Review a managed AI architecture for region, identity, retention, and portability

Review a proposal that sends EU customer documents through a managed model endpoint, managed vector store, hosted agent runtime, and third-party tool connector. The diagram lists product names but not data paths, identities, retention, regional behavior, quotas, or recovery. Produce the questions, required changes, decision record, and validation plan needed before approval.

Browser -> application API -> managed agent runtime -> managed retrieval -> model endpoint
Agent runtime -> third-party ticketing connector
Unknowns: where uploaded files and traces persist, which identity each hop uses, whether every feature is available in-region,
          what happens at quota exhaustion, and how workflows move if the agent runtime is replaced.

• Trace each data class through every control plane, data plane, log, cache, and support path.
• Use workload identity and least-privilege authorization rather than shared static keys.
• Verify current regional availability and retention for the exact features used.
• Define quota, outage, support, and data-recovery behavior.
• Keep domain workflow state and critical policy outside provider-specific agent internals.
• Test portability through interfaces and exported artifacts rather than claiming full vendor neutrality.

1. Rewrite the product diagram as a data-flow and trust-boundary diagram with data classes, identities, and regions.
2. Create a responsibility matrix for application controls, provider controls, connector controls, and shared obligations.
3. Verify retention, training use, diagnostic capture, deletion, residency, encryption, and support-access settings.
4. Map quotas, concurrency, failure modes, fallback eligibility, and degraded operation for every dependency.
5. Define portable contracts for model invocation, retrieval, tools, evaluations, and workflow state while documenting provider-specific value.
6. Approve only after configuration tests, permission tests, regional probes, deletion checks, load tests, failure drills, and an explicit decision record.

architecture_decision:
  data_classes:
    customer_document:
      allowed_regions: [eu]
      model_training: prohibited
      content_telemetry: prohibited
      retention_days: 30
  identities:
    app_to_model: workload_identity:model-invoke
    app_to_retrieval: workload_identity:tenant-scoped-search
    agent_to_ticketing: delegated_connector:ticket-comment-only
  failure_policy:
    quota_exhausted: queue_or_degrade
    regional_outage: no_cross_region_failover_without_policy_approval
  portability:
    domain_workflow_state: application_database
    eval_dataset_and_results: exportable
    provider_specific_features: [managed_grounding_guardrail]
  validation:
    - regional_endpoint_probe
    - least_privilege_permission_test
    - retention_and_deletion_test
    - quota_and_outage_game_day

The review cost grows with dependencies, regions, data classes, and connector operations. A concise responsibility matrix prevents the same control from being assumed by everyone and owned by no one.

• The model endpoint is regional, but tracing or abuse-monitoring data follows a different policy.
• A managed feature is unavailable in-region and the SDK silently selects another endpoint.
• A connector uses end-user delegation for reads but a shared service credential for writes.
• Provider export covers files but not agent memory or evaluation history.
• The fallback route meets availability goals but violates residency or schema requirements.

• Add an out-of-region telemetry sink and require the review to catch it.
• Remove one managed agent feature and verify domain state allows a simpler workflow replacement.
• Exhaust quota and require a defined user-visible degraded mode.
• Delete a customer document and verify derived files, vectors, caches, and traces follow policy.
• Attempt a connector operation beyond its approved scope and require deterministic denial.

• A list of cloud product names is not an architecture or a data-flow assessment.
• A regional endpoint does not prove every associated store and diagnostic path stays in-region.
• Provider-managed security does not authorize application users or enforce tenant boundaries.
• Calling an adapter portable while workflow state lives inside one hosted runtime understates lock-in.
• An untested fallback is only a diagram, not a recovery capability.