You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Build and deploy a **Foundry Hosted Agent** governed end-to-end by the **Agent
49
+
Governance Toolkit (AGT)**, and read its audit trail in Application Insights.
50
+
- Publish a Foundry Agent as a governed **Agent-to-Agent (A2A)** endpoint through APIM.
51
+
- Understand how an **MCP server** is published and consumed through APIM, including
52
+
where this lab's automation stops short (Entra app-registration/app-role setup) and
53
+
what a facilitator needs to add to unlock that exercise.
54
+
55
+
## Scenario
56
+
57
+
You are onboarding your organization onto a **Citadel Agentic Governance Hub**: a single
58
+
Azure API Management gateway that every model call and every agent must pass through, so
59
+
platform, security, and compliance teams get one place to see and control AI usage.
60
+
61
+
Your lab automation deploys:
62
+
63
+
- A **Hub** resource group containing APIM, a governance Foundry account/project, Log
64
+
Analytics, Application Insights, Cosmos DB (usage tracking), Event Hub, and Key Vault.
65
+
- A **Spoke** resource group (folded into the same RG) containing a sample Foundry
66
+
account/project and Azure Container Registry — where you build and deploy the agents
67
+
the later challenges call for.
68
+
69
+
Each challenge exercises one governance capability against these resources, using the
70
+
Citadel workshop's own Jupyter notebooks — unmodified, and already fully documented with
71
+
their own numbered sections, so the challenge files here exist to orient you and point
72
+
you at the right notebook, not to restate what's already in it.
73
+
74
+
## Requirements
75
+
76
+
To complete this MicroHack you'll need:
77
+
78
+
- Your lab's attendee credentials (`HackboxCredential` values) from the MicroHack
79
+
dashboard — resource group, subscription, and the Spoke Foundry/Key Vault/ACR names.
80
+
-`azd` installed, so [`setup-notebook-env.ps1`](labautomation/README.md#notebook-environment-setup)
81
+
can bridge those credentials into a local `azd` environment the (unchanged) workshop
82
+
notebooks read via `azd env get-value`.
83
+
- The Azure CLI (`az`), logged in (`az login`) against your lab's subscription/tenant.
84
+
- The workshop's Python environment set up (`uv sync` — see
85
+
[`challenges/workshop/readme.md`](challenges/workshop/readme.md) — or
86
+
`pip install -r requirements.txt` from the `challenges/workshop/` folder).
87
+
- Comfort running and reading Jupyter notebooks in VS Code.
88
+
89
+
> [!TIP]
90
+
> **You're ready to start when** you've run `setup-notebook-env.ps1` once with your
91
+
> dashboard's credentials (see [Challenge 1, Part A](challenges/challenge-01.md)) and can
92
+
> open the first workshop notebook without any `azd env get-value` errors.
93
+
94
+
## Challenges
95
+
96
+
This MicroHack is divided into nine challenges. Challenges 1–6 build up the core
97
+
governance model (backends → universal API → access contracts → agent frameworks → PII →
98
+
unified API); challenges 7–8 graduate to hosted, governed agents and agent-to-agent
99
+
publishing; challenge 9 covers MCP publishing and is **optional/instructor-led**, since it
100
+
needs infrastructure this lab's automation doesn't provision on its own.
101
+
102
+
### Challenge structure
103
+
104
+
Each challenge follows the same anatomy, so you always know where to look:
105
+
106
+
| Section | Description |
107
+
|---------|-------------|
108
+
| 🎯 **Objective**| What you'll achieve and why it matters |
109
+
| 🧭 **Context**| The Hub/Spoke resources and prerequisites this exercise relies on |
110
+
| ✅ **Tasks**| Confirm your notebook bridge, then run the notebook's own sections in order |
111
+
| 🏁 **Success criteria**| A checklist to confirm you're done |
112
+
| 🛠️ **Troubleshooting**| Common problems and their fixes |
113
+
| 🚀 **Go further**| Optional stretch goals if you finish early |
114
+
| 📚 **Learning resources**| Docs to go deeper |
115
+
116
+
### Challenge list
117
+
118
+
-**Challenge 1**: **[Onboard a New LLM Backend](challenges/challenge-01.md)***(35 min)* — onboard a backend into the hub and prove it through multiple API shapes.
119
+
-**Challenge 2**: **[Universal LLM API Across Every Model](challenges/challenge-02.md)***(25 min)* — validate `/models` against every model with no RBAC restriction.
120
+
-**Challenge 3**: **[Access Contracts: Model RBAC & Capacity](challenges/challenge-03.md)***(35 min)* — three access contracts enforcing `allowedModels` and capacity limits.
121
+
-**Challenge 4**: **[Drive Access Contracts from Agent Frameworks](challenges/challenge-04.md)***(30 min)* — the same contracts, driven from three different agent frameworks.
122
+
-**Challenge 5**: **[PII Anonymization, Blocking & Analytics](challenges/challenge-05.md)***(35 min)* — mask, block, and analyze PII at the gateway.
123
+
-**Challenge 6**: **[Unified AI API Across Providers](challenges/challenge-06.md)***(35 min)* — one API surface across Azure OpenAI, Foundry inference, Responses API, and Gemini-compatible patterns.
124
+
-**Challenge 7**: **[Build a Governed Hosted Agent with AGT](challenges/challenge-07.md)***(40 min)* — deploy a Foundry Hosted Agent governed end-to-end by the Agent Governance Toolkit.
125
+
-**Challenge 8**: **[Publish a Foundry Agent as an A2A Endpoint](challenges/challenge-08.md)***(35 min)* — publish and call an agent-to-agent endpoint through APIM.
126
+
-**Challenge 9***(optional / instructor-led)*: **[HR MCP via APIM](challenges/challenge-09.md)***(variable)* — publish and consume an MCP server through APIM; requires facilitator-provisioned infrastructure beyond this lab's automation.
127
+
128
+
> [!TIP]
129
+
> It's tempting to race through, but pause after each challenge and read the notebook's
130
+
> own `📊 Results Summary` cell — that's where the "why this matters for governance"
0 commit comments