AI Code Completion Service  ·  View 20 of 21  ·  Assurance

Trust Zones and Network Segmentation

Five zones by decreasing exposure, and the plane that is allowed no egress at all.

Editable source SVG draw.io All views
Untrusted — the developer's machine Editor process untrusted client Open buffers never uploaded whole Local redaction Short-lived token refreshed Public edge — internet facing Front Door + WAF Seat authoriser Client version gate Per-seat rate limit Request plane — private, no inbound internet Prompt assembler Retrieval service Post-processor Safety filters Inference plane — no egress, tenant-partitioned cache GPU node pools egress denied KV cache partitioned by tenant Batch scheduler Control and data plane — private endpoints only Policy & seats Model registry Quality aggregates Key Vault / HSM Audit store append-only TLS, token bound authorised, deadline private endpoint prompt, tenant tagged metadata, scrubbed Trust Zones and Network Segmentation External / third party Data store Security / platform Interface / broker Decision point Application we own synchronous event / async The inference plane has no egress at all, and returns tokens rather than context: a model that cannot reach the internet cannot exfiltrate what it was given. v 1.0 · owner Developer Experience Architecture · date 2026-10

Decisions

  • The inference plane has no egress. A model process that cannot reach the internet cannot exfiltrate the context it was handed, whatever it was persuaded to generate.
  • The prefix cache is partitioned by tenant as a hard boundary: a content-keyed shared cache would turn the fleet's chief efficiency mechanism into its chief isolation risk.
  • The editor is treated as an untrusted client. Debounce, cancellation and local suppression live there; no policy decision, filter or quota is enforced only there.

Assumptions

  • All control and data stores are reachable only over private endpoints; tenant-scoped keys with a customer-managed option.
  • Client credentials are short-lived and refreshed by the editor; a revoked seat fails within 60 s.

Risks

  • Cross-tenant isolation inside a continuously batched accelerator is an assertion about a runtime, not a network control. The seventh core architecture question leaves open whether dedicated pools are required for the top tier.
◀  Model and Quality Lifecycle All views Identity, Seat and Policy Flow  ▶
Solution Architecture v1.0 · Microsoft Azure · Developer Experience Architecture · 2026-10 · 21 views · 15 architecture decision records20-trust-zones-and-network