.<\/p>\n\n\n\n
For the TechWyns NorthStar architecture<\/strong>, I would make the TechWyns Orchestrator<\/strong> the explicit control plane between the experience layer and the multi-agent\/tool estate.<\/p>\n\n\n\n The design below is the production-oriented implementation I recommend.<\/p>\n\n\n\n The critical architectural distinction is:<\/p>\n\n\n\n The LLM proposes what should happen; the Orchestrator’s deterministic policy layer decides what is actually allowed to happen.<\/strong><\/p>\n<\/blockquote>\n\n\n\n That is essential for an enterprise\/regulatory environment.<\/p>\n\n\n\n Microsoft’s current Foundry architecture supports Prompt Agents and Hosted Agents, and Hosted Agents are specifically intended for code-based\/custom orchestration. Foundry also provides managed toolboxes, A2A, observability and managed identities.<\/p>\n\n\n\n Every request follows this pipeline:<\/p>\n\n\n\n Foundry Toolboxes are now the recommended reusable-tool mechanism because they provide a managed MCP endpoint with centralized authentication, governance, versioning and reuse across agents.<\/p>\n\n\n\n I would initially register these agents:<\/p>\n\n\n\n The orchestrator should not<\/strong> blindly call every agent.<\/p>\n\n\n\n For example:<\/p>\n\n\n\n Whereas:<\/p>\n\n\n\n Independent agents should execute concurrently.<\/p>\n\n\n\n Microsoft Agent Framework currently provides concurrent, sequential, handoff, group-chat and Magentic orchestration patterns; the implementation can use those primitives where appropriate, while retaining a-specific policy layer around them.<\/p>\n\n\n\n Do not<\/strong> do this:<\/p>\n\n\n\n Instead:<\/p>\n\n\n\n The model never grants itself authorization<\/strong>.<\/p>\n\n\n\n The planner produces a structured plan:<\/p>\n\n\n\n Notice the execution groups:<\/p>\n\n\n\n That gives you both parallelism and dependency control<\/strong>.<\/p>\n\n\n\n The orchestrator should never have dozens of individual backend connections.<\/p>\n\n\n\n Instead:<\/p>\n\n\n\n Toolboxes are particularly useful here because the same tool set can be consumed by multiple agents without embedding tool configuration in every agent.<\/p>\n\n\n\n I’ve created the reference implementation as a downloadable project:<\/p>\n\n\n\n Download the Orchestrator reference implementation<\/strong><\/p>\n\n\n\n It contains:<\/p>\n\n\n\n The heart of the implementation is:<\/p>\n\n\n\n The important part is that planning and authorization are separate<\/strong>.<\/p>\n\n\n\n The orchestrator uses parallel execution for independent work:<\/p>\n\n\n\n So:<\/p>\n\n\n\n This is much better than:<\/p>\n\n\n\n because the independent operations can run concurrently.<\/p>\n\n\n\n The orchestrator connects to the registered Foundry agents:<\/p>\n\n\n\n Then:<\/p>\n\n\n\n Current Microsoft documentation supports connecting to both Prompt Agents and Hosted Agents through This is arguably more important than the LLM planner.<\/p>\n\n\n\n This prevents:<\/p>\n\n\n\n Instead:<\/p>\n\n\n\n For example:<\/p>\n\n\n\n Agent Framework currently supports approval-required function tools and exposes approval requests so the application can pause and obtain explicit approval.<\/p>\n\n\n\n For, I would extend this to a formal:<\/p>\n\n\n\n Keep the registry outside the LLM.<\/p>\n\n\n\n Example:<\/p>\n\n\n\n This gives you:<\/p>\n\n\n\n This should eventually become part of your broader Agent Governance \/ Agent 365<\/strong> plane.<\/p>\n\n\n\n Foundry currently supports agent registry\/lifecycle capabilities and integration with Agent 365.<\/p>\n\n\n\n The code uses an abstraction:<\/p>\n\n\n\n The production topology is:<\/p>\n\n\n\n The reference implementation uses APIM as the backend boundary so that the orchestration code isn’t tightly coupled to individual systems.<\/p>\n\n\n\n I would create these:<\/p>\n\n\n\n Toolboxes can bundle MCP, OpenAPI, Azure AI Search, A2A and other supported tools behind a managed MCP interface.<\/p>\n\n\n\n The orchestrator should not duplicate SimpleChat or Foundry memory<\/strong>.<\/p>\n\n\n\n Use:<\/p>\n\n\n\n Use for:<\/p>\n\n\n\n Use for:<\/p>\n\n\n\n Use for:<\/p>\n\n\n\n But:<\/p>\n\n\n\n AI Search is not the canonical source of truth.<\/strong><\/p>\n<\/blockquote>\n\n\n\n The orchestrator must understand the difference between:<\/p>\n\n\n\n Therefore:<\/p>\n\n\n\n Memory should never become regulatory truth.<\/p>\n\n\n\n Every specialist agent should ideally return:<\/p>\n\n\n\n Then:<\/p>\n\n\n\n Only then should synthesis happen.<\/p>\n\n\n\n The synthesizer receives:<\/p>\n\n\n\n Its job is not<\/strong> to perform another investigation.<\/p>\n\n\n\n It should:<\/p>\n\n\n\n And it must not expose:<\/p>\n\n\n\n Every orchestration request should generate:<\/p>\n\n\n\n The trace should look like:<\/p>\n\n\n\n Foundry currently provides tracing, metrics, evaluations and Application Insights integration, and Microsoft documents evaluating deployed interactions from captured Application Insights traces.<\/p>\n\n\n\n The orchestrator should never simply fail the entire request because one agent failed.<\/p>\n\n\n\n Example:<\/p>\n\n\n\n Response:<\/p>\n\n\n\n \u201cThe investigation and market analyses completed successfully. The compliance analysis was unavailable because the compliance service timed out. The conclusions below therefore exclude an independent compliance assessment.\u201d<\/p>\n<\/blockquote>\n\n\n\n That is much safer than hallucinating a compliance conclusion.<\/p>\n\n\n\n Use:<\/p>\n\n\n\n But never blindly retry writes<\/strong>.<\/p>\n\n\n\n For mutation operations:<\/p>\n\n\n\n must be required.<\/p>\n\n\n\n For agent-to-agent communication:<\/p>\n\n\n\n A2A should be used when the agent itself needs to delegate to another independent agent.<\/p>\n\n\n\n Foundry currently supports A2A connections and recommends using a Toolbox to expose A2A connections as reusable governed tools.<\/p>\n\n\n\n I recommend making the Orchestrator itself a Foundry Hosted Agent<\/strong> rather than putting orchestration logic inside a Prompt Agent.<\/p>\n\n\n\n Why?<\/p>\n\n\n\n Because you need:<\/p>\n\n\n\n Hosted Agents are specifically designed for code-based agents and can expose managed Responses\/Invocations endpoints.<\/p>\n\n\n\n The Foundry hosted-agent contract currently expects the container to listen on port I would formally define its responsibilities as:<\/p>\n\n\n\n The resulting architecture becomes:<\/p>\n\n\n\n This makes the Orchestrator the architectural \u201cbrainstem\u201d of the NorthStar\u2014not another agent.<\/strong> It is the governed control plane that decides which agents, which tools, in what order, with what context, under whose authorization, and with what evidence<\/strong>.<\/p>\n\n\n\n The downloadable project above is the baseline implementation; I would next turn this into the full production repo with Bicep\/Terraform, Foundry agent definitions, Toolbox\/MCP definitions, APIM policies, Cosmos\/Redis memory, Entra app roles, Application Insights telemetry, evaluation datasets, CI\/CD and Teams\/M365\/SimpleChat integration<\/strong>.<\/p>\n\n\n\n Today 7:49 PM<\/p>\n\n\n\n Give me verbose step by step instructions, design and code to setup Mcp server that will integrate with Microsoft ai foundry agents<\/p>\n\n\n\n Absolutely. For your NorthStar<\/strong>, I recommend treating MCP as the shared tool protocol<\/strong>, and Foundry Toolbox as the governed tool-management layer<\/strong> around your MCP servers.<\/p>\n\n\n\n The production topology I would use is:<\/p>\n\n\n\n Microsoft currently supports connecting Foundry Agent Service to remote MCP servers, including custom servers hosted on Azure Functions. Microsoft also recommends Foundry Toolboxes when you want to centrally curate, govern, version and reuse MCP tools across agents.<\/p>\n\n\n\n MCP is not another AI agent<\/strong>.<\/p>\n\n\n\n It is a standardized interface between an agent and tools\/data.<\/p>\n\n\n\n For:<\/p>\n\n\n\n The MCP server exposes tools such as:<\/p>\n\n\n\n The LLM never needs to know:<\/p>\n\n\n\n It only sees a strongly typed tool.<\/p>\n\n\n\n You could connect every Foundry agent directly to your MCP server:<\/p>\n\n\n\n But that becomes difficult to govern.<\/p>\n\n\n\n Instead:<\/p>\n\n\n\n The Toolbox provides one managed MCP-compatible endpoint and supports centralized configuration, authentication, governance and versioning. You can promote a new Toolbox version to default without changing every consuming agent.<\/p>\n\n\n\n For your NorthStar, this is the better enterprise pattern<\/strong>.<\/p>\n\n\n\n Don’t build one enormous MCP server with 100 tools.<\/p>\n\n\n\n Create logical tool domains.<\/p>\n\n\n\n You can initially deploy these as one service with logical tool groups, then split them into separate servers later.<\/p>\n\n\n\n You have three good options.<\/p>\n\n\n\n Microsoft provides an official Azure Functions MCP pattern and a remote MCP Functions template. The current Microsoft documentation shows:<\/p>\n\n\n\n as the MCP endpoint.<\/p>\n\n\n\n For a Python MCP server using the current MCP Python SDK, this is my preferred implementation pattern.<\/p>\n\n\n\n You own:<\/p>\n\n\n\n and Container Apps supplies:<\/p>\n\n\n\n Container Apps also supports built-in Microsoft Entra authentication.<\/p>\n\n\n\n Use AKS if eventually requires:<\/p>\n\n\n\n For your current NorthStar, Container Apps or Functions is sufficient<\/strong>.<\/p>\n\n\n\n Because your architecture already contains APIM, private endpoints, managed identities and a Orchestrator:<\/p>\n\n\n\n This provides a clean separation:<\/p>\n\n\n\n Foundry<\/strong><\/p>\n\n\n\n \u2192 agent intelligence<\/p>\n\n\n\n CFTC Orchestrator<\/strong><\/p>\n\n\n\n \u2192 routing and coordination<\/p>\n\n\n\n Toolbox<\/strong><\/p>\n\n\n\n \u2192 tool governance<\/p>\n\n\n\n MCP Server<\/strong><\/p>\n\n\n\n \u2192 tool implementation<\/p>\n\n\n\n APIM<\/strong><\/p>\n\n\n\n \u2192 API\/security gateway<\/p>\n\n\n\n CFTC APIs<\/strong><\/p>\n\n\n\n \u2192 system of record<\/p>\n\n\n\n I’m using the current MCP Python SDK v2<\/strong> in the implementation below.<\/p>\n\n\n\n Important current change: the current SDK uses:<\/p>\n\n\n\n rather than the older:<\/p>\n\n\n\n The SDK’s v2 line renamed Use Python 3.13 for this implementation, which also aligns with Microsoft’s current custom Azure Functions MCP-server guidance.<\/p>\n\n\n\n Create:<\/p>\n\n\n\n Activate it.<\/p>\n\n\n\n macOS\/Linux:<\/p>\n\n\n\n Windows:<\/p>\n\n\n\n Install:<\/p>\n\n\n\n The official MCP SDK currently supports Streamable HTTP, SSE and stdio; Streamable HTTP is the appropriate remote deployment transport.<\/p>\n\n\n\n Create:<\/p>\n\n\n\n Create 1. TechWyns Orchestrator \u2014 role<\/h2>\n\n\n\n
CFTC EXPERIENCE LAYER\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 SimpleChat \u2502 Teams \u2502 M365 Copilot \u2502 Web \u2502 Mobile \u2502 APIs \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Azure API Manager \u2502\n \u2502 Auth \u2022 Rate \u2022 Policy \u2502\n \u2502 Correlation \u2022 Routing \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 TechWyns ORCHESTRATION LAYER \u2551\n \u2551 \u2551\n \u2551 1. Identity \/ Context \u2551\n \u2551 2. Intent Detection \u2551\n \u2551 3. Planning & Reasoning \u2551\n \u2551 4. Agent Selection \u2551\n \u2551 5. Tool Selection \u2551\n \u2551 6. Parallel \/ Sequential Execution \u2551\n \u2551 7. Context & Memory Management \u2551\n \u2551 8. Authorization \/ Policy Enforcement \u2551\n \u2551 9. Human Approval \u2551\n \u2551 10. Error \/ Retry \/ Fallback \u2551\n \u2551 11. Evidence \/ Citation Validation \u2551\n \u2551 12. Response Synthesis \u2551\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n \u2502 \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 MULTI-AGENT ESTATE \u2502 \u2502 TOOLBOX \u2502\n \u2502 \u2502 \u2502 \u2502\n \u2502 Research Agent \u2502 \u2502 Knowledge Toolbox \u2502\n \u2502 Investigation Agent \u2502 \u2502 Case Toolbox \u2502\n \u2502 Market Agent \u2502 \u2502 Market Toolbox \u2502\n \u2502 Compliance Agent \u2502 \u2502 Document Toolbox \u2502\n \u2502 Document Agent \u2502 \u2502 Communication \u2502\n \u2502 Executive Agent \u2502 \u2502 Enterprise Tools \u2502\n \u2502 Evidence Agent \u2502 \u2502 MCP \/ OpenAPI \u2502\n \u2502 Safety \/ Quality Agent \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 Foundry IQ \u2502 AI Search \u2502 Cosmos DB \u2502 Redis \u2502 APIs \u2502\n \u2502 SharePoint \u2502 Blob \u2502 Databases \u2502 Enterprise Systems \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/code><\/pre>\n\n\n\n\n
\n\n\n\n2. Core orchestration flow<\/h1>\n\n\n\n
USER\n \u2502\n \u25bc\nEntra Authentication\n \u2502\n \u25bc\nAPIM\n \u2502\n \u251c\u2500\u2500 JWT validation\n \u251c\u2500\u2500 throttling\n \u251c\u2500\u2500 correlation ID\n \u251c\u2500\u2500 tenant context\n \u2514\u2500\u2500 API policy\n \u2502\n \u25bc\nORCHESTRATOR\n \u2502\n \u251c\u2500\u2500\u25ba Load conversation\/context\n \u2502\n \u251c\u2500\u2500\u25ba Load authorized user\/case context\n \u2502\n \u251c\u2500\u2500\u25ba Intent classification\n \u2502\n \u251c\u2500\u2500\u25ba Planning\n \u2502\n \u251c\u2500\u2500\u25ba Policy validation\n \u2502\n \u251c\u2500\u2500\u25ba Approval check\n \u2502\n \u251c\u2500\u2500\u25ba Agent selection\n \u2502\n \u251c\u2500\u2500\u25ba Tool selection\n \u2502\n \u251c\u2500\u2500\u25ba Execute\n \u2502 \u251c\u2500\u2500 Agent A\n \u2502 \u251c\u2500\u2500 Agent B\n \u2502 \u251c\u2500\u2500 Agent C\n \u2502 \u251c\u2500\u2500 Tool A\n \u2502 \u2514\u2500\u2500 Tool B\n \u2502\n \u251c\u2500\u2500\u25ba Evidence reconciliation\n \u2502\n \u251c\u2500\u2500\u25ba Citation validation\n \u2502\n \u251c\u2500\u2500\u25ba Response synthesis\n \u2502\n \u2514\u2500\u2500\u25ba Telemetry \/ audit \/ memory\n \u2502\n \u25bc\nRESPONSE<\/code><\/pre>\n\n\n\n
\n\n\n\n3. Agent routing model<\/h1>\n\n\n\n
Agent<\/th> Primary responsibility<\/th> Risk<\/th><\/tr><\/thead> Research Agent<\/td> Regulations, policy, procedures<\/td> Low<\/td><\/tr> Investigation Agent<\/td> Cases\/evidence\/investigations<\/td> High<\/td><\/tr> Market Surveillance Agent<\/td> Markets\/trading patterns<\/td> High<\/td><\/tr> Compliance Agent<\/td> Compliance analysis<\/td> Medium<\/td><\/tr> Document Agent<\/td> Extraction\/comparison\/summarization<\/td> Medium<\/td><\/tr> Evidence Agent<\/td> Evidence validation<\/td> High<\/td><\/tr> Executive Briefing Agent<\/td> Executive reports<\/td> Low<\/td><\/tr> Communication Agent<\/td> Approved correspondence<\/td> High<\/td><\/tr> Safety\/Quality Agent<\/td> Grounding\/security\/quality<\/td> High<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \"What does regulation X require?\"\n \u2502\n \u25bc\nResearch Agent\n \u2502\n \u25bc\nFoundry IQ\n \u2502\n \u25bc\nResponse<\/code><\/pre>\n\n\n\n\"Analyze case 123 and determine whether the trading\n activity warrants further investigation.\"\n\n \u2502\n \u25bc\nOrchestrator\n \u2502\n \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc\nInvestigation Market Surveillance\nAgent Agent\n \u2502 \u2502\n \u25bc \u25bc\nCase Toolbox Market Toolbox\n \u2502 \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u25bc\n Evidence Agent\n \u2502\n \u25bc\n Quality \/ Citation Agent\n \u2502\n \u25bc\n Executive Synthesizer<\/code><\/pre>\n\n\n\n
\n\n\n\n4. The most important security boundary<\/h1>\n\n\n\n
LLM\n \u2502\n \u251c\u2500\u2500 \"userId = 123\"\n \u251c\u2500\u2500 \"caseId = 456\"\n \u2514\u2500\u2500 \"I'm authorized\"<\/code><\/pre>\n\n\n\nEntra Token\n \u2502\n \u25bc\nAPIM\n \u2502\n \u25bc\nTrusted Request Context\n \u2502\n \u251c\u2500\u2500 authenticatedUserId\n \u251c\u2500\u2500 tenantId\n \u251c\u2500\u2500 roles\n \u251c\u2500\u2500 groups\n \u251c\u2500\u2500 case permissions\n \u2514\u2500\u2500 classification clearance\n \u2502\n \u25bc\n Policy Engine\n \u2502\n \u25bc\n Agent \/ Tool access<\/code><\/pre>\n\n\n\n
\n\n\n\n5. Planning contract<\/h1>\n\n\n\n
{\n \"objective\": \"Analyze authorized case activity\",\n \"steps\": [\n {\n \"kind\": \"agent\",\n \"target\": \"investigation-agent\",\n \"reason\": \"Analyze case facts and evidence\",\n \"risk\": \"high\",\n \"parallel_group\": 1\n },\n {\n \"kind\": \"agent\",\n \"target\": \"market-surveillance-agent\",\n \"reason\": \"Analyze trading patterns\",\n \"risk\": \"high\",\n \"parallel_group\": 1\n },\n {\n \"kind\": \"agent\",\n \"target\": \"compliance-agent\",\n \"reason\": \"Assess regulatory implications\",\n \"risk\": \"medium\",\n \"parallel_group\": 1\n },\n {\n \"kind\": \"agent\",\n \"target\": \"evidence-agent\",\n \"reason\": \"Validate supporting evidence\",\n \"risk\": \"high\",\n \"parallel_group\": 2\n },\n {\n \"kind\": \"agent\",\n \"target\": \"executive-briefing-agent\",\n \"reason\": \"Synthesize verified findings\",\n \"risk\": \"low\",\n \"parallel_group\": 3\n }\n ]\n}<\/code><\/pre>\n\n\n\nGROUP 1\n \u251c\u2500\u2500 Investigation\n \u251c\u2500\u2500 Market\n \u2514\u2500\u2500 Compliance\n \u2502\n \u25bc\nGROUP 2\n \u2514\u2500\u2500 Evidence Validation\n \u2502\n \u25bc\nGROUP 3\n \u2514\u2500\u2500 Executive Synthesis<\/code><\/pre>\n\n\n\n
\n\n\n\n6. Toolbox architecture<\/h1>\n\n\n\n
TOOLBOX\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 \u2502 \u2502\n \u25bc \u25bc \u25bc\n Knowledge Case Market\n Toolbox Toolbox Toolbox\n \u2502 \u2502 \u2502\n \u25bc \u25bc \u25bc\n Foundry IQ Case API Market API\n AI Search Evidence Surveillance\n \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc\n Document Toolbox\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc \u25bc\n Blob SharePoint Content\n Understanding<\/code><\/pre>\n\n\n\n
\n\n\n\n7. Orchestrator repository<\/h1>\n\n\n\n
-orchestrator\/\n\u2502\n\u251c\u2500\u2500 app\/\n\u2502 \u251c\u2500\u2500 config.py\n\u2502 \u251c\u2500\u2500 models.py\n\u2502 \u251c\u2500\u2500 registry.py\n\u2502 \u251c\u2500\u2500 policy.py\n\u2502 \u251c\u2500\u2500 tool_gateway.py\n\u2502 \u251c\u2500\u2500 memory.py\n\u2502 \u251c\u2500\u2500 observability.py\n\u2502 \u251c\u2500\u2500 orchestrator.py\n\u2502 \u2514\u2500\u2500 host.py\n\u2502\n\u251c\u2500\u2500 config\/\n\u2502 \u251c\u2500\u2500 agents.yaml\n\u2502 \u2514\u2500\u2500 tools.yaml\n\u2502\n\u251c\u2500\u2500 prompts\/\n\u2502 \u251c\u2500\u2500 planner.md\n\u2502 \u2514\u2500\u2500 synthesizer.md\n\u2502\n\u251c\u2500\u2500 tests\/\n\u2502 \u251c\u2500\u2500 test_policy.py\n\u2502 \u2514\u2500\u2500 test_orchestrator.py\n\u2502\n\u251c\u2500\u2500 Dockerfile\n\u251c\u2500\u2500 pyproject.toml\n\u251c\u2500\u2500 .env.example\n\u2514\u2500\u2500 README.md<\/code><\/pre>\n\n\n\n
\n\n\n\n8. Core Orchestrator<\/h1>\n\n\n\n
class orchestrator:\n\n async def run(self, request):\n\n correlation_id = request.correlation_id or str(uuid4())\n\n request.correlation_id = correlation_id\n\n # 1. Generate execution plan\n plan = await self.plan(request)\n\n # 2. Enforce deterministic policy\n self.policy.validate_plan(request, plan)\n\n # 3. Stop for human approval\n if plan.requires_human_approval:\n return OrchestrationResponse(\n correlation_id=correlation_id,\n status=\"approval_required\",\n answer=(\n \"This request requires authorized human \"\n \"approval before execution.\"\n ),\n approval_required=True\n )\n\n # 4. Execute agents and tools\n agent_results, tool_results = await self._execute(\n plan,\n request\n )\n\n # 5. Synthesize\n final = await self.synthesizer.run(\n json.dumps({\n \"user_request\": request.input,\n \"agent_results\": [\n x.model_dump()\n for x in agent_results\n ],\n \"tool_results\": [\n x.model_dump()\n for x in tool_results\n ]\n })\n )\n\n # 6. Return governed response\n return OrchestrationResponse(\n correlation_id=correlation_id,\n status=\"completed\",\n answer=final.text,\n agents=agent_results,\n tools=tool_results\n )<\/code><\/pre>\n\n\n\n
\n\n\n\n9. Parallel execution<\/h1>\n\n\n\n
async def _execute(self, plan, request):\n\n groups = {}\n\n for step in plan.steps:\n groups.setdefault(\n step.parallel_group,\n []\n ).append(step)\n\n agents = []\n tools = []\n\n for group_id in sorted(groups):\n\n steps = groups[group_id]\n\n results = await asyncio.gather(\n *[\n self._run_agent(step, request)\n if step.kind == \"agent\"\n else self._run_tool(step, request)\n for step in steps\n ]\n )\n\n for step, result in zip(steps, results):\n\n if step.kind == \"agent\":\n agents.append(result)\n else:\n tools.append(result)\n\n return agents, tools<\/code><\/pre>\n\n\n\n GROUP 1\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc \u25bc\n Research Market Investigation\n \u2502 \u2502 \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u25bc\n GROUP 2\n \u2502\n \u25bc\n Evidence Agent\n \u2502\n \u25bc\n GROUP 3\n \u2502\n \u25bc\n Synthesizer<\/code><\/pre>\n\n\n\nResearch\n \u2193\nMarket\n \u2193\nInvestigation\n \u2193\nEvidence\n \u2193\nReport<\/code><\/pre>\n\n\n\n
\n\n\n\n10. Agent invocation<\/h1>\n\n\n\n
async def _make_agent(self, spec):\n\n kwargs = {\n \"project_endpoint\":\n settings.foundry_project_endpoint,\n\n \"agent_name\":\n spec.foundry_name,\n\n \"credential\":\n self.credential,\n\n \"timeout\":\n settings.agent_timeout_seconds,\n }\n\n if spec.foundry_version:\n kwargs[\"agent_version\"] = spec.foundry_version\n\n return FoundryAgent(**kwargs)<\/code><\/pre>\n\n\n\nagent = await self._make_agent(spec)\n\nresult = await agent.run(\n prompt\n)<\/code><\/pre>\n\n\n\nFoundryAgent<\/code>; Prompt Agents require an agent version, while Hosted Agents use the registered agent name.<\/p>\n\n\n\n
\n\n\n\n11. policy engine<\/h1>\n\n\n\n
class PolicyEngine:\n\n def validate_plan(self, request, plan):\n\n for step in plan.steps:\n\n if step.kind == \"agent\":\n\n spec = self.registry.agent(\n step.target\n )\n\n if spec.risk in (\n Risk.HIGH,\n Risk.CRITICAL\n ):\n plan.requires_human_approval = True\n\n else:\n\n spec = self.registry.tool(\n step.target\n )\n\n if (\n spec.requires_approval\n or spec.risk in (\n Risk.HIGH,\n Risk.CRITICAL\n )\n ):\n plan.requires_human_approval = True\n\n return plan<\/code><\/pre>\n\n\n\nPrompt injection\n \u2193\nLLM\n \u2193\n\"Call surveillance tool\"\n \u2193\n❌<\/code><\/pre>\n\n\n\nPrompt injection\n \u2193\nLLM proposes tool\n \u2193\nPolicy Engine\n \u2193\nAuthorization\n \u2193\nRisk evaluation\n \u2193\nApproval\n \u2193\nTool<\/code><\/pre>\n\n\n\n
\n\n\n\n12. Human approval<\/h1>\n\n\n\n
User:\n\"Run surveillance analysis and initiate enforcement workflow.\"\n\n \u2193\n\n Orchestrator\n \u2193\n Plan generated\n \u2193\n Policy Engine\n \u2193\n Enforcement = HIGH RISK\n \u2193\n STOP EXECUTION\n \u2193\n HUMAN APPROVAL\n \u2193\n Authorized user\n \u2193\n APPROVE\n \u2193\n Execute operation<\/code><\/pre>\n\n\n\nApproval Service\n\napprovalId\nrequestId\ncorrelationId\nuserId\nagent\ntool\noperation\nrisk\nreason\nrequestedAt\napprovedBy\napprovedAt\nexpiresAt\ndecision<\/code><\/pre>\n\n\n\n
\n\n\n\n13. agent registry<\/h1>\n\n\n\n
- name: investigation-agent\n description: Authorized case and investigation analysis\n risk: high\n enabled: true\n foundry_name:-investigation-agent\n foundry_version: \"1\"\n allowed_tools:\n - case-search\n - case-details\n - evidence-search<\/code><\/pre>\n\n\n\nAgent Registry\n \u2502\n \u251c\u2500\u2500 Identity\n \u251c\u2500\u2500 Version\n \u251c\u2500\u2500 Owner\n \u251c\u2500\u2500 Risk\n \u251c\u2500\u2500 Allowed tools\n \u251c\u2500\u2500 Data classification\n \u251c\u2500\u2500 Environment\n \u251c\u2500\u2500 Evaluation score\n \u2514\u2500\u2500 Status<\/code><\/pre>\n\n\n\n
\n\n\n\n14. Tool execution<\/h1>\n\n\n\n
class ToolGateway:\n\n async def call(\n self,\n tool_name,\n request,\n payload\n ):\n ...<\/code><\/pre>\n\n\n\nOrchestrator\n \u2502\n \u25bc\nToolbox\n \u2502\n \u25bc\nManaged MCP\n \u2502\n \u251c\u2500\u2500 Case API\n \u251c\u2500\u2500 Market API\n \u251c\u2500\u2500 Evidence API\n \u251c\u2500\u2500 Regulatory API\n \u251c\u2500\u2500 Document API\n \u2514\u2500\u2500 Enterprise Systems<\/code><\/pre>\n\n\n\n
\n\n\n\n15. Recommended production Toolboxes<\/h1>\n\n\n\n
-knowledge-toolbox<\/code><\/h3>\n\n\n\nFoundry IQ\nAI Search\nRegulations\nPolicies\nProcedures\nLegal documents\nApproved enterprise knowledge<\/code><\/pre>\n\n\n\n-case-toolbox<\/code><\/h3>\n\n\n\nCase search\nCase details\nEvidence search\nInvestigation timeline\nCase analytics<\/code><\/pre>\n\n\n\n-market-toolbox<\/code><\/h3>\n\n\n\nMarket data\nTrading activity\nSurveillance\nPattern detection\nMarket analytics<\/code><\/pre>\n\n\n\n-document-toolbox<\/code><\/h3>\n\n\n\nBlob\nSharePoint\nDocument Intelligence\nOCR\nExtraction\nComparison\nSummarization<\/code><\/pre>\n\n\n\n-communication-toolbox<\/code><\/h3>\n\n\n\nEmail\nTeams\nApproved correspondence\nBriefings\nReports\nNotifications<\/code><\/pre>\n\n\n\n-enterprise-toolbox<\/code><\/h3>\n\n\n\nMicrosoft Graph\nDatabases\nCRM\nEnterprise APIs\nPower BI\nDataverse\nOther approved systems<\/code><\/pre>\n\n\n\n
\n\n\n\n16. Memory architecture<\/h1>\n\n\n\n
MEMORY FABRIC\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 \u2502 \u2502\n \u25bc \u25bc \u25bc\n Redis Cosmos AI Search\n \u2502 \u2502 \u2502\n short-term durable semantic\n cache\/state enterprise retrieval\n \u2502 \u2502 \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n Orchestrator<\/code><\/pre>\n\n\n\nRedis<\/h3>\n\n\n\n
session cache\nworking context\nagent scratch\ntool-result cache\nrate limiting\nidempotency\ndistributed locks\ntemporary workflow state<\/code><\/pre>\n\n\n\nCosmos<\/h3>\n\n\n\n
durable enterprise memory\ndecision history\nepisodic summaries\ninstitutional context\nagent execution state\naudit metadata<\/code><\/pre>\n\n\n\nAI Search<\/h3>\n\n\n\n
semantic memory\nembeddings\nhybrid retrieval\nmemory discovery\nknowledge indexing<\/code><\/pre>\n\n\n\n\n
\n\n\n\n17. Foundry IQ remains authoritative<\/h1>\n\n\n\n
KNOWLEDGE\n \u2502\n \u2514\u2500\u2500 Foundry IQ\n \u2502\n \u251c\u2500\u2500 Regulations\n \u251c\u2500\u2500 Policies\n \u251c\u2500\u2500 Procedures\n \u2514\u2500\u2500 Approved content\n\nMEMORY\n \u2502\n \u2514\u2500\u2500 Context \/ continuity<\/code><\/pre>\n\n\n\nMemory says:\n\"User previously believed X\"\n\nFoundry IQ says:\n\"Current policy says Y\"\n\n \u2193\n\n Y WINS<\/code><\/pre>\n\n\n\n
\n\n\n\n18. Evidence contract<\/h1>\n\n\n\n
{\n \"agent\": \"market-surveillance-agent\",\n \"status\": \"completed\",\n \"confidence\": 0.91,\n \"findings\": [\n {\n \"finding\": \"Potential unusual trading pattern\",\n \"confidence\": 0.89,\n \"evidence\": [\n {\n \"source\": \"market-data\",\n \"reference\": \"MD-123\"\n }\n ]\n }\n ],\n \"warnings\": []\n}<\/code><\/pre>\n\n\n\nAgent Findings\n \u2502\n \u25bc\nEvidence Agent\n \u2502\n \u251c\u2500\u2500 validate source\n \u251c\u2500\u2500 validate permissions\n \u251c\u2500\u2500 validate freshness\n \u251c\u2500\u2500 validate citation\n \u2514\u2500\u2500 detect conflicts\n \u2502\n \u25bc\nVerified Evidence<\/code><\/pre>\n\n\n\n
\n\n\n\n19. Response synthesis<\/h1>\n\n\n\n
{\n \"user_request\": \"...\",\n \"agent_results\": [],\n \"tool_results\": [],\n \"evidence\": []\n}<\/code><\/pre>\n\n\n\nCOLLECT\n \u2193\nRECONCILE\n \u2193\nVALIDATE\n \u2193\nCITE\n \u2193\nEXPLAIN UNCERTAINTY\n \u2193\nSYNTHESIZE<\/code><\/pre>\n\n\n\ninternal chain of thought\nsystem prompts\nsecurity policy\ncredentials\nprivate agent messages<\/code><\/pre>\n\n\n\n
\n\n\n\n20. Observability<\/h1>\n\n\n\n
correlationId\nrequestId\nconversationId\nuserId\ntenantId\ncaseId\nchannel\norchestratorVersion\nplannerModel\nsynthesizerModel\nagentId\nagentVersion\ntoolName\ntoolVersion\nknowledgeSource\nmemoryHit\nlatency\ntokens\nestimatedCost\nauthorizationDecision\napprovalDecision\nevaluationScore\ncitationScore<\/code><\/pre>\n\n\n\nCorrelation:-839201\n\nAPIM\n \u2514\u2500\u2500 Orchestrator\n \u251c\u2500\u2500 Planner\n \u2502\n \u251c\u2500\u2500 Investigation Agent\n \u2502 \u251c\u2500\u2500 Case Toolbox\n \u2502 \u2514\u2500\u2500 Evidence Toolbox\n \u2502\n \u251c\u2500\u2500 Market Agent\n \u2502 \u2514\u2500\u2500 Market Toolbox\n \u2502\n \u251c\u2500\u2500 Compliance Agent\n \u2502 \u2514\u2500\u2500 Foundry IQ\n \u2502\n \u251c\u2500\u2500 Evidence Validator\n \u2502\n \u2514\u2500\u2500 Synthesizer<\/code><\/pre>\n\n\n\n
\n\n\n\n21. Failure handling<\/h1>\n\n\n\n
Investigation Agent SUCCESS\nMarket Agent SUCCESS\nCompliance Agent TIMEOUT\nEvidence Agent SUCCESS\n \u2502\n \u25bc\n Orchestrator\n \u2502\n \u251c\u2500\u2500 Continue\n \u251c\u2500\u2500 Mark compliance unavailable\n \u2514\u2500\u2500 Tell user<\/code><\/pre>\n\n\n\n\n
\n\n\n\n22. Retry policy<\/h1>\n\n\n\n
Transient error\n \u2502\n \u25bc\nRetry 1\n \u2502\n \u25bc\nRetry 2\n \u2502\n \u25bc\nCircuit breaker\n \u2502\n \u25bc\nFallback agent\/tool\n \u2502\n \u25bc\nDegraded response<\/code><\/pre>\n\n\n\nidempotencyKey\n+\napprovalId\n+\noperationId<\/code><\/pre>\n\n\n\n
\n\n\n\n23. A2A<\/h1>\n\n\n\n
Orchestrator\n \u2502\n \u251c\u2500\u2500 A2A\n \u25bc\nInvestigation Agent\n \u2502\n \u2514\u2500\u2500 A2A\n \u25bc\nEvidence Agent<\/code><\/pre>\n\n\n\n
\n\n\n\n24. Foundry Hosted Agent deployment<\/h1>\n\n\n\n
deterministic policy\nasync concurrency\ntimeouts\nretries\napproval gates\ncustom routing\ncustom telemetry\nmemory decisions\nagent registry\ntool registry\nenterprise integration<\/code><\/pre>\n\n\n\n8088<\/code>, provide \/readiness<\/code>, and expose at least \/responses<\/code> or \/invocations<\/code>.<\/p>\n\n\n\n
\n\n\n\n25. The Orchestrator’s final responsibility model<\/h1>\n\n\n\n
INTELLIGENCE<\/h3>\n\n\n\n
Intent\nPlanning\nRouting\nAgent selection\nTool selection\nContext assembly\nResponse synthesis<\/code><\/pre>\n\n\n\nCONTROL<\/h3>\n\n\n\n
Authorization\nPolicy\nRisk\nApproval\nData classification\nTenant isolation\nCase isolation<\/code><\/pre>\n\n\n\nEXECUTION<\/h3>\n\n\n\n
Agent calls\nTool calls\nParallelism\nSequencing\nRetries\nTimeouts\nFallbacks<\/code><\/pre>\n\n\n\nKNOWLEDGE<\/h3>\n\n\n\n
Foundry IQ\nAI Search\nWorkspace context\nLive APIs<\/code><\/pre>\n\n\n\nMEMORY<\/h3>\n\n\n\n
Redis\nCosmos\nFoundry memory\nSimpleChat memory\nSemantic memory<\/code><\/pre>\n\n\n\nGOVERNANCE<\/h3>\n\n\n\n
Agent registry\nTool registry\nVersioning\nEvaluation\nAudit\nObservability\nCost controls<\/code><\/pre>\n\n\n\n
\n\n\n\n26. Final NorthStar relationship<\/h1>\n\n\n\n
\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 MANY EXPERIENCES \u2502\n \u2502 \u2502\n \u2502 SimpleChat \u2022 Teams \u2022 M365 \u2502\n \u2502 Web \u2022 Mobile \u2022 Executive \u2502\n \u2502 Voice \u2022 APIs \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 APIM + \u2502\n \u2502 ENTRA SECURITY \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 ORCHESTRATOR \u2551\n \u2551 \u2551\n \u2551 Intent \u2192 Plan \u2192 Policy \u2192 Route \u2192 Execute \u2551\n \u2551 \u2192 Validate \u2192 Synthesize \u2551\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n \u2502 \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557 \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 MULTI-AGENT \u2551 \u2551 TOOLBOX \u2551\n \u2551 ESTATE \u2551 \u2551 \u2551\n \u2551 \u2551 \u2551 Knowledge \u2551\n \u2551 Research \u2551 \u2551 Cases \u2551\n \u2551 Investigation \u2551 \u2551 Market \u2551\n \u2551 Market \u2551 \u2551 Documents \u2551\n \u2551 Compliance \u2551 \u2551 Communications \u2551\n \u2551 Evidence \u2551 \u2551 Enterprise \u2551\n \u2551 Documents \u2551 \u2551 MCP \/ OpenAPI \u2551\n \u2551 Executive \u2551 \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n \u255a\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u255d \u2502\n \u2502 \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 SHARED INTELLIGENCE \u2551\n \u2551 \u2551\n \u2551 Foundry IQ \u2022 AI Search \u2551\n \u2551 APIs \u2022 Enterprise Data \u2551\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n \u2502\n \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 MEMORY FABRIC \u2551\n \u2551 \u2551\n \u2551 Redis \u2192 Cosmos \u2192 AI Search \u2551\n \u2551 Short \u2192 Durable \u2192 Semantic \u2551\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n \u2502\n \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 GOVERNANCE & EVALUATION \u2551\n \u2551 \u2551\n \u2551 Entra \u2022 Agent 365 \u2022 Purview \u2551\n \u2551 Defender \u2022 Policy \u2022 Audit \u2551\n \u2551 App Insights \u2022 Evaluation \u2551\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d<\/code><\/pre>\n\n\n\n EXPERIENCES\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 SimpleChat \u2502 Teams \u2502 M365 Copilot \u2502 Web \u2502 Mobile \u2502 APIs \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n Microsoft Entra ID\n \u2502\n \u25bc\n APIM \/ WAF\n \u2502\n \u25bc\n ORCHESTRATOR\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502 \u2502\n \u25bc \u25bc\n Foundry Agent Estate Foundry IQ\n \u2502\n \u2502 MCP \/ A2A\n \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 FOUNDRY TOOLBOX \u2551\n \u2551 governed reusable tools \u2551\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n \u2502 MCP\n \u25bc\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n \u2551 MCP SERVER \u2551\n \u2551 \u2551\n \u2551 Case Tools \u2551\n \u2551 Evidence Tools \u2551\n \u2551 Market Tools \u2551\n \u2551 Regulatory Tools \u2551\n \u2551 Document Tools \u2551\n \u2551 Enterprise Tools \u2551\n \u255a\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u255d\n \u2502\n Managed Identity\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc \u25bc\n APIs Cosmos DB AI Search\n Case Mgmt Storage Databases\n Market SharePoint Enterprise\n Systems<\/code><\/pre>\n\n\n\n
\n\n\n\n1. First: understand what MCP actually does<\/h1>\n\n\n\n
Agent\n \u2502\n \u2502 \"Search case 123\"\n \u25bc\nMCP Client\n \u2502\n \u2502 MCP tools\/call\n \u25bc\nMCP Server\n \u2502\n \u2502 business API call\n \u25bc\nCase API<\/code><\/pre>\n\n\n\nsearch_cases()\nget_case()\nsearch_case_evidence()\nsearch_market_data()\nsearch_regulations()<\/code><\/pre>\n\n\n\nSQL\nREST URL\nCosmos container\ndatabase credentials\ninternal service topology<\/code><\/pre>\n\n\n\n
\n\n\n\n2. Why I recommend Foundry Toolbox + MCP<\/h1>\n\n\n\n
Research Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\nInvestigation Agent \u2500\u2500\u2500\u2524\nMarket Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\nCompliance Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2524\u2500\u2500> MCP\nDocument Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\nExecutive Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/code><\/pre>\n\n\n\nResearch Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\nInvestigation Agent \u2500\u2500\u2500\u2524\nMarket Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\nCompliance Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2524\nDocument Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\nExecutive Agent \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n \u2502\n \u25bc\n Toolbox\n \u2502\n \u25bc\n MCP Server<\/code><\/pre>\n\n\n\n
\n\n\n\n3. What I would build for<\/h1>\n\n\n\n
TOOL FABRIC\n\u2502\n\u251c\u2500\u2500-knowledge-mcp\n\u2502 \u251c\u2500\u2500 search_regulations\n\u2502 \u251c\u2500\u2500 search_policies\n\u2502 \u251c\u2500\u2500 search_procedures\n\u2502 \u2514\u2500\u2500 retrieve_authoritative_document\n\u2502\n\u251c\u2500\u2500-case-mcp\n\u2502 \u251c\u2500\u2500 search_cases\n\u2502 \u251c\u2500\u2500 get_case\n\u2502 \u251c\u2500\u2500 get_case_timeline\n\u2502 \u251c\u2500\u2500 search_case_evidence\n\u2502 \u2514\u2500\u2500 get_case_document\n\u2502\n\u251c\u2500\u2500-market-mcp\n\u2502 \u251c\u2500\u2500 search_market_data\n\u2502 \u251c\u2500\u2500 get_market_snapshot\n\u2502 \u251c\u2500\u2500 search_trading_activity\n\u2502 \u2514\u2500\u2500 surveillance_query\n\u2502\n\u251c\u2500\u2500-document-mcp\n\u2502 \u251c\u2500\u2500 analyze_document\n\u2502 \u251c\u2500\u2500 compare_documents\n\u2502 \u251c\u2500\u2500 extract_document\n\u2502 \u2514\u2500\u2500 summarize_document\n\u2502\n\u2514\u2500\u2500-enterprise-mcp\n \u251c\u2500\u2500 approved Graph operations\n \u251c\u2500\u2500 approved databases\n \u251c\u2500\u2500 approved reporting\n \u2514\u2500\u2500 approved enterprise APIs<\/code><\/pre>\n\n\n\n
\n\n\n\n4. MCP server hosting choice<\/h1>\n\n\n\n
Option A \u2014 Azure Functions<\/h3>\n\n\n\n
https://<function-app>.azurewebsites.net\/runtime\/webhooks\/mcp<\/code><\/pre>\n\n\n\nOption B \u2014 Azure Container Apps<\/h3>\n\n\n\n
Python\nMCP SDK\nFastAPI\/Uvicorn\nContainer<\/code><\/pre>\n\n\n\nTLS\nscaling\nmanaged identity\nnetworking\nauthentication\ncontainer hosting<\/code><\/pre>\n\n\n\nOption C \u2014 AKS<\/h3>\n\n\n\n
large tool estate\ncomplex service mesh\ncustom ingress\nmulti-region active\/active\nadvanced Kubernetes policy<\/code><\/pre>\n\n\n\n
\n\n\n\n5. My recommendation for your deployment<\/h1>\n\n\n\n
Microsoft Foundry\n \u2502\n \u2502 Agent identity\n \u25bc\n Foundry Toolbox\n \u2502\n \u2502 MCP\n \u25bc\n Azure APIM\n \u2502\n JWT \/ RBAC \/ policy\n \u2502\n \u25bc\n MCP Server\n Azure Container Apps\n \u2502\n Managed Identity\n \u2502\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u25bc \u25bc \u25bc\n APIs Cosmos Search<\/code><\/pre>\n\n\n\n
\n\n\n\n6. Create the MCP project<\/h1>\n\n\n\n
from mcp.server import MCPServer<\/code><\/pre>\n\n\n\nfrom mcp.server.fastmcp import FastMCP<\/code><\/pre>\n\n\n\nFastMCP<\/code> to MCPServer<\/code>.<\/p>\n\n\n\nmkdir cftc-mcp-server\ncd cftc-mcp-server\n\npython -m venv .venv<\/code><\/pre>\n\n\n\nsource .venv\/bin\/activate<\/code><\/pre>\n\n\n\n.venv\\Scripts\\Activate.ps1<\/code><\/pre>\n\n\n\npip install \"mcp[cli]\"\npip install fastapi uvicorn\npip install httpx\npip install azure-identity\npip install pydantic pydantic-settings<\/code><\/pre>\n\n\n\n
\n\n\n\n7. Project structure<\/h1>\n\n\n\n
cftc-mcp-server\/\n\u2502\n\u251c\u2500\u2500 src\/\n\u2502 \u2514\u2500\u2500 cftc_mcp\/\n\u2502 \u251c\u2500\u2500 __init__.py\n\u2502 \u251c\u2500\u2500 server.py\n\u2502 \u251c\u2500\u2500 backend.py\n\u2502 \u251c\u2500\u2500 security.py\n\u2502 \u251c\u2500\u2500 config.py\n\u2502 \u2514\u2500\u2500 app.py\n\u2502\n\u251c\u2500\u2500 tests\/\n\u2502 \u2514\u2500\u2500 test_server.py\n\u2502\n\u251c\u2500\u2500 Dockerfile\n\u251c\u2500\u2500 requirements.txt\n\u251c\u2500\u2500 .env\n\u2514\u2500\u2500 .gitignore<\/code><\/pre>\n\n\n\n
\n\n\n\n8. Configuration<\/h1>\n\n\n\n
config.py<\/code><\/h2>\n\n\n\nfrom pydantic_settings import BaseSettings, SettingsConfigDict\n\n\nclass Settings(BaseSettings):\n\n model_config = SettingsConfigDict(\n env_file=\".env\",\n extra=\"ignore\"\n )\n\n backend_base_url: str\n\n backend_scope: str\n\n environment: str = \"dev\"\n\n request_timeout_seconds: float = 45\n\n max_search_limit: int = 50\n\n\nsettings = Settings()<\/code><\/pre>\n\n\n\n
\n\n\n\n9. Environment variables<\/h1>\n\n\n\n
.env<\/code>:<\/p>\n\n\n\n