3.5. Reflection Checkpoint

Key Takeaways

• A deployment is four orthogonal choices (model, version, capacity type, routing scope); match the constraint word — predictable vs. bursty, residency, latency — to the axis it governs.
• Quota is permission, not capacity; TPM sizes standard deployments (per deployment), PTU sizes provisioned (model-independent, reserved hourly).
• Security is layered: managed identity over keys, least-privilege RBAC (OpenAI User, not Owner), private endpoints/VNet for network origin, CMK only when key control is required (default encryption already exists).
• Cost controls stop spend; content safety stops harm — and a budget alert notifies while a TPM ceiling actually caps burn rate.
• Responsible-AI controls map to distinct threats: harm categories (content), prompt shields (injection), groundedness (hallucination), PII/protected material (sensitive/copyrighted).
• GenAIOps = DevOps + evaluation gates + AI observability; traces explain step-level agent behavior that metrics dashboards can't.

Connecting Forward

Phase 4 turns to information extraction — RAG and grounding as a first-class domain. This is where the grounding first principle from Phase 1 and the knowledge sources from Phase 2's agents become concrete: chunking, embeddings, Azure AI Search indexes, vector/hybrid/semantic retrieval, and Document Intelligence. The security, cost, and deployment decisions from this phase all constrain how you build that retrieval layer.

Self-Check Questions

• A production app has steady predictable traffic, an EU residency requirement, and a need to control its own encryption keys. Name the capacity type, routing scope, and data-protection control — and the requirement word that drives each.
• Distinguish the failure each of these prevents: a budget alert, a TPM ceiling, a prompt shield, and a harm-category threshold. Why can't any one of them substitute for another?