
notebooks/data/network-isolated-foundry-iq/definitions.py |
Moderate: generated toolbox output omits the required tool name and uses an inconsistent server label. |
notebooks/data/network-isolated-foundry-iq/cost-inputs.json |
Stores candidate pricing inputs. |
notebooks/data/network-isolated-foundry-iq/configure_agents.py |
Gates prompt-agent configuration behind approval. |
notebooks/data/network-isolated-foundry-iq/approval.example.json |
Provides an approval envelope template. |
notebooks/data/network-isolated-foundry-iq/.gitignore |
Excludes credentials and local artifacts. |
notebooks/azure-ai-search-custom-schema-citations.ipynb |
Adds Search citation prerequisites. |
.github/github-app.yml |
Adds repository-scoped authoring and review guidance. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+20
to
+24
| resource searchIndexDataContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| scope: searchService | ||
| name: guid(projectPrincipalId, searchIndexDataContributorRole.id, searchService.id) | ||
| properties: { | ||
| principalId: projectPrincipalId |
Comment on lines
+87
to
+89
| required = ("source", "indexer", "status", "shared_links", "expected_targets", "source_content_evidence", "embedding_evidence", "sku") | ||
| if not all(observation.get(k) for k in required): | ||
| return Result(Status.BLOCKED, "Missing ingestion readback, source content or embedding evidence") |
Comment on lines
+148
to
+152
| keys = ("invocation_id", "canary_positive_control", "canary_ownership_evidence", | ||
| "allowed_dependency_success", "network_deny_evidence", "runtime_identity_evidence") | ||
| if not all(receipt.get(k) for k in keys) or receipt.get("canary_received") is not False: | ||
| return Result(Status.INCONCLUSIVE, "Need allowed dependency, positive control and correlated deny evidence") | ||
| return Result(Status.PASS, "Task-owned canary denial corroborated from the required runtime") |
Comment on lines
+272
to
+276
| - slug: network-isolated-foundry-iq | ||
| path: notebooks/network-isolated-foundry-iq.ipynb | ||
| title: "Verify Private Retrieval with Foundry IQ" | ||
| description: "Build a disposable BYO-VNet lab for one Blob-backed knowledge base and two agents, then distinguish network isolation from authorization failures. Live verification is pending." | ||
| date: "2026-05-29" |
Comment on lines
+101
to
+104
| return {"description": "The same private Blob-backed KB, using the observed hosted agent identity.", | ||
| "tools": [{"type": "mcp", "server_label": "knowledge-base", "server_url": mcp_endpoint(c), | ||
| "project_connection_id": c["hosted_connection"], "require_approval": "never", | ||
| "allowed_tools": ["knowledge_base_retrieve"]}]} |
| nonce = str(uuid.UUID(nonce)) | ||
| request = Request(origin.rstrip("/") + "/canary/" + nonce, method="GET") | ||
| try: | ||
| with urlopen(request, timeout=10) as response: |
Comment on lines
+56
to
+57
| DisableLocalAuth: true | ||
| } |
| // Reference the existing virtual network | ||
| resource existingVNet 'Microsoft.Network/virtualNetworks@2024-05-01' existing = { | ||
| name: vnetName | ||
| scope: resourceGroup(vnetResourceGroupName) |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
This draft now contains an offline-tested foundation for BYO-VNet Microsoft Foundry and Foundry IQ: one private Blob-backed hybrid knowledge base, separate prompt-agent and hosted-agent source/configuration, pinned infrastructure, and a fail-closed evidence harness.
Recipe:
network-isolated-foundry-iq· Author: Farzad Sunavala (@farzad528)Reviewed asset snapshot · Updated notebook
Verification performed
github-tokeninput is emptyPreview prerequisite: the base-branch workflow requires the repository secret
FORGEBOOK_TEAM_READ_TOKENfor its contributor-team membership check. A maintainer must configure an appropriately scoped, organization-authorized token and rerun the failed deployment workflow. This revision does not bypass the authorization gate or alter credentials. An existing preview URL must not be treated as proof that this final commit was deployed.The original classifier was reproduced from its pinned revision with mocked transports: five of eight error fixtures falsely passed isolation. The corrected tests reject those false positives. That is offline regression evidence, not Azure evidence.
Readiness and remaining work
Not production-ready and not ready to merge. All 17 required live controls remain BLOCKED. No Azure resources were provisioned or changed and no live model/agent/KB invocations were performed for this revision.
I will report the controls actually exercised, their evidence, and their limits. A finite test suite cannot prove that a setup is “100% secure,” and private endpoints do not place every Azure PaaS or Foundry platform component inside a customer-owned VNet. Preview dependencies remain explicitly labeled.
Before publication:
Current review score: upstream Forgebook ten-axis rubric 73/100. The factory adds a learning-objectives axis: 78/105 (74.3/100 normalized). These are disclosed draft scores, not a fabricated 100/100; live evidence and incomplete adapters remain publication blockers.
Documentation anchors
The draft stays open until these acceptance gates and the remaining implementation are resolved.