Governed Azure AI Foundry Architecture Diagram

Zero-Trust Identity

Entra Workload Identities replace static keys across all services
APIM verifies user JWT claims and enforces tenant rate limits
Key Vault stores only legacy connection secrets with rotation

Enterprise Safety Gates

Foundry Content Safety filters jailbreaks, PII, and harmful output
CRM connector enforces read-only queries; updates require human click in CRM UI
AI Search enforces document-level ACLs before passing context to LLM

Hub & Project Topology

Platform team owns shared Hub, compute capacity, and policy boundaries
Product teams deploy app orchestrators into project subnets
Full audit trail and cost attribution captured in Log Analytics