Enterprise Generative Search — Azure and Open Source  ·  View 36 of 41  ·  Assurance

Security Zones

Five trust zones, and every flow that crosses one.

Editable source SVG draw.io All views
Internet Browser and mobile managed devices Public web sources crawled, untrusted Attacker or a poisoned document Edge Front Door and WAF TLS 1.3, bot rules API Management token validation, quota DDoS protection standard tier Application Search Gateway no source credentials Planner and retrieval acts as the caller Policy Engine OPA, decisions logged Tool Broker egress allowlist Model and GPU Self-hosted models no egress, no internet Azure OpenAI private endpoint Content Safety screens both directions Data Azure AI Search private endpoint only PostgreSQL CMK, no public route ADLS Gen2 immutable raw Key Vault workload identity only HTTPS, Entra token private link filtered query fenced context crawled, screened injection attempt short-lived credential Security Zones — Trust Boundaries and What Crosses Them External / third party Risk / gap Security / platform Interface / broker Application we own Data store synchronous batch failure / alternate The only inbound path is Front Door. Every data service refuses public traffic, and no application pod holds a long-lived secret. v 1.0 · owner Data and AI Global Practice

Decisions

  • One inbound path: Front Door. Every data service refuses public traffic, and every application pod authenticates with workload identity rather than a stored secret.
  • Self-hosted models have no internet egress at all. A model that cannot reach the network cannot be talked into exfiltrating anything, regardless of what a document tells it.
  • The attacker is drawn on the page. A poisoned document arriving through a legitimate connector is the realistic threat, not someone attacking the login page.

What crosses which boundary

  • Internet to edge: HTTPS with an Entra token, WAF and bot rules.
  • Application to model: a fenced context containing evidence that is never read as instruction.
  • Application to data: a filtered query carrying the caller's group set — the only way content leaves the data zone.

Risks

  • Azure OpenAI is outside our trust zone even over a private endpoint. What we send it is bounded by the context assembly rules in view 25 and by the sensitive-data controls in view 39.
  • Crawled public content is untrusted by definition and is screened at index time; it can still be wrong, which is why source authority weighting exists in view 24.
◀  Cost Model All views Identity and Authorisation  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 41 views · Microsoft Azure and open source36-security-zones