Azure Enterprise Infra Planner Skill Security Audit

17   f. "Other" — this should be a custom input field.185. Run the `insights_get` tool using a general-purpose subagent. Pass a one-line summary via the `--query` option that describes the user's infrastructure and the types of insights to prioritise. Do not pass the `--nocache` flag unless the user has explicitly asked for it. Begin Phase 2 while this tool runs.196. Once the tool finishes, save the resulting JSON to `<project-root>/.azure/insights.json`. Do not include tool call metadata. If the tool errors or returns no insights, write an empty array `[]` to the file instead.207. In referenced mode, merge one insight entry for every existing resource into the current insights array. Set `existingResource.id`, `type`, `name`, `role`, `must_not_recreate: true`, and `integrationPoints` using the normalized inventory. Preserve full ARM IDs for actual-state resources and do not duplicate an entry already identified by the same resource ID. Do this even when the resource produces no broader insight.

7273In referenced mode:7475- Include exactly one entry for every inventoried existing resource, uniquely identified by `existingResource.id`.76- Preserve the full ARM ID in `existingResource.id` for actual-state resources.77- Use an empty `integrationPoints` array when the resource has no integration points.78- A resource-only entry may omit `pattern` and `implication`; when recording a broader insight, include both.

62. If no insights file exists, check whether the `insights_get` tool is available. If it is not, initialize the file with `[]`, then continue to step 7 in referenced mode or proceed to the gate in greenfield mode.73. Ask the user which scope to use for generating insights. Present these three options:8   a. "Subscription-scoped (default subscription)" — use this as the default if the user does not respond.9   b. "Subscription-scoped (choose a subscription)" — if selected, ask the user to provide a subscription name or ID.10   c. "Tenant-scoped (slower)"114. Ask the user whether there are specific areas they want the insights to focus on. Present these options:

4142- `draft` — set by Phase 4 when the plan is written.43- `approved` — set by Phase 5 only after the user explicitly approves. Required before Phase 6 and Phase 7.44- `deployed` — set by Phase 7 after a successful `az deployment ... create` or `terraform apply`.45

1# Phase 6: Generate IaC23> Important: Before continuing this phase, `meta.status` must be set to `approved` as required by Phase 5.451. Ask the user whether to generate Bicep or Terraform.62. Generate IaC from the approved plan. Refer to [bicep-generation.md](../bicep-generation.md) for Bicep or [terraform-generation.md](../terraform-generation.md) for Terraform.73. **Apply secure-by-default (mandatory).** Unless the approved plan explicitly overrides a control, every generated resource must use:

1314## Gate15- Every item in **both** checklists pass (or have been fixed).16- Present plan to user and wait for manual and explicit approval before proceeding.17  - Edit `meta.status` to `approved` if approved.18  - Otherwise, ask the user for improvements, and return to Phase 2, 3, or 4 based on the nature of their request.

75  destroy** against them — abort if the plan proposes destroying or replacing a referenced resource.76- **Preview first.** Always run `az deployment ... --what-if` (Bicep) or `terraform plan` (Terraform)77  and confirm the diff only *creates* new resources and *modifies nothing* on the referenced ones before78  applying.79- **Deploy into the existing scope when integrating.** Target the referenced resource group/subscription80  so RBAC, private endpoints, and diagnostics wire into the existing resources.81

2425Scope selection: use resource-group scope when your template deploys into an existing resource group. Use subscription scope when your template creates resource groups or other subscription-level resources (policies, role assignments, etc.).26

69  "deploy" reply sent *after* the risks are shown. The original prompt never satisfies the gate.70- **Additive only.** The deployment must *add* the new resources and their wiring. The referenced71  resources are declared as `existing`/`data` (not `resource`), so a normal deploy never touches them.72- **Incremental mode, never Complete.** For Bicep use the default **incremental** mode — never

78  applying.79- **Deploy into the existing scope when integrating.** Target the referenced resource group/subscription80  so RBAC, private endpoints, and diagnostics wire into the existing resources.81

1415Read `.azure/insights.json` produced by Phase 1 and evaluate each insight against the current workload and sub-goals identified in Phase 2:16* If an insight applies, prefer it over defaults — especially for region, SKU tier, security posture, naming, and tagging.17* If an insight doesn't apply, document the intentional omission in `overallReasoning.tradeoffs`.18* Insights can shape both resource selection and property configuration.19* Track each insight you apply in `inputs.insightsApplied` so the user can trace why a decision was made.2021> Mandatory Security rule: only apply a security-related insight if it results in an equal or stronger security posture than the alternatives. A weaker security posture from an insight is only acceptable when the user has explicitly requested it in the initial prompt.22

2021> Mandatory Security rule: only apply a security-related insight if it results in an equal or stronger security posture than the alternatives. A weaker security posture from an insight is only acceptable when the user has explicitly requested it in the initial prompt.22

3334| `targetScope` | When to use | Command |35|---|---|---|36| `resourceGroup` (default) | All resources in one resource group | `az deployment group create` |37| `subscription` | Resources span multiple resource groups, or includes subscription-level resources (policy, RBAC, resource group creation) | `az deployment sub create` |38

100101# Preview changes102terraform plan -var-file=prod.tfvars -out=tfplan103104# Apply (requires confirmation)105terraform apply tfplan106```

12131. Confirm subscription and resource group with user142. Select the correct deployment scope based on `targetScope` in `main.bicep` (resource group, subscription, management group, or tenant)153. Run `az bicep build` to validate, then execute the matching scope command (`az deployment group create`, `az deployment sub create`, etc.) or `terraform apply`16