Foundry AI Operations

Foundry AI Operations

Turn an Azure AI Foundry operations request into provisioning steps, model deployment commands, managed identity configuration, endpoint checks, and operational evidence for the Open Horizons H3 Innovation layer.

When to invoke

• "Provision Azure AI Foundry resources."
• "Deploy and manage OpenAI models."
• "Configure RAG pipelines with AI Search."
• "Monitor token usage and costs."
• "Test model endpoints."

Prerequisites and context

• Azure CLI authenticated (az login).
• Subscription with AI services quota.
• Terraform H3 modules applied, or manual provisioning approved.
• Project files to consult: terraform/modules/ai-foundry/ and scripts/golden-paths/ for checked-in Golden Path scaffolding.

Procedure

Provisioning

1. Create AI Foundry Resources (via Terraform)

# Deploy H3 Innovation layer (includes AI Foundry)
cd terraform
terraform plan -var-file=environments/dev.tfvars -var="enable_h3=true" -out=tfplan
terraform apply tfplan

# Or via bootstrap script
./scripts/platform-bootstrap.sh --horizon h3 --environment dev

2. Create Resources (via Azure CLI)

# Create Cognitive Services account (OpenAI)
az cognitiveservices account create \
  --name "${PROJECT}-${ENV}-openai" \
  --resource-group "${RG_NAME}" \
  --kind OpenAI \
  --sku S0 \
  --location eastus2 \
  --custom-domain "${PROJECT}-${ENV}-openai" \
  --tags environment="${ENV}" project="${PROJECT}"

# Create AI Search service
az search service create \
  --name "${PROJECT}-${ENV}-search" \
  --resource-group "${RG_NAME}" \
  --sku standard \
  --partition-count 1 \
  --replica-count 1

# Create model deployment (GPT-4o)
az cognitiveservices account deployment create \
  --name "${PROJECT}-${ENV}-openai" \
  --resource-group "${RG_NAME}" \
  --deployment-name gpt-4o \
  --model-name gpt-4o \
  --model-version "2024-05-13" \
  --model-format OpenAI \
  --sku-capacity 30 \
  --sku-name Standard

3. Configure Managed Identity Access

# Assign Cognitive Services User role to AKS identity
az role assignment create \
  --assignee "${AKS_IDENTITY_PRINCIPAL_ID}" \
  --role "Cognitive Services User" \
  --scope "/subscriptions/${SUB_ID}/resourceGroups/${RG_NAME}/providers/Microsoft.CognitiveServices/accounts/${PROJECT}-${ENV}-openai"

# Get endpoint
az cognitiveservices account show \
  --name "${PROJECT}-${ENV}-openai" \
  --resource-group "${RG_NAME}" \
  --query "properties.endpoint" -o tsv

Day-2 Operations

Resource Management

# List AI Foundry workspaces
az ml workspace list -o table

# Show workspace details
az ml workspace show --name <workspace> --resource-group <rg>

# List compute resources
az ml compute list --workspace-name <workspace> --resource-group <rg>

OpenAI Deployments

# List Cognitive Services accounts
az cognitiveservices account list -o table

# List deployments
az cognitiveservices account deployment list \
  --name <account> --resource-group <rg> -o table

# Check quota usage
az cognitiveservices usage list --location eastus2 -o table

Model Testing

# Test chat completion
curl -X POST "https://<endpoint>.openai.azure.com/openai/deployments/<deployment>/chat/completions?api-version=2024-02-15-preview" \
  -H "Content-Type: application/json" \
  -H "api-key: ${OPENAI_API_KEY}" \
  -d '{"messages":[{"role":"user","content":"Hello"}],"max_tokens":100}'

# Test with managed identity (from AKS pod)
curl -X POST "https://<endpoint>.openai.azure.com/openai/deployments/<deployment>/chat/completions?api-version=2024-02-15-preview" \
  -H "Content-Type: application/json" \
  -H "Authorization: ******" \
  -d '{"messages":[{"role":"user","content":"Hello"}]}'

Best practices

1. Configure content safety filters on all deployments.
2. Implement rate limiting and retry logic.
3. Use managed identity for authentication (never API keys in code).
4. Monitor token usage and set cost alerts.
5. Enable diagnostic logging for compliance.
6. Use private endpoints for production.
7. Deploy models in LATAM-nearest region with quota.

Output template

Return exactly this structure:

AI Foundry Operations Result

**Status:** PASS | FAIL | BLOCKED
**Summary:** One sentence describing the Foundry provisioning, deployment, or operations outcome.

### Details
- Command executed: `command or not run`
- Resource status: workspace, Cognitive Services account, AI Search, deployment, or endpoint state
- Deployment details: model deployment, SKU, region, identity, endpoint, or RAG configuration
- Recommendations: operational next steps, cost controls, logging, or safety filters

### Validation
- Azure context: PASS | FAIL | SKIPPED with subscription, resource group, and evidence
- Command result: PASS | FAIL | SKIPPED with exit code or observed output
- Endpoint or resource check: PASS | FAIL | SKIPPED with endpoint, deployment, or query evidence

Limits

• Do not use this skill for general Azure architecture.
• Use azure-infrastructure (skill) instead when designing landing zones, networking, identity, naming, tagging, or private connectivity patterns.
• Do not use this skill for Terraform execution.
• Use terraform-cli (skill) instead when running Terraform plans or applies.
• Do not use this skill for Kubernetes operations.
• Use kubectl-cli (skill) instead when operating AKS workloads.
• Do not use this skill for agent design patterns.
• Use foundry-agent-blueprint (skill) instead when mapping an agent design to Foundry primitives.

Related primitives

Quality gate

• name matches the ai-foundry-operations directory.
• The request matches positive Foundry operations triggers.
• Required Azure context, quota, and H3 prerequisites are stated or checked.
• Commands preserve their original flags, resource names, model names, API versions, and paths.
• Managed identity and private endpoint best practices are considered before delivery.
• The response follows the output template with validation evidence.