Enterprise hardening

Already shipping behind private endpoints with managed identity? Skip to the next lesson.

Pilots rarely die because the AI was bad. They die on networking, permissions and "my company will not let me do that". This lesson is the security review, written as code you run.

Three things to check

Network. By default your AI resource is reachable from the public internet. Companies do not allow that. A private endpoint gives the resource an address that only exists inside the company network.

There is a trap here worth knowing before it costs you a day. Private endpoints need private DNS, which is the address book that translates the name to that internal address. Turn on the endpoint without the DNS and every setting looks correct in the portal while every client fails to connect.

Identity. Module 7's rule, enforced. A managed identity is an identity Azure gives the application itself, so there is no key anywhere. A key sitting in application settings is a password that gets copied and never changed.

Content safety. Content filters check text going in and coming out. Both directions. Input only leaves whatever your own agent says unchecked.

What to write

You are writing the review, then using it.

1. review_network, review_identity and review_content_safety, each returning a list of problem codes
2. preflight(cfg), combining them all, sorted
3. Fix HARDENED until preflight finds nothing
4. Work the flags out from HARDENED rather than typing them, then run the loop

The check runs your review against PILOT, which has seven problems in it. A review that finds nothing in that config is not a review.

The point

The pilot failed on networking and identity, not on the prompt.

Break it on purpose

Make review_network return an empty list. Every flag still looks right and the check fails anyway, because a review that cannot say no protects nothing.