AI Code Completion Service  ·  View 06 of 21  ·  People and journeys

Journey — Switching On a Tenant

The adoption path, which begins with a security review that usually goes badly.

Editable source SVG draw.io All views
Platform admin with a security reviewer behind them Goal — Give the whole estate completion without giving away the estate's code Trigger — A budget approval and a security review that has not started well Done when — Seats live, zero retention proved, and a usage figure they trust 1 · Ask security review 2 · Configure policy + geo 3 · Pilot one repo group ◆ moment of truth 4 · Roll out 5 · Account for it ◆ moment of truth 6 · Revoke What they do Asks where code goes Sets zero retention Pins the geography Enables 40 engineers Assigns 4,000 seats Reads cost per accept Revokes a leaver What the platform does Shows the data path Refuses cross-region spill Scoped retrieval index Caches policy, fails strict Attributes GPU seconds Effective in 60 s How it feels Trusting Wary Blocked Where it hurts "Disabled" is not absent Policy conflicts silently Index leaks private repo Bill is per request Credential still valid What answers it Privacy by absence Declared precedence ACL at request time Restrictive on cold cache Cost per accepted Short-lived tokens Journey — Switching It On For 4,000 Engineers The first trough is the review, and it is answered structurally: the retaining path does not exist rather than being switched off. v 1.0 · owner Developer Experience Architecture · date 2026-10

The first trough is the review

  • "Retention is disabled" is a configuration claim, and a reviewer is right to discount it. The answer offered here is structural: for a zero-retention tenant the retaining path does not exist.
  • The second trough is accounting — a bill expressed per request tells an administrator nothing about whether the spend bought anything.

Decisions

  • Policy precedence is declared (tenant over group over developer) and the effective policy for a request is inspectable, because a silent conflict is indistinguishable from a bug.
  • A cold policy cache fails to the more restrictive policy, so an availability problem can never become a disclosure.
  • Usage is reported as cost per displayed and per accepted suggestion, on the same figures used for billing.

Assumptions

  • Seat revocation effective for new requests within 60 s; policy cache staleness ≤ 30 s.
  • Geography pinning refuses rather than spills when the declared region is unavailable.
◀  Journey — Promoting a Model All views Layered Architecture  ▶
Solution Architecture v1.0 · Microsoft Azure · Developer Experience Architecture · 2026-10 · 21 views · 15 architecture decision records06-journey-switching-on-a-tenant