AI Code Completion Service  ·  View 21 of 21  ·  Assurance

Identity, Seat and Policy Flow

Fifteen messages. The twelfth is evaluated per request, and that is the point.

Editable source SVG draw.io All views
Developer Editor plugin Microsoft Entra ID Edge authoriser Policy cache Policy store Retrieval service Source hosting 1. signs in once 2. OIDC device code 3. token, 60 min 4. suggest + bearer token 5. verify signature, extract tenant 6. effective policy for seat 7. miss — read through 8. rules, precedence resolved 9. policy, ≤ 30 s stale 10. seat revoked or cold cache — refuse 11. authorised, with principal 12. may this principal read this repo? 13. scoped repo list 14. retrieve within scope only 15. context, provenance tagged Identity Flow — Seat, Policy and Repository Permission Message 12 is evaluated per request, not per index build: an index that outlives a permission change must not serve it. v 1.0 · owner Developer Experience Architecture · date 2026-10

Read message 12 first

  • Repository permission is resolved against the requesting principal at request time, not cached from index build. An index that outlives a permission change must not serve it.
  • Message 10 is the refusal path: a revoked seat or a cold policy cache both fail to the restrictive answer, so an availability problem can never become a disclosure.

Assumptions

  • Entra token lifetime 60 minutes, refreshed by the plugin; policy cache read-through with ≤ 30 s staleness.
  • Source hosting answers the per-principal scope question inside the context-assembly budget.

Risks

  • A synchronous permission check on the critical path is a dependency on a system this platform does not own, inside a 300 ms budget. Caching it is the obvious optimisation and the obvious way to leak a repository.
◀  Trust Zones and Network Segmentation All views
Solution Architecture v1.0 · Microsoft Azure · Developer Experience Architecture · 2026-10 · 21 views · 15 architecture decision records21-identity-seat-and-policy