citadel-spoke-onboarding

Onboarding a Foundry project as a governed spoke involves deploying access contract artifacts like APIM products and subscriptions, then configuring a Foundry APIM connection to route LLM traffic through the Citadel hub gateway.

Routing Foundry LLM traffic for VNet-isolated workloads uses Foundry Connection routing instead of Key Vault secret pulls, securely directing model calls through the Citadel hub APIM gateway without exposing keys.

Yes, you can enforce optional JWT authentication on top of gateway access, applying security posture layers alongside per-product policies like allowed models, token limits, and content safety.

Yes, mapping service codes to Citadel hub APIM API IDs is a required step to set deployment parameters correctly in the bicepparam template before provisioning the access contract.

The best way to apply per-product policies is by provisioning access contracts via IaC, which automatically binds model restrictions, token limits, and content safety rules to the APIM subscriptions.

Foundry Connection routing is required for VNet-isolated spokes to maintain a keyless-by-mandate security posture, avoiding direct Key Vault secret pulls while securely routing traffic through the gateway.