AI Platform: Decisions¶

Condensed design decisions of the solution, taken from the project conventions and the module code. The source does not contain formal decision records, so each entry states the decision and the reason that can be read from the code.

One shared Foundry account, one project per workload¶

All workloads share one account, every workload gets a project. The project is the isolation boundary for connections, the identity, files and agent data, while quota and models stay central. Status: in use by the module design.

Model deployments are managed at platform level¶

The project module does not create model deployments. This keeps quota management central and consistent across projects. Consequence: a workload team asks the platform team for a model or for quota.

Identity instead of keys¶

The account has local authentication disabled, connections use Entra ID, and the project and the workload each have a user-assigned managed identity. Access for people goes through groups. Consequence: no keys to rotate, but role assignments must be right before something works.

User-assigned identities¶

User-assigned identities are created by Terraform before the resources that use them. This allows role assignments to be made up front and keeps identity creation separate from resource creation (the workload_identity module exists for this reason).

AzAPI for Foundry resources¶

Account, project, connections and capability host are created with the azapi provider, because azurerm does not fully support them. Consequence: the API version is pinned in the code and schema validation is switched off, so review plans carefully.

Network injection and private endpoints¶

Agents run in a subnet of the spoke (network injection, own subnet instead of a Microsoft-managed network). Services are reached through private endpoints. See Architecture.

Shared data stores with per-project collections¶

Cosmos DB and AI Search are shared. Projects get their own collections and role assignments, and a storage account per project. Consequence: a platform-wide limit or incident on these services affects all projects.

Data-only lookup modules¶

platform_data and project_data let workload code find platform resources without remote state or hard-coded IDs. Trade-off: the names in platform_data are fixed per deployment (see Known issues).

Modules first, deployment code later¶

The first phase delivers modules. Deployment roots follow, in the order shared platform, projects, workloads. The backend configuration is passed at terraform init and never stored in the repository.